CVE-2004-2771
Fixed in a distro release EPSS 7%
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
Products: oracle linux, redhat enterprise_linux, bsd_mailx_project bsd_mailx, heirloom mailx
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | bsd-mailx | 8.1.2-0.20071201cvs-1 |
| Debian 13 | bsd-mailx | 8.1.2-0.20071201cvs-1 |
| Debian 14 | bsd-mailx | 8.1.2-0.20071201cvs-1 |
| Debian 6.0 | heirloom-mailx | 12.4-2+deb6u1 |
| Debian 7 | heirloom-mailx | 12.5-2+deb7u1 |
| Red Hat Enterprise Linux 6 | mailx | 0:12.4-8.el6_6 |
| Red Hat Enterprise Linux 6 | mailx-debuginfo | 0:12.4-8.el6_6 |
| Red Hat Enterprise Linux 7 | mailx | 0:12.5-12.el7_0 |
| Red Hat Enterprise Linux 7 | mailx-debuginfo | 0:12.5-12.el7_0 |
| Ubuntu 14.04 LTS | heirloom-mailx | 12.5-2+deb7u1build0.14.04.1 |
| openSUSE Tumbleweed | mailx | 12.5-24.4 |