{"id":"CVE-2004-2771","aliases":["AZL-36961","AZL-6676","AZL-7286","DEBIAN-CVE-2004-2771","DLA-114-1","DSA-3105-1","EUVD-2004-2761","GHSA-3f68-9fxg-g2j6","MGASA-2014-0538","RHSA-2014:1999","SUSE-RU-2015:0876-1","UBUNTU-CVE-2004-2771","openSUSE-SU-2024:10561-1"],"status":"published","title":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier...","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06858,"percentile":0.94088,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-12-10T16:46:46Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Azure Linux:3","package":"mailx","fixed_in":["12.5-36"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"mailx","fixed_in":["12.5-34"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bsd-mailx","fixed_in":["8.1.2-0.20071201cvs-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bsd-mailx","fixed_in":["8.1.2-0.20071201cvs-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bsd-mailx","fixed_in":["8.1.2-0.20071201cvs-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"heirloom-mailx","fixed_in":["12.5-2+deb7u1build0.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.5-36"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.5-34"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.5-34"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bsd-mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-0.20071201cvs-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bsd-mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-0.20071201cvs-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bsd-mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-0.20071201cvs-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"heirloom-mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4-2+deb6u1"}]}],"versions":["12.4-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"heirloom-mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.5-2+deb7u1"}]}],"versions":["12.5-2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"nail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4-9.1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4-8.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mailx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4-8.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4-8.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mailx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4-8.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4-8.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mailx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4-8.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4-8.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mailx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4-8.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.5-12.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mailx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.5-12.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.5-12.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mailx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.5-12.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.5-12.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mailx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.5-12.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.5-12.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mailx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.5-12.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"heirloom-mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.5-2+deb7u1build0.14.04.1"}]}],"versions":["12.5-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mailx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.5-24.4"}]}],"bundled":2}],"products":[{"vendor":"bsd_mailx_project","product":"bsd_mailx"},{"vendor":"heirloom","product":"mailx"},{"vendor":"oracle","product":"linux"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"http://linux.oracle.com/errata/ELSA-2014-1999.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-3105","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/61693","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278748","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"http://seclists.org/oss-sec/2014/q4/1066","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/60940","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/61585","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1999.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-2771","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1999","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2004-2771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1162783","tags":["report"]},{"url":"https://github.com/advisories/GHSA-3f68-9fxg-g2j6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2004-2771","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0538.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14828","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1999.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1999.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-2771","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7844","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7844","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/827010","tags":["report"]},{"url":"https://bugzilla.suse.com/853246","tags":["report"]},{"url":"https://bugzilla.suse.com/909208","tags":["report"]},{"url":"https://bugzilla.suse.com/922543","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2004-2771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7844","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2004-2771","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2004-2771","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2014-12-24T18:00:00Z","modified":"2024-08-08T01:36:25.354Z","updated_at":"2026-11-02T14:34:53.70484Z"}],"euvd":[{"id":"EUVD-2004-2761","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2014-12-24T18:00:00Z","modified":"2024-08-08T01:36:25Z","updated_at":"2026-11-03T01:15:09.127613Z"}],"ghsa":[{"id":"GHSA-3f68-9fxg-g2j6","title":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier...","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2022-04-29T03:02:04Z","modified":"2023-02-10T05:06:30Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:54:01.789224Z"}],"nvd":[{"id":"CVE-2004-2771","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2014-12-24T18:59:00.103Z","modified":"2026-09-23T13:10:00.153Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:00:53.662124Z"}],"osv":[{"id":"AZL-36961","title":"CVE-2004-2771 affecting package mailx for versions less than 12.5-36","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2014-12-24T18:59:00Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6676","title":"CVE-2004-2771 affecting package mailx for versions less than 12.5-34","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2014-12-24T18:59:00Z","modified":"2026-04-21T04:37:58.136734Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"AZL-7286","title":"CVE-2004-2771 affecting package mailx for versions less than 12.5-34","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2014-12-24T18:59:00Z","modified":"2026-04-21T04:33:44.246662Z","updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2004-2771","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2014-12-24T18:59:00Z","modified":"2026-04-16T06:19:39.055117873Z","updated_at":"2026-11-02T15:43:56.315348Z"},{"id":"DEBIAN-CVE-2004-2771","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2014-12-24T18:59:00.103Z","modified":"2026-10-21T15:47:27.394001401Z","updated_at":"2026-11-02T15:45:22.55978Z"},{"id":"DLA-114-1","title":"heirloom-mailx - security update","status":"published","published":"2014-12-17T00:00:00Z","modified":"2026-03-09T01:00:55.092803Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3105-1","title":"heirloom-mailx - security update","status":"published","published":"2014-12-16T00:00:00Z","modified":"2026-03-09T01:20:10.028792Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0538","title":"Updated nail package fixes security vulnerabilities","description":"Updated nail package fixes security vulnerabilities:\n\nA flaw was found in the way mailx handled the parsing of email addresses.\nA syntactically valid email address could allow a local attacker to cause\nmailx to execute arbitrary shell commands through shell meta-characters and\nthe direct command execution functionality (CVE-2004-2771, CVE-2014-7844).\n","status":"published","published":"2014-12-19T15:06:35Z","modified":"2026-04-16T06:23:17.836766494Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10561-1","title":"mailx-12.5-24.4 on GA media","description":"These are all security issues fixed in the mailx-12.5-24.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:50:30.043252Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2014:1999","title":"Red Hat Security Advisory: mailx security update","status":"published","published":"2024-09-15T22:14:45Z","modified":"2026-06-26T10:25:51Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-RU-2015:0876-1","title":"Recommended update for mailx","description":"\nThis update for mailx enables IPv6 support and includes the following \nfixes:\n\n    * Crop off the brackets of an ipv6 address if found. (bnc#853246)\n    * Enable mailx to parse IPv6 addresses including a port ([ipv6]:port).\n      (bnc#853246)\n    * Do not pseudo detect Latin nor UTF-8 in binary attachments.\n      (bnc#827010)\n\n","status":"published","published":"2013-12-10T16:46:46Z","modified":"2026-02-04T02:23:23.465934Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2004-2771","description":"The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.","status":"published","published":"2014-12-24T18:59:00Z","modified":"2025-09-08T16:42:49Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}