sendmail: Information disclosure

sendmail: Information disclosure A vulnerability in sendmail could allow a local attacker to obtain sensitive information. sendmail 2014-12-22 2014-12-22 511760 local 8.14.9 8.14.9

sendmail is a widely-used Mail Transport Agent (MTA).

The sm_close_on_exec function in conf.c has arguments in the wrong order.

A local attacker could get access to unintended high-numbered file descriptors via a specially crafted program.

There is no known workaround at this time.

All sendmail users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=mail-mta/sendmail-8.14.9"

CVE-2014-3956 BlueKnight Zlogene