Description
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kisli vmime
Default version status: unaffected
0 to ≤ 0.9.2affected
pkg:github/kisli/vmimeReferences
- https://github.com/kisli/vmime/pull/363 ↗
- https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8 ↗
- https://github.com/kisli/vmime ↗
- https://github.com/kisli/vmime/blob/v0.9.2/src/vmime/utility/encoder/uuEncoder.cpp#L185-L190 ↗
- https://hackmd.io/@haindpwn/vmime-uuencode-decoder-oob-write ↗
- https://www.vulncheck.com/advisories/vmime-through-0.9.2-stack-based-buffer-overflow-via-uuencode-decoder ↗