{"id":"CVE-2020-8794","aliases":["ALPINE-CVE-2020-8794","DEBIAN-CVE-2020-8794","DSA-4634-1","EUVD-2020-29642","GHSA-hmw3-c3g9-px9f","UBUNTU-CVE-2020-8794","USN-4294-1","USN-4875-1"],"status":"published","title":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in...","description":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.889,"percentile":0.9978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125"],"published":"2020-02-25T16:38:07Z","modified":"2026-11-03T06:32:37Z","exploits":[{"source":"metasploit","id":"exploit/unix/local/opensmtpd_oob_read_lpe","title":"OpenSMTPD OOB Read Local Privilege Escalation","type":"exploit","platform":"Unix","date":"2020-02-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/local/opensmtpd_oob_read_lpe"},{"source":"exploitdb","id":"EDB-48140","title":"OpenSMTPD \u003c 6.6.3p1 - Local Privilege Escalation + Remote Code Execution","type":"remote","platform":"openbsd","date":"2020-02-26","url":"https://www.exploit-db.com/exploits/48140"},{"source":"exploitdb","id":"EDB-48185","title":"OpenSMTPD - OOB Read Local Privilege Escalation (Metasploit)","type":"local","platform":"linux","date":"2020-03-09","verified":true,"url":"https://www.exploit-db.com/exploits/48185"}],"fixes":[{"ecosystem":"Alpine:v3.13","package":"opensmtpd-extras","fixed_in":["6.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"opensmtpd-extras","fixed_in":["6.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"opensmtpd-extras","fixed_in":["6.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"opensmtpd-extras","fixed_in":["6.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"opensmtpd-extras","fixed_in":["6.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"opensmtpd-extras","fixed_in":["6.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"opensmtpd-extras","fixed_in":["6.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"opensmtpd-extras","fixed_in":["6.6.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"opensmtpd","fixed_in":["6.6.4p1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"opensmtpd","fixed_in":["6.6.4p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensmtpd","fixed_in":["6.6.4p1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"opensmtpd","fixed_in":["6.0.2p1-2+deb9u3"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"opensmtpd","fixed_in":["6.0.3p1-5+deb10u4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensmtpd","fixed_in":["5.7.3p2-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"opensmtpd","fixed_in":["6.0.3p1-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"opensmtpd","fixed_in":["6.6.4p1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"opensmtpd-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"opensmtpd-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"opensmtpd-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"opensmtpd-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"opensmtpd-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"opensmtpd-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"opensmtpd-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"opensmtpd-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4p1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4p1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2p1-2+deb9u3"}]}],"versions":["6.0.2p1-2","6.0.2p1-2+deb9u1","6.0.2p1-2+deb9u2"]},{"source":"osv","ecosystem":"Debian:10","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3p1-5+deb10u4"}]}],"versions":["6.0.3p1-5","6.0.3p1-5+deb10u1","6.0.3p1-5+deb10u2","6.0.3p1-5+deb10u3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3p2-1ubuntu0.1~esm2"}]}],"versions":["5.4.2p1-4","5.7.3p1-1","5.7.3p2-1","5.7.3p2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3p1-1ubuntu0.2"}]}],"versions":["6.0.2p1-2build1","6.0.3p1-1","6.0.3p1-1build1","6.0.3p1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4p1-1"}]}],"versions":["6.0.3p1-6","6.0.3p1-6build1","6.6.1p1-1","6.6.1p1-3","6.6.1p1-4","6.6.1p1-5","6.6.2p1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3p1-1ubuntu0.2"}]}],"versions":["6.0.2p1-2build1","6.0.3p1-1","6.0.3p1-1build1","6.0.3p1-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1p1-1ubuntu0.1~esm1"}]}],"versions":["5.3.3p1-4","5.4.1p1-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3p2-1ubuntu0.1~esm2"}]}],"versions":["5.4.2p1-4","5.7.3p1-1","5.7.3p2-1","5.7.3p2-1ubuntu0.1~esm1"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensmtpd","product":"opensmtpd"}],"references":[{"url":"https://www.openbsd.org/security.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2020/02/24/5","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2020/02/26/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://www.debian.org/security/2020/dsa-4634","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2020/Feb/32","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/03/01/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/03/01/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/156633/OpenSMTPD-Out-Of-Bounds-Read-Local-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4294-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/04/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8794"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/"},{"url":"https://github.com/advisories/GHSA-hmw3-c3g9-px9f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8794","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8794","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8794","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4294-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4875-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-7247","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-8794","description":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.","status":"published","published":"2020-02-25T16:38:07Z","modified":"2024-08-04T10:12:10.566Z","updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-29642","description":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.","status":"published","published":"2020-02-25T16:38:07Z","modified":"2024-08-04T10:12:10Z","updated_at":"2026-11-03T03:07:56.155078Z"}],"ghsa":[{"id":"GHSA-hmw3-c3g9-px9f","title":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in...","description":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.","status":"published","published":"2022-05-24T17:09:38Z","modified":"2023-01-29T05:04:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:45:29.899073Z"}],"nvd":[{"id":"CVE-2020-8794","description":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.","status":"published","published":"2020-02-25T17:15:13.197Z","modified":"2026-06-17T03:26:57.32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:54.796125Z"}],"osv":[{"id":"ALPINE-CVE-2020-8794","description":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.","status":"published","published":"2020-02-25T17:15:13.197Z","modified":"2026-11-03T06:32:37.712295486Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2020-8794","description":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.","status":"published","published":"2020-02-25T17:15:13.197Z","modified":"2026-10-24T14:24:38.885428124Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8794","description":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.","status":"published","published":"2020-02-25T17:15:13.197Z","modified":"2026-10-26T12:02:54.875555734Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"UBUNTU-CVE-2020-8794","description":"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.","status":"published","published":"2020-02-25T17:15:00Z","modified":"2026-04-28T16:21:24.487505Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"DSA-4634-1","title":"opensmtpd - security update","status":"published","published":"2020-02-26T00:00:00Z","modified":"2026-03-09T02:11:38.471636Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-4294-1","title":"OpenSMTPD vulnerabilities","description":"It was discovered that OpenSMTPD mishandled certain input. A remote,\nunauthenticated attacker could use this vulnerability to execute arbitrary\nshell commands as any non-root user. (CVE-2020-8794)\n\nIt was discovered that OpenSMTPD did not properly handle hardlinks under\ncertain conditions. An unprivileged local attacker could read the first\nline of any file on the filesystem. (CVE-2020-8793)\n","status":"published","published":"2020-03-02T18:17:27Z","modified":"2026-04-27T15:34:28.874295Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4875-1","title":"opensmtpd vulnerabilities","description":"It was discovered that OpenSMTPD incorrectly verified the sender's or\nreceiver's e-mail addresses under certain conditions. An attacker could\npossibly use this vulnerability to execute arbitrary commands as root.\n(CVE-2020-7247)\n\nIt was discovered that OpenSMTPD did not properly handle hardlinks under\ncertain conditions. An unprivileged local attacker could possibly use this\nissue to obtain sensitive information. This issue only affected Ubuntu\n16.04 ESM. (CVE-2020-8793)\n\nIt was discovered that OpenSMTPD mishandled certain input. A remote,\nunauthenticated attacker could possibly use this vulnerability to execute\narbitrary shell commands as any non-root user. This issue only affected\nUbuntu 16.04 ESM. (CVE-2020-8794)\n","status":"published","published":"2021-03-15T23:06:41Z","modified":"2026-06-29T13:48:38.635633199Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}