Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that…

Description

Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.

Scores

EPSS (exploitation in 30 days)

5.3% · top 7.4% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

• n/a
• CWE-399 (opens in a new tab)All about CWE-399 and its CVEs

Affected products

• n/a

  • affected n/a

References (53)

• IY85415 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• HPSBTU02116 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• DSA-1155 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• [3.8] 008: SECURITY FIX: June 15, 2006 (opens in a new tab)vendor-advisoryx_refsource_OPENBSDx_transferred
• 20684 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBUX02124 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• ADV-2006-2388 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 20726 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• oval:org.mitre.oval:def:11253 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• ADV-2006-2351 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 21327 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• RHSA-2006:0515 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• ADV-2006-2389 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 21647 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-18.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://issues.rpath.com/browse/RPL-526 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20651 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20683 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20650 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.avaya.com/elmodocs2/security/ASA-2006-148.htm (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20782 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-3135 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 1016295 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 20694 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20473 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-2189 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 20060721 rPSA-2006-0134-1 sendmail sendmail-cf (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• ADV-2006-2798 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 102460 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc (opens in a new tab)x_refsource_CONFIRMx_transferred
• MDKSA-2006:104 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• sendmail-multipart-mime-dos(27128) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 20673 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.f-secure.com/security/fsc-2006-5.shtml (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20060621 Re: Sendmail MIME DoS vulnerability (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 21612 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20654 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-2390 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• SSA:2006-166-01 (opens in a new tab)vendor-advisoryx_refsource_SLACKWAREx_transferred
• GLSA-200606-19 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 18433 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 20675 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• SUSE-SA:2006:032 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 20060620 Sendmail MIME DoS vulnerability (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• VU#146718 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
• 15779 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20641 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20679 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 26197 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 21042 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 21160 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• IY85930 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
• 20060624 Re: Sendmail MIME DoS vulnerability (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-1173](https://trackcve.app/badge/CVE-2006-1173.svg)](https://trackcve.app/cve/CVE-2006-1173)

Record last updated 7 Aug 2024, 17:03 UTC.