Mailutils
Vendor:
First CVE: Dec 31, 2004 · Active for 21 years
8
Total CVEs
More Total CVEs than 85% of tracked products
2.7
Avg CVEs / Year
Higher CVE frequency than 75% of tracked products
7.2
Avg CVSS
Higher Avg CVSS than 44% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Mailutils over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2004
21 years ago
Most Recent CVE
Nov 11, 2019
2,447 days ago
CVE Severity & Scoring
Mailutils8 CVEs
13%
88%
All CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local1 (12.5%)
Network0 (0.0%)
Unknown7 (87.5%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low1 (12.5%)
High0 (0.0%)
Unknown7 (87.5%)
User Interaction
None1 (12.5%)
Unknown7 (87.5%)
Required0 (0.0%)
Privileges Required
Low1 (12.5%)
High0 (0.0%)
None0 (0.0%)
Unknown7 (87.5%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-18862HIGH maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode. | Nov 11, 2019 | 7.8 | 36 | NO | YES |
CVE-2005-2878HIGH Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SE | Sep 13, 2005 | 7.5 | 35 | NO | YES |
CVE-2005-1523HIGH Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string spe | May 26, 2005 | 7.5 | 32 | NO | YES |
CVE-2005-1520HIGH Buffer overflow in the header_get_field_name function in header.c for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code | May 26, 2005 | 7.5 | 31 | NO | YES |
CVE-2004-0984HIGH Unknown vulnerability in the dotlock implementation in mailutils before 1:0.5-4 on Debian GNU/Linux allows attackers to gain privileges. | Dec 31, 2004 | 7.2 | 23 | NO | NO |
CVE-2005-1521HIGH Integer overflow in the fetch_io function of the imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via | May 26, 2005 | 7.5 | 20 | NO | NO |
CVE-2005-1824HIGH The sql_escape_string function in auth/sql.c for the mailutils SQL authentication module does not properly quote the "\" (backslash) character, which is used as an escape character | Jun 2, 2005 | 7.5 | 19 | NO | NO |
CVE-2005-1522MEDIUM The imap4d server for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows authenticated remote users to cause a denial of service (CPU consumption) via a large rang | May 26, 2005 | 5.0 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
4 CVEs
50.0% of CVEs· 91st percentile
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Mailutils
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.0.6.1.1 | 1 | 7.5 | 1.1% | 0 | 0 |
| 0.6 | 5 | 7.0 | 7.2% | 0 | 3 |
| 0.5 | 4 | 6.9 | 5.3% | 0 | 2 |