CVE-2020-1946
Published Mar 25, 2021In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be inj…
Vendor/product archive
apache / spamassassin CVEs
Beta · best-effort13 CVEs tagged to apache / spamassassin — 2 Critical, 5 High, 6 Medium, 0 Low, 0 Unrated.
CVE-2020-1931
Published Jan 30, 2020A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar t…
CVE-2020-1930
Published Jan 30, 2020A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands simi…
CVE-2019-12420
Published Dec 12, 2019In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details wil…
CVE-2018-11805
Published Dec 12, 2019In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of s…
CVE-2018-11781
Published Sep 17, 2018Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
CVE-2018-11780
Published Sep 17, 2018A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
CVE-2017-15705
Published Sep 17, 2018A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup t…
CVE-2016-1238
Published Aug 2, 2016(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/en…
CVE-2007-0451
Published Feb 16, 2007Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
CVE-2006-2447
Published Jun 6, 2006SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properl…
CVE-2005-3351
Published Nov 20, 2005SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large number of recipients ("To" addresses), which triggers a bus error in Perl.
CVE-2005-1266
Published Jun 15, 2005Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header witho…
Showing 1-13 of 13 CVEsPage 1 of 1