Ssmtp is a lightweight mail-delivery utility widely deployed in containerized and embedded systems as a simple SMTP client for log forwarding and application alerts. The reported vulnerabilities center on the product's credential handling and information-disclosure properties, reflecting the exposure risks inherent in a system that manages plaintext mail credentials and forwards potentially sensitive operational data. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ssmtp over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2004-0156MEDIUM Format string vulnerabilities in the (1) die or (2) log_event functions for ssmtp before 2.50.6 allow remote mail relays to cause a denial of service and possibly execute arbitrary | Jun 1, 2004 | 5.0 | 16 | NO | NO |
The from_format function in ssmtp.c in ssmtp 2.61 and 2.62, in certain configurations, uses uninitialized memory for the From: field of an e-mail message, which might allow remote | Sep 11, 2008 | 2.6 | 12 | NO | NO |
The log_event function in ssmtp 2.50.6 and earlier allows local users to overwrite arbitrary files via a symlink attack on the ssmtp.log temporary log file. | Jul 7, 2004 | 2.1 | 11 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ssmtp.
Media articles that mention a CVE ID that affects a product developed by Ssmtp — matched by CVE ID, not by vendor name.