CVE-2004-2771
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier...
CVE-2004-2771 is a high vulnerability (CVSS 7.5) in Bsd Mailx Project Mailx, published December 10, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.86%, the 94th percentile. Fixed in mailx 12.5-36.
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
Exploit likelihood
What each source reports
NVD Score used
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
CVE-2004-2771- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
CVE-2004-2771- Updated
- 2026-11-02
EUVDEUVD-2004-2761 No score
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
EUVD-2004-2761- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3f68-9fxg-g2j6 No score
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier...
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
GHSA-3f68-9fxg-g2j6- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVAZL-36961 No score
CVE-2004-2771 affecting package mailx for versions less than 12.5-36
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
AZL-36961- Updated
- 2026-11-02
OSVAZL-6676 No score
CVE-2004-2771 affecting package mailx for versions less than 12.5-34
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
AZL-6676- Updated
- 2026-11-02
Show 7 moreShow less
OSVAZL-7286 No score
CVE-2004-2771 affecting package mailx for versions less than 12.5-34
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
AZL-7286- Updated
- 2026-11-02
OSV No score
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
CVE-2004-2771- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-2771 No score
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
DEBIAN-CVE-2004-2771- Updated
- 2026-11-02
OSVMGASA-2014-0538 No score
Updated nail package fixes security vulnerabilities
Updated nail package fixes security vulnerabilities:
A flaw was found in the way mailx handled the parsing of email addresses. A syntactically valid email address could allow a local attacker to cause mailx to execute arbitrary shell commands through shell meta-characters and the direct command execution functionality (CVE-2004-2771, CVE-2014-7844).
- Record
MGASA-2014-0538- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10561-1 No score
mailx-12.5-24.4 on GA media
These are all security issues fixed in the mailx-12.5-24.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10561-1- Updated
- 2026-11-02
OSVSUSE-RU-2015:0876-1 No score
Recommended update for mailx
This update for mailx enables IPv6 support and includes the following fixes:
* Crop off the brackets of an ipv6 address if found. (bnc#853246)
* Enable mailx to parse IPv6 addresses including a port ([ipv6]:port).
(bnc#853246)
* Do not pseudo detect Latin nor UTF-8 in binary attachments.
(bnc#827010)
- Record
SUSE-RU-2015:0876-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2004-2771 No score
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
- Record
UBUNTU-CVE-2004-2771- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mailxAzure Linux:3 |
before 12.5-36 | 12.5-36 |
mailxAzure Linux:2 |
before 12.5-34 | 12.5-34 |
bsd-mailxDebian:12 |
before 8.1.2-0.20071201cvs-1 | 8.1.2-0.20071201cvs-1 |
bsd-mailxDebian:13 |
before 8.1.2-0.20071201cvs-1 | 8.1.2-0.20071201cvs-1 |
bsd-mailxDebian:14 |
before 8.1.2-0.20071201cvs-1 | 8.1.2-0.20071201cvs-1 |
heirloom-mailxDebian:6.0 |
before 12.4-2+deb6u1, plus listed versions 12.4-2 |
12.4-2+deb6u1 |
heirloom-mailxDebian:7 |
before 12.5-2+deb7u1, plus listed versions 12.5-2 |
12.5-2+deb7u1 |
nailMageia:4 |
before 12.4-9.1.mga4 | 12.4-9.1.mga4 |
mailxRed Hat:enterprise_linux:6::client |
before 0:12.4-8.el6_6 | 0:12.4-8.el6_6 |
mailx-debuginfoRed Hat:enterprise_linux:6::client |
before 0:12.4-8.el6_6 | 0:12.4-8.el6_6 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mailxRed Hat:enterprise_linux:6::computenode |
before 0:12.4-8.el6_6 | 0:12.4-8.el6_6 |
mailx-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:12.4-8.el6_6 | 0:12.4-8.el6_6 |
mailxRed Hat:enterprise_linux:6::server |
before 0:12.4-8.el6_6 | 0:12.4-8.el6_6 |
mailx-debuginfoRed Hat:enterprise_linux:6::server |
before 0:12.4-8.el6_6 | 0:12.4-8.el6_6 |
mailxRed Hat:enterprise_linux:6::workstation |
before 0:12.4-8.el6_6 | 0:12.4-8.el6_6 |
mailx-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:12.4-8.el6_6 | 0:12.4-8.el6_6 |
mailxRed Hat:enterprise_linux:7::client |
before 0:12.5-12.el7_0 | 0:12.5-12.el7_0 |
mailx-debuginfoRed Hat:enterprise_linux:7::client |
before 0:12.5-12.el7_0 | 0:12.5-12.el7_0 |
mailxRed Hat:enterprise_linux:7::computenode |
before 0:12.5-12.el7_0 | 0:12.5-12.el7_0 |
mailx-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:12.5-12.el7_0 | 0:12.5-12.el7_0 |
mailxRed Hat:enterprise_linux:7::server |
before 0:12.5-12.el7_0 | 0:12.5-12.el7_0 |
mailx-debuginfoRed Hat:enterprise_linux:7::server |
before 0:12.5-12.el7_0 | 0:12.5-12.el7_0 |
mailxRed Hat:enterprise_linux:7::workstation |
before 0:12.5-12.el7_0 | 0:12.5-12.el7_0 |
mailx-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:12.5-12.el7_0 | 0:12.5-12.el7_0 |
heirloom-mailxUbuntu:14.04:LTS |
before 12.5-2+deb7u1build0.14.04.1, plus listed versions 12.5-2 |
12.5-2+deb7u1build0.14.04.1 |
mailxopenSUSE:Tumbleweed |
before 12.5-24.4 | 12.5-24.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
linux.oracle.com/errata/ELSA-2014-1999.html
debian.org/security/2014/dsa-3105
secunia.com/advisories/61693
bugs.debian.org/cgi-bin/bugreport.cgi?bug=278748
seclists.org/oss-sec/2014/q4/1066
Show 24 moreShow less
rhn.redhat.com/errata/RHSA-2014-1999.html
nvd.nist.gov/vuln/detail/CVE-2004-2771
access.redhat.com/errata/RHSA-2014:1999
bugzilla.redhat.com/show_bug.cgi?id=1162783
github.com/advisories/GHSA-3f68-9fxg-g2j6
security-tracker.debian.org/tracker/CVE-2004-2771
advisories.mageia.org/MGASA-2014-0538.html
bugs.mageia.org/show_bug.cgi?id=14828
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1999.json
cve.org/CVERecord?id=CVE-2004-2771
suse.com/support/update/announcement//suse-ru-20150876-1
bugzilla.suse.com/827010
ubuntu.com/security/CVE-2004-2771