Alpine: multiple spamassassin packages, perl-mail-spamassassin: security update to 3.4.3-r0

critical Tenable Cloud Security Plugin ID 424526

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
(CVE-2018-11780)

- (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4)
cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7)
cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10)
cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails,
(13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-
ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18)
utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL,
(23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and
5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory
array, which might allow local users to gain privileges via a Trojan horse module under the current
working directory. (CVE-2016-1238)

- A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The
vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly
leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the
begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close"
event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the
"text" event to deal with the object normally. This can cause carefully crafted emails that might take
more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design
decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly
formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a
Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the
future. (CVE-2017-15705)

- Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. (CVE-2018-11781)

Plugin Details

Severity: Critical

ID: 424526

Version: Revision 1.11

Type: Local

Family: Alpine Linux Local Security Checks

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.35

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2018-11780

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/26/2016

Reference Information

CVE: CVE-2016-1238, CVE-2017-15705, CVE-2018-11780, CVE-2018-11781, CVE-2018-11805, CVE-2019-12420

BID: 105347, 105373, 92136

IAVA: 2018-A-0332-S

Detections

Analytics