CVE-2015-7687
CriticalSummary
A use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.
Risk Assessment
This vulnerability could lead to service downtime or unauthorized access to the system, posing a significant security risk to the organization.
Recommendation
It is recommended to upgrade OpenSMTPD to version 5.7.2 or later to mitigate this vulnerability.
Other vulnerabilities in OpenSMTPD
See all- CVE-2020-7247CriticalActively exploited
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- CVE-2025-62875Medium
An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1.
Original NVD description (English source)
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS