Every CVE Search/ Get API key

CVE-2014-3618

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to...

7.5 HighFix available

CVE-2014-3618 is a high vulnerability (CVSS 7.5) in Procmail, published September 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.87%, the 95th percentile. Fixed in procmail 3.22-53.

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Exploit likelihood

8.87%Up 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
CVE-2014-3618
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
CVE-2014-3618
Updated
2026-11-02
EUVDEUVD-2014-3581 No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
EUVD-2014-3581
Updated
2026-11-03
GitHub AdvisoriesGHSA-j8hf-r298-62j6 No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to...

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
GHSA-j8hf-r298-62j6
Weakness
CWE-119
Updated
2026-11-02
OSVAZL-36981 No score

CVE-2014-3618 affecting package procmail for versions less than 3.22-53

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
AZL-36981
Updated
2026-11-02
OSVAZL-6802 No score

CVE-2014-3618 affecting package procmail for versions less than 3.22-53

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
AZL-6802
Updated
2026-11-02
Show 7 moreShow less
OSVAZL-7331 No score

CVE-2014-3618 affecting package procmail for versions less than 3.22-53

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
AZL-7331
Updated
2026-11-02
OSV No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
CVE-2014-3618
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3618 No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
DEBIAN-CVE-2014-3618
Updated
2026-11-02
OSVMGASA-2014-0373 No score

Updated procmail packages fix CVE-2014-3618

Updated procmail package fixes security vulnerability:

A heap-based buffer overflow was reported in procmail's formail utility when parsing addresses with unbalanced quotes (CVE-2014-3618).

Record
MGASA-2014-0373
Updated
2026-11-02
OSVopenSUSE-SU-2024:10533-1 No score

procmail-3.22-270.9 on GA media

These are all security issues fixed in the procmail-3.22-270.9 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10533-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3618 No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
UBUNTU-CVE-2014-3618
Updated
2026-11-02
OSVUSN-2340-1 No score

procmail vulnerability

Tavis Ormandy discovered that the formail tool incorrectly handled certain malformed mail headers. An attacker could use this flaw to cause formail to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-2340-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
procmail
Azure Linux:3
 before 3.22-53
3.22-53
procmail
Azure Linux:2
 before 3.22-53
3.22-53
procmail
Debian:12
 before 3.22-22
3.22-22
procmail
Debian:13
 before 3.22-22
3.22-22
procmail
Debian:14
 before 3.22-22
3.22-22
procmail
Debian:6.0
 before 3.22-19+deb6u1, plus listed versions
3.22-19
3.22-19+deb6u1
procmail
Debian:7
 before 3.22-20+deb7u1, plus listed versions
3.22-20
3.22-20+deb7u1
procmail
Mageia:3
 before 3.22-18.1.mga3
3.22-18.1.mga3
procmail
Mageia:4
 before 3.22-19.1.mga4
3.22-19.1.mga4
procmail
Red Hat:enterprise_linux:5::client
 before 0:3.22-17.1.2
0:3.22-17.1.2
Show 19 moreShow less
Affected packages
PackageAffectedFixed
procmail-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:3.22-17.1.2
0:3.22-17.1.2
procmail
Red Hat:enterprise_linux:5::server
 before 0:3.22-17.1.2
0:3.22-17.1.2
procmail-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:3.22-17.1.2
0:3.22-17.1.2
procmail
Red Hat:enterprise_linux:6::client
 before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail
Red Hat:enterprise_linux:6::computenode
 before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail
Red Hat:enterprise_linux:6::server
 before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail
Red Hat:enterprise_linux:6::workstation
 before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail
Red Hat:enterprise_linux:7::client
 before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail
Red Hat:enterprise_linux:7::server
 before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail
Red Hat:enterprise_linux:7::workstation
 before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail
Ubuntu:14.04:LTS
 before 3.22-21ubuntu0.1, plus listed versions
3.22-203.22-21
3.22-21ubuntu0.1
procmail
openSUSE:Tumbleweed
 before 3.22-270.9
3.22-270.9

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open