Every CVESearch/Get API key

CVE-2014-3618

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to...

7.5 HighFix available

CVE-2014-3618 is a high vulnerability (CVSS 7.5) in Procmail, published September 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.87%, the 95th percentile. Fixed in procmail 3.22-53.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
8.87%EPSS, 95th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.22-53procmail +28 more

Description

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Exploit likelihood

8.87%Up 0.6 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
procmail
Azure Linux:3
before 3.22-53
3.22-53
procmail
Azure Linux:2
before 3.22-53
3.22-53
procmail
Debian:12
before 3.22-22
3.22-22
procmail
Debian:13
before 3.22-22
3.22-22
procmail
Debian:14
before 3.22-22
3.22-22
procmail
Debian:6.0
before 3.22-19+deb6u1, plus listed versions
3.22-19
3.22-19+deb6u1
procmail
Debian:7
before 3.22-20+deb7u1, plus listed versions
3.22-20
3.22-20+deb7u1
procmail
Mageia:3
before 3.22-18.1.mga3
3.22-18.1.mga3
procmail
Mageia:4
before 3.22-19.1.mga4
3.22-19.1.mga4
procmail
Red Hat:enterprise_linux:5::client
before 0:3.22-17.1.2
0:3.22-17.1.2
Show 19 moreShow less
Affected packages
PackageAffectedFixed
procmail-debuginfo
Red Hat:enterprise_linux:5::client
before 0:3.22-17.1.2
0:3.22-17.1.2
procmail
Red Hat:enterprise_linux:5::server
before 0:3.22-17.1.2
0:3.22-17.1.2
procmail-debuginfo
Red Hat:enterprise_linux:5::server
before 0:3.22-17.1.2
0:3.22-17.1.2
procmail
Red Hat:enterprise_linux:6::client
before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail-debuginfo
Red Hat:enterprise_linux:6::client
before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail
Red Hat:enterprise_linux:6::computenode
before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail-debuginfo
Red Hat:enterprise_linux:6::computenode
before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail
Red Hat:enterprise_linux:6::server
before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail-debuginfo
Red Hat:enterprise_linux:6::server
before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail
Red Hat:enterprise_linux:6::workstation
before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail-debuginfo
Red Hat:enterprise_linux:6::workstation
before 0:3.22-25.1.el6_5.1
0:3.22-25.1.el6_5.1
procmail
Red Hat:enterprise_linux:7::client
before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail-debuginfo
Red Hat:enterprise_linux:7::client
before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail
Red Hat:enterprise_linux:7::server
before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail-debuginfo
Red Hat:enterprise_linux:7::server
before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail
Red Hat:enterprise_linux:7::workstation
before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail-debuginfo
Red Hat:enterprise_linux:7::workstation
before 0:3.22-34.el7_0.1
0:3.22-34.el7_0.1
procmail
Ubuntu:14.04:LTS
before 3.22-21ubuntu0.1, plus listed versions
3.22-203.22-21
3.22-21ubuntu0.1
procmail
openSUSE:Tumbleweed
before 3.22-270.9
3.22-270.9

What each source reports

NVD Score used7.5

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
CVE-2014-3618
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
CVE-2014-3618
Updated
2026-11-02
EUVDEUVD-2014-3581No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
EUVD-2014-3581
Updated
2026-11-03
GitHub AdvisoriesGHSA-j8hf-r298-62j6No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to...

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
GHSA-j8hf-r298-62j6
Weakness
CWE-119
Updated
2026-11-02
OSVAZL-36981No score

CVE-2014-3618 affecting package procmail for versions less than 3.22-53

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
AZL-36981
Updated
2026-11-02
OSVAZL-6802No score

CVE-2014-3618 affecting package procmail for versions less than 3.22-53

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
AZL-6802
Updated
2026-11-02
Show 7 moreShow less
OSVAZL-7331No score

CVE-2014-3618 affecting package procmail for versions less than 3.22-53

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
AZL-7331
Updated
2026-11-02
OSVNo score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
CVE-2014-3618
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3618No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
DEBIAN-CVE-2014-3618
Updated
2026-11-02
OSVMGASA-2014-0373No score

Updated procmail packages fix CVE-2014-3618

Updated procmail package fixes security vulnerability:

A heap-based buffer overflow was reported in procmail's formail utility when parsing addresses with unbalanced quotes (CVE-2014-3618).

Record
MGASA-2014-0373
Updated
2026-11-02
OSVopenSUSE-SU-2024:10533-1No score

procmail-3.22-270.9 on GA media

These are all security issues fixed in the procmail-3.22-270.9 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10533-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3618No score

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

Record
UBUNTU-CVE-2014-3618
Updated
2026-11-02
OSVUSN-2340-1No score

procmail vulnerability

Tavis Ormandy discovered that the formail tool incorrectly handled certain malformed mail headers. An attacker could use this flaw to cause formail to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-2340-1
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 22 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open