OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 27, 2020 |
| Debian | — | Upgrade opendmarc | Apr 26, 2021 | Jul 27, 2020 |
| Freebsd | — | Upgrade opendmarc | Nov 4, 2022 | Dec 30, 2021 |
| Gentoo Linux | — | Upgrade mail-filter/opendmarc. | Nov 3, 2020 | Jul 27, 2020 |
| Ubuntu | — | Upgrade libopendmarc2Upgrade opendmarc (Ubuntu Pro)Upgrade libopendmarc2 (Ubuntu Pro)Upgrade opendmarc | Sep 18, 2023 | Jul 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub