CVE-2018-11780

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

Updated spamassassin package fixes security vulnerabilities:

A reliance on "." in @INC in one configuration script (CVE-2016-1238).

A denial of service vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts (CVE-2017-15705).

A potential Remote Code Execution bug with the PDFInfo plugin (CVE-2018-11780).

A local user code injection in the meta rule syntax (CVE-2018-11781).

This update for spamassassin to version 3.4.2 fixes the following issues:

Security issues fixed:

• CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748).
• CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750).
• CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745).
• CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749).

Non-security issues fixed:

• Use systemd timers instead of cron (bsc#1115411)
• Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765)
• Fixed warning about deprecated regex during sa-update (bsc#1069831)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the perl-Mail-SpamAssassin-3.4.6-71.3 package on the GA media of openSUSE Tumbleweed.

This update for spamassassin to version 3.4.2 fixes the following issues:

Security issues fixed:

• CVE-2017-15705: Fixed denial of service via unclosed tags in crafted emails (bsc#1108745).
• CVE-2018-11781: Fixed a code injection in the meta rule syntax by local users (bsc#1108748).
• CVE-2018-11780: Fixed a potential remote code execution vulnerability in PDFInfo plugin (bsc#1108750).

Non-security issues fixed:

• Added four new plugins (disabled by default): HashBL, ResourceLimits, FromNameSpoof, Phishing
• sa-update script: optional support for SHA-256 / SHA-512 been added for better validation of rules
• GeoIP2 support has been added to RelayCountry and URILocalBL plugins
• Several new or enhanced configuration options

This update for spamassassin to version 3.4.2 fixes the following issues:

Security issues fixed:

• CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748).
• CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750).
• CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745).
• CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749).

Non-security issues fixed:

• Use systemd timers instead of cron (bsc#1115411)
• Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765)
• Fixed warning about deprecated regex during sa-update (bsc#1069831)

It was discovered that SpamAssassin incorrectly handled certain unclosed tags in emails. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2017-15705)

It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2018-11780)

It was discovered that SpamAssassin incorrectly handled meta rule syntax. A local attacker could possibly use this issue to execute arbitrary code. (CVE-2018-11781)