Arch Linux: Arbitrary code execution (CVE-2017-16844)

A heap-based buffer overflow flaw was found in the loadbuf function in formisc.c in the formail utility in procmail <= 3.22 because of a hardcoded realloc size. When the buffer is too small, the function tries to resize it, but only by Bsize (=128) bytes which is not necessarily enough. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail.