Eric Allman's vulnerability profile centers on a historically significant mail system and utility software, particularly Sendmail and related components, which remain deployed across legacy infrastructure despite extended maintenance cycles. The exposure reflects the complexity inherent to mail processing and system utilities, with weaknesses clustering around input handling and protocol parsing where the legacy nature of affected products compounds the defensive burden. Live exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Eric Allman over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-1999-0095HIGH The debug command in Sendmail is enabled, allowing attackers to execute commands as root. | Oct 1, 1988 | 10.0 | 49 | NO | YES |
CVE-1999-0204HIGH Sendmail 8.6.9 allows remote attackers to execute root commands, using ident. | Jan 1, 1997 | 10.0 | 40 | NO | YES |
CVE-1999-0047HIGH MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4. | Jan 28, 1997 | 10.0 | 27 | NO | NO |
CVE-1999-0130HIGH Local users can start Sendmail in daemon mode and gain root privileges. | Nov 16, 1996 | 7.2 | 27 | NO | YES |
CVE-1999-0206HIGH MIME buffer overflow in Sendmail 8.8.0 and 8.8.1 gives root access. | Oct 1, 1996 | 10.0 | 25 | NO | NO |
CVE-1999-0203HIGH In Sendmail, attackers can gain root privileges via SMTP by specifying an improper "mail from" address and an invalid "rcpt to" address that would cause the mail to bounce to a pro | Aug 17, 1995 | 10.0 | 25 | NO | NO |
CVE-1999-0393MEDIUM Remote attackers can cause a denial of service in Sendmail 8.8.x and 8.9.2 by sending messages with a large number of headers. | Jan 1, 1999 | 5.0 | 23 | NO | YES |
CVE-1999-0057HIGH Vacation program allows command execution by remote users through a sendmail command. | Nov 16, 1998 | 7.5 | 23 | NO | NO |
CVE-1999-0145HIGH Sendmail WIZ command enabled, allowing root access. | Sep 30, 1993 | 7.2 | 22 | NO | NO |
CVE-1999-0163HIGH In older versions of Sendmail, an attacker could use a pipe character to execute root commands. | Jan 1, 1997 | 7.2 | 20 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Eric Allman.
Media articles that mention a CVE ID that affects a product developed by Eric Allman — matched by CVE ID, not by vendor name.