-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3019-1                   security@debian.org
http://www.debian.org/security/                      Salvatore Bonaccorso
September 04, 2014                     http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : procmail
CVE ID         : CVE-2014-3618
Debian Bug     : 704675 760443

Boris 'pi' Piwinger and Tavis Ormandy reported a heap overflow
vulnerability in procmail's formail utility when processing
specially-crafted email headers. A remote attacker could use this flaw
to cause formail to crash, resulting in a denial of service or data
loss, or possibly execute arbitrary code.

For the stable distribution (wheezy), this problem has been fixed in
version 3.22-20+deb7u1.

For the unstable distribution (sid), this problem has been fixed in
version 3.22-22.

We recommend that you upgrade your procmail packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJUCM2aAAoJEAVMuPMTQ89EiXYQAI8FfgODDJjhgCMefri5EdMy
DoykHwK7Nrblc3MkXT47Xyh7Ihrh2pfouhO6V+vX/W3tG2pquXL9aCnPXTujtpvJ
NTm5xpuoOMFUaLRXpeCwLYSzBa2h1BU2dnWFuVRSd8dNsMxsrx/Y/nI7+vyeSY30
IxR6ODjjHpBdHsi+cnYhn5wWb2kxyrOLTiDx2Q/Vwyg2GY0WojDu1r8NMs/5dUmD
MnbQaRQVYMjNww1WVr/B0T/4XDz3zLOKycD3EIj4L6mMen+H7Y6QCNc+YlZ1bKNQ
J5VBL9HmoeJiZGKThXxUFkdOWW8QMGsURl1XfN2DWzXS6qRHa5b8jjeX0EY1Utsl
liD600qjcxC08c1elS4Une3nz02y6kyH+aVyAUgHSfO0gal6x5NOF/VohEQI43vV
27vnhQMCz7uoYB8ZvohtDRKu9F0P5SXXO3hJWrX5oj3+/So9jW9xZgmxj/v2Q4eX
AU8+tAHpwcEmVmzlFnr7/irbf/25zmkQQBEYDHDtwwDIoPX6YZhru7W/Xn2Ulyvi
H6YDtdfyakv5paHN6QGE3kQEKu13SpVTp47lVV6GiZsMm1kxraGQh0q8itgis5Ko
4RVZ7I8VYbMezjHCDHEcMGU4WN4FG+LF2GkrJXRoTDwDRr6YBthMie/33Bvd9MMy
cBuaUkEYz1VJNuBHJoem
=RMOq
-----END PGP SIGNATURE-----