CVE-2014-3956
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong...
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
Exploit likelihood
What each source reports
NVD Score used
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
- Record
CVE-2014-3956- CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
- Record
CVE-2014-3956- Updated
- 2026-11-02
EUVDEUVD-2014-3889 No score
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
- Record
EUVD-2014-3889- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-frwj-4rf4-3wjf No score
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong...
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
- Record
GHSA-frwj-4rf4-3wjf- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
- Record
CVE-2014-3956- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3956 No score
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
- Record
DEBIAN-CVE-2014-3956- Updated
- 2026-11-02
OSVMGASA-2014-0270 No score
Updated sendmail packages fix CVE-2014-3956
Updated sendmail packages fix security vulnerability:
Sendmail before 8.14.9 does not properly closing file descriptors before executing programs. This bug could enable local users to interfere with an open SMTP connection if they can execute their own program for mail delivery (e.g., via procmail or the prog mailer) (CVE-2014-3956).
- Record
MGASA-2014-0270- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3956 No score
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
- Record
UBUNTU-CVE-2014-3956- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sendmailDebian:12 |
before 8.14.4-6 | 8.14.4-6 |
sendmailDebian:13 |
before 8.14.4-6 | 8.14.4-6 |
sendmailDebian:14 |
before 8.14.4-6 | 8.14.4-6 |
sendmailMageia:3 |
before 8.14.6-2.1.mga3 | 8.14.6-2.1.mga3 |
sendmailMageia:4 |
before 8.14.7-3.1.mga4 | 8.14.7-3.1.mga4 |
sendmailUbuntu:14.04:LTS |
before 8.14.4-4.1ubuntu1.1, plus listed versions 8.14.4-2.1ubuntu48.14.4-2.1ubuntu58.14.4-4.1ubuntu1 |
8.14.4-4.1ubuntu1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3956 is a low vulnerability (CVSS 1.9) in Sendmail, published June 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in sendmail 8.14.4-6.
References
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05216368
secunia.com/advisories/58628
freebsd.org/security/advisories/FreeBSD-SA-14%3A11.sendmail.asc
mandriva.com/security/advisories?name=MDVSA-2015:128
packetstormsecurity.com/files/126975/Slackware-Security-Advisory-sendmail-Updates.html
security.gentoo.org/glsa/glsa-201412-32.xml
Show 17 moreShow less
sendmail.com/sm/open_source/download/8.14.9
lists.opensuse.org/opensuse-updates/2014-06/msg00032.html
lists.fedoraproject.org/pipermail/package-announce/2014-June/134349.html
securityfocus.com/bid/67791
advisories.mageia.org/MGASA-2014-0270.html
slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.728644
securitytracker.com/id/1030331
nvd.nist.gov/vuln/detail/CVE-2014-3956
github.com/advisories/GHSA-frwj-4rf4-3wjf
security-tracker.debian.org/tracker/CVE-2014-3956
bugs.mageia.org/show_bug.cgi?id=13431
ubuntu.com/security/CVE-2014-3956
openwall.com/lists/oss-security/2014/06/03/1
cve.org/CVERecord?id=CVE-2014-3956