Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Bogofilter <1.2.3 may crash or be compromised by crafted email

CVE-2012-5468 · published 13 years ago
Summary

Bogofilter versions before 1.2.3 can be made to stop working or run unwanted code when it processes an email that contains a specially formed base64 string. The problem lies in how the program converts that data, allowing the memory to be overwritten. Update to the latest Bogofilter release or apply the vendor’s patch to stop this risk.

What to do
  • Update debian bogofilter to version 1.2.2+dfsg1-2.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian bogofilter < 1.2.2+dfsg1-2
Fix: upgrade to 1.2.2+dfsg1-2
Debian:13 debian bogofilter < 1.2.2+dfsg1-2
Fix: upgrade to 1.2.2+dfsg1-2
Debian:14 debian bogofilter < 1.2.2+dfsg1-2
Fix: upgrade to 1.2.2+dfsg1-2
– bogofilter_project bogofilter <= 1.2.2
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
3 more version ranges
cpe:2.3:a:bogofilter_project:bogofilter:*:*:*:*:*:*:*:*
Original advisory text
Heap-based buffer overflow in iconvert.c in the bogolexer component in Bogofilter before 1.2.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a...
Heap-based buffer overflow in iconvert.c in the bogolexer component in Bogofilter before 1.2.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an email containing a base64 string that is decoded to incomplete multibyte characters.
References
Severity
7.5 High
Exploitation
6% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published18 Dec 2012
Updated3 Nov 2026
First seen3 Sep 2026
Sources
DEBIAN-CVE-2012-5468 · OSV
CVE-2012-5468 · NVD
Track software like this
Free during beta