CVE-2015-7687

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170448.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169600.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/03/1Mailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/76975Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1268793Issue Tracking, Third Party Advisory, VDB Entry
https://www.opensmtpd.org/announces/release-5.7.2.txtRelease Notes, Vendor Advisory
https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txtExploit, Technical Description, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170448.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169600.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/03/1Mailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/76975Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1268793Issue Tracking, Third Party Advisory, VDB Entry
https://www.opensmtpd.org/announces/release-5.7.2.txtRelease Notes, Vendor Advisory
https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txtExploit, Technical Description, Third Party Advisory

Timeline

Published: Oct 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015