CVE-2014-7844

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
BSD	mailx	8.1.2 and earlier

References

http://linux.oracle.com/errata/ELSA-2014-1999.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1999.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q4/1066Mailing List, Patch, Third Party Advisory
http://www.debian.org/security/2014/dsa-3104Third Party Advisory
http://www.debian.org/security/2014/dsa-3105Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-1999.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1999.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q4/1066Mailing List, Patch, Third Party Advisory
http://www.debian.org/security/2014/dsa-3104Third Party Advisory
http://www.debian.org/security/2014/dsa-3105Third Party Advisory

Timeline

Published: Jan 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-78457.5The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a s CVE-2014-78464.0tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the mood CVE-2014-78475.0iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause CVE-2014-78485.0lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a CVE-2014-78494.0The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly ver CVE-2014-78504.3Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or CVE-2014-78517.5oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users wi CVE-2014-78524.3Cross-site scripting (XSS) vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web CVE-2014-78534.0The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properl CVE-2014-78579.8D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05 CVE-2014-78589.8The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the u CVE-2014-78599.8Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-32