The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade sendmail | Jul 30, 2024 | Jun 4, 2014 |
| Gentoo Linux | — | Upgrade mail-mta/sendmail. | Oct 30, 2017 | Jun 4, 2014 |
| Hpux | — | Update Sendmail.SENDMAIL-RUN to the latest version | Aug 11, 2017 | Jun 4, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade sendmail-cfUpgrade sendmail | Dec 4, 2019 | Jun 4, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade sendmail-cfUpgrade sendmail | Dec 18, 2019 | Jun 4, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade sendmail-cfUpgrade sendmail | Dec 11, 2019 | Jun 4, 2014 |
| Ibm Aix | — | Apply the fix or workaround for sendmail_advisory3 | Apr 9, 2018 | Jun 4, 2014 |
| Oracle Solaris | — | Upgrade service/network/smtp/sendmail to version 8.14.9-0.175.2.4.0.4.2 on Solaris 11.2Upgrade library/libmilter to version 8.14.9-0.175.2.4.0.4.2 on Solaris 11.2Upgrade consolidation/osnet/osnet-incorporation to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3 | May 29, 2017 | Jun 4, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2014 |
| Sendmail | — | Upgrade to the latest version of Sendmail. | Jun 12, 2014 | Jun 4, 2014 |
| Suse | — | Upgrade sendmail-develUpgrade sendmail | Dec 18, 2015 | Jun 4, 2014 |
| Ubuntu | — | Upgrade sendmail | Nov 19, 2024 | Jun 4, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub