CVE-2018-11780 Code injection in Apache SpamAssassin
Attackers can execute arbitrary code via the PDFInfo plugin in Apache SpamAssassin, requiring an upgrade to secure the mail server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-11780?
CVE-2018-11780 is a critical code injection vulnerability in Canonical Ubuntu Linux, published on 17 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
Weakness: CWE-94
Which versions are affected by CVE-2018-11780?
It affects 4 products.
Products include Apache Spamassassin, Canonical Ubuntu Linux, Debian Debian Linux, Pdfinfo Project Pdfinfo.
How do I fix CVE-2018-11780?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-11780 being exploited?
There is no known exploitation of CVE-2018-11780 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
- CVE-2020-1946 Apache SpamAssassin has an OS Command Injection vulnerability
- CVE-2020-1930 Command injection in Apache SpamAssassin
- CVE-2020-1931 Command injection in Apache SpamAssassin
- CVE-2018-11781 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
- CVE-2016-1238 Privilege escalation in n/a
Sources
Also known as ALPINE-CVE-2018-11780, DEBIAN-CVE-2018-11780, GHSA-ph2p-v983-f856, UBUNTU-CVE-2018-11780.