CVE-2017-16844

Name of the Vulnerable Software and Affected Versions procmail version 3.22

Description The issue is a heap-based buffer overflow in the loadbuf function in formisc.c in formail, which can be exploited by remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted e-mail message. This is due to a hardcoded realloc size.

Recommendations For procmail version 3.22, consider disabling the loadbuf function in formisc.c as a temporary workaround until a patch is available. Restrict access to the formail component to minimize the risk of exploitation. Avoid using the affected function to process e-mail messages until the issue is resolved.