CVE-2005-1513
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms...
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
9.8
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
- Record
CVE-2005-1513- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
- Record
CVE-2005-1513- Updated
- 2026-11-02
EUVDEUVD-2005-1516 No score
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
- Record
EUVD-2005-1516- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mrmc-m8fj-g9px
9.8
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms...
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
- Record
GHSA-mrmc-m8fj-g9px- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2005-1513
9.8
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
- Record
UBUNTU-CVE-2005-1513- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-4556-1 No score
netqmail vulnerabilities
It was discovered that netqmail did not properly handle certain input. Both remote and local attackers could use this vulnerability to cause netqmail to crash or execute arbitrary code. (CVE-2005-1513, CVE-2005-1514, CVE-2005-1515)
It was discovered that netqmail did not properly handle certain input when validating email addresses. An attacker could use this to bypass email address validation. (CVE-2020-3811)
It was discovered that netqmail did not properly handle certain input when validating email addresses. An attacker could use this vulnerability to cause netqmail to disclose sensitive information. (CVE-2020-3812)
- Record
USN-4556-1- Updated
- 2026-11-02
OSVUSN-4621-1 No score
netqmail vulnerabilities
It was discovered that netqmail did not properly handle certain input. Both remote and local attackers could use this vulnerability to cause netqmail to crash or execute arbitrary code. (CVE-2005-1513, CVE-2005-1514, CVE-2005-1515)
It was discovered that netqmail did not properly handle certain input when validating email addresses. An attacker could use this to bypass email address validation. (CVE-2020-3811)
It was discovered that netqmail did not properly handle certain input when validating email addresses. An attacker could use this vulnerability to cause netqmail to disclose sensitive information. (CVE-2020-3812)
- Record
USN-4621-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
netqmailDebian:8 From an advisory covering 5 CVEs |
before 1.06-6.2~deb8u1, plus listed versions 1.06-51.06-61.06-6.1 |
1.06-6.2~deb8u1 |
netqmailDebian:9 From an advisory covering 5 CVEs |
before 1.06-6.2~deb9u1, plus listed versions 1.06-61.06-6.11.06-6.2~deb8u1 |
1.06-6.2~deb9u1 |
netqmailDebian:10 From an advisory covering 5 CVEs |
before 1.06-6.2~deb10u1, plus listed versions 1.06-61.06-6.11.06-6.2~deb8u11.06-6.2~deb9u1 |
1.06-6.2~deb10u1 |
netqmailUbuntu:Pro:14.04:LTS |
before 1.06-6.2~deb10u1build0.14.04.1+esm1, plus listed versions 1.06-5 |
1.06-6.2~deb10u1build0.14.04.1+esm1 |
netqmailUbuntu:16.04:LTS |
before 1.06-6.2~deb10u1build0.16.04.1, plus listed versions 1.06-5 |
1.06-6.2~deb10u1build0.16.04.1 |
netqmailUbuntu:18.04:LTS |
before 1.06-6.2~deb10u1build0.18.04.1, plus listed versions 1.06-6 |
1.06-6.2~deb10u1build0.18.04.1 |
netqmailUbuntu:20.04:LTS |
before 1.06-6.2~deb10u1build0.20.04.1, plus listed versions 1.06-6.1 |
1.06-6.2~deb10u1build0.20.04.1 |
netqmailUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 1.06-6.2~deb10u1build0.20.04.1, plus listed versions 1.06-6.1 |
1.06-6.2~deb10u1build0.20.04.1 |
netqmailUbuntu:16.04:LTS From an advisory covering 5 CVEs |
before 1.06-6.2~deb10u1build0.16.04.1, plus listed versions 1.06-5 |
1.06-6.2~deb10u1build0.16.04.1 |
netqmailUbuntu:18.04:LTS From an advisory covering 5 CVEs |
before 1.06-6.2~deb10u1build0.18.04.1, plus listed versions 1.06-6 |
1.06-6.2~deb10u1build0.18.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-1513 is a critical vulnerability (CVSS 9.8) in Qmail Project Qmail, published May 11, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.8%, the 95th percentile. Fixed in netqmail 1.06-6.2~deb10u1build0.14.04.1+esm1.
References
archives.neohapsis.com/archives/fulldisclosure/2005-05/0101.html
guninski.com/where_do_you_want_billg_to_go_today_4.html
securitytracker.com/id?1013911
openwall.com/lists/oss-security/2020/05/19/8
openwall.com/lists/oss-security/2020/05/20/2
openwall.com/lists/oss-security/2020/05/20/5
Show 22 moreShow less
seclists.org/fulldisclosure/2020/May/42
packetstormsecurity.com/files/157805/Qualys-Security-Advisory-Qmail-Remote-Code-Execution.html
debian.org/security/2020/dsa-4692
lists.debian.org/debian-lts-announce/2020/06/msg00002.html
openwall.com/lists/oss-security/2020/06/16/2
seclists.org/fulldisclosure/2020/Jun/27
packetstormsecurity.com/files/158203/Qmail-Local-Privilege-Escalation-Remote-Code-Execution.html
security.gentoo.org/glsa/202007-01
usn.ubuntu.com/4556-1
openwall.com/lists/oss-security/2023/06/06/3
seclists.org/fulldisclosure/2023/Jun/2
packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html
nvd.nist.gov/vuln/detail/CVE-2005-1513
github.com/advisories/GHSA-mrmc-m8fj-g9px
ubuntu.com/security/CVE-2005-1513
ubuntu.com/security/notices/USN-4556-1
ubuntu.com/security/notices/USN-4621-1
cve.org/CVERecord?id=CVE-2005-1513
ubuntu.com/security/CVE-2005-1514
ubuntu.com/security/CVE-2005-1515
ubuntu.com/security/CVE-2020-3811
ubuntu.com/security/CVE-2020-3812