Re: CVE request: procmail heap overflow in getlline()

[Santiago Vila <sanvila () unex es>]

On Wed, Dec 03, 2014 at 05:30:57PM -0600, Joshua J. Drake wrote:
> Is it possible to trigger this issue with untrusted input or only
> trusted input from procmailrc?

This is an issue with the handling of .procmailrc file, which contains
the filter rules for procmail. An external attacker is not supposed to
provide the .procmailrc file at /home/user, only the email to be
filtered, so, IMHO, this is a bug but maybe not a security bug.

Thanks.