CVE-2014-3956
N/A
Published: June 4, 2014 at 10:00 AM UTC
Updated: June 17, 2026 at 12:09 AM UTC
4 products affected across 4 vendorsFedoraFreeBSDHP Ux
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.6%
Description
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
95%
v ≤ 8.14.88.108.10.08.10.18.10.28.11.08.11.18.11.28.11.38.11.48.11.58.11.68.11.78.12.08.12.18.12.108.12.118.12.28.12.38.12.48.12.58.12.68.12.78.12.88.12.98.13.08.13.18.13.28.13.38.13.48.13.58.13.68.13.78.13.88.14.08.14.18.14.28.14.38.14.48.14.58.14.68.14.78.6.78.7.108.7.68.7.78.7.88.7.98.8.88.9.08.9.18.9.28.9.3
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- ftp://ftp.sendmail.org/pub/sendmail/RELEASE_NOTES
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134349.html
- http://lists.opensuse.org/opensuse-updates/2014-06/msg00032.html
- http://lists.opensuse.org/opensuse-updates/2014-06/msg00033.html
- http://security.gentoo.org/glsa/glsa-201412-32.xml
References (17)
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
ftp://ftp.sendmail.org/pub/sendmail/RELEASE_NOTESx_refsource_CONFIRMThird Party Advisory
Source: [email protected]
http://advisories.mageia.org/MGASA-2014-0270.htmlVendor Advisoryx_refsource_FEDORAThird Party Advisory
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134349.htmlVendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-updates/2014-06/msg00032.htmlVendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-updates/2014-06/msg00033.htmlx_refsource_MISCThird Party AdvisoryVDB Entry
Source: [email protected]
http://packetstormsecurity.com/files/126975/Slackware-Security-Advisory-sendmail-Updates.htmlQuick Info
StatusMODIFIED
CWE
CWE-200
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card