CVE-2014-7844

HIGH

Description

BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.

References

http://linux.oracle.com/errata/ELSA-2014-1999.html

http://rhn.redhat.com/errata/RHSA-2014-1999.html

http://seclists.org/oss-sec/2014/q4/1066

http://www.debian.org/security/2014/dsa-3104

http://www.debian.org/security/2014/dsa-3105

Details

Source: MITRE

Published: 2020-01-14

Updated: 2020-01-21

Type: CWE-74

Risk Information

CVSS v2.0

Base Score: 7.2

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 3.9

Severity: HIGH

CVSS v3.0

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.8

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:a:bsd_mailx_project:bsd_mailx:8.1.2:*:*:*:*:*:*:*

Tenable Plugins

View all (21 total)

IDNameProductFamilySeverity
108927GLSA-201804-06 : mailx: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
99238F5 Networks BIG-IP : Mailx vulnerabilities (K16945)NessusF5 Networks Local Security Checks
high
89084Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : mailx (SSA:2016-062-01)NessusSlackware Local Security Checks
high
8981Mac OS X < 10.10.5 Multiple VulnerabilitiesNessus Network MonitorOperating System Detection
high
85408Mac OS X 10.10.x < 10.10.5 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
high
82098Debian DLA-114-1 : heirloom-mailx security updateNessusDebian Local Security Checks
high
82097Debian DLA-113-1 : bsd-mailx security updateNessusDebian Local Security Checks
high
80430Mandriva Linux Security Advisory : nail (MDVSA-2015:011)NessusMandriva Local Security Checks
high
80418Amazon Linux AMI : mailx (ALAS-2015-467)NessusAmazon Linux Local Security Checks
high
80413Ubuntu 10.04 LTS / 12.04 LTS / 14.04 LTS / 14.10 : bsd-mailx vulnerability (USN-2455-1)NessusUbuntu Local Security Checks
high
80345Fedora 19 : mailx-12.5-9.fc19 (2014-17277)NessusFedora Local Security Checks
high
80344Fedora 20 : mailx-12.5-11.fc20 (2014-17245)NessusFedora Local Security Checks
high
80343Fedora 21 : mailx-12.5-14.fc21 (2014-17243)NessusFedora Local Security Checks
high
80274openSUSE Security Update : mailx (openSUSE-SU-2014:1713-1)NessusSuSE Local Security Checks
high
80251SuSE 11.3 Security Update : mailx (SAT Patch Number 10096)NessusSuSE Local Security Checks
high
80075Scientific Linux Security Update : mailx on SL6.x, SL7.x i386/x86_64 (20141216)NessusScientific Linux Local Security Checks
high
80074RHEL 6 / 7 : mailx (RHSA-2014:1999)NessusRed Hat Local Security Checks
high
80071Oracle Linux 6 / 7 : mailx (ELSA-2014-1999)NessusOracle Linux Local Security Checks
high
80058Debian DSA-3105-1 : heirloom-mailx - security updateNessusDebian Local Security Checks
high
80057Debian DSA-3104-1 : bsd-mailx - security updateNessusDebian Local Security Checks
high
80056CentOS 6 / 7 : mailx (CESA-2014:1999)NessusCentOS Local Security Checks
high