Missing Release of Resource after Effective Lifetime The advisory has been revoked - it doesn't affect any version of package opensmtpd (opens in a new tab)

Threat Intelligence

2.79% (87^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU1604-OPENSMTPD-1054805
published29 Dec 2020
disclosed24 Dec 2020

Report a new vulnerability Found a mistake?

Introduced: 24 Dec 2020

CVE-2020-35679 (opens in a new tab) CWE-772 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:16.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream opensmtpd package and not the opensmtpd package as distributed by Ubuntu.

smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.