CVE-2018-11780: apache software foundation apache spamassassin Improper Control of Generation of Code

Modified

AliasesALPINE-CVE-2018-11780UBUNTU-CVE-2018-11780DEBIAN-CVE-2018-11780

Published 17-09-2018Last modified 16-09-2024

Vulnerability summary

CVE-2018-11780 is a critical (CVSS 9.8) Improper Control of Generation of Code vulnerability in apache software foundation apache spamassassin. EPSS estimates a 10.82% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 11% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

10.82%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 5

DLA-1578-1 MGASA-2018-0425 OPENSUSE-SU-2019:1831-1 OPENSUSE-SU-2024:11395-1 SUSE-SU-2019:1961-1 SUSE-SU-2019:2011-1+1 more

Timeline

17-09-2018
PublishedVulnerability first disclosed.
16-09-2024
Last modifiedVulnerability information updated.

Description

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

10.82%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 10.82% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Debian2 products

spamassassin< 3.4.2-1
debian_linuxEOL8.0

Alpine1 product

spamassassin< 3.4.2-r0 | < 3.4.3-r0

Apache1 product

spamassassin< 3.4.2

Apache software foundation1 product

apache spamassassin< 3.4.2

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04

Pdfinfo_project1 product

pdfinfona

Ubuntu1 product

spamassassin< 3.4.2-0ubuntu0.14.04.1 | < 3.4.2-0ubuntu0.16.04.1 | < 3.4.2-0ubuntu0.18.04.1

7 vendors · 8 products

References

14 links

usn.ubuntu.com/3811-3/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
usn.ubuntu.com/3811-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.securityfocus.com/bid/105373VDB EntryX Refsource BIDThird Party Advisory
security.gentoo.org/glsa/201812-07Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.debian.org/debian-lts-announce/2018/11/msg00016.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.htmlVendor AdvisoryX Refsource SUSE
security.alpinelinux.org/vuln/CVE-2018-11780Advisory
ubuntu.com/security/CVE-2018-11780REPORT
www.openwall.com/lists/oss-security/2018/09/16/1REPORT

Show all 14 references

ubuntu.com/security/notices/USN-3811-1Advisory
www.cve.org/CVERecord?id=CVE-2018-11780REPORT
ubuntu.com/security/notices/USN-3811-3Advisory
security-tracker.debian.org/tracker/CVE-2018-11780Advisory