Pine, developed at the University of Washington, is a tool for reading,
sending, and managing electronic messages (including mail and news).
A buffer overflow exists in the way unpatched versions of Pine prior to
4.57 handle the 'message/external-body' type. The Common Vulnerabilities
and Exposures project has assigned the name
CAN-2003-0720 to this issue.
An integer overflow exists in the Pine MIME header parsing in versions
prior to 4.57. The Common Vulnerabilities and Exposures project
has assigned the name
CAN-2003-0721 to this issue.
Both of these flaws could be exploited by a remote attacker sending a
carefully crafted email to the victim that will execute arbitrary code when
the email is opened using Pine.
Posted Sep 18, 2003 9:12 UTC (Thu) by vmlinuz (subscriber, #24)
[Link]
Just for reference, there is no released Pine 4.57 - they skipped that completely and went to 4.58. I don't quite know why, but I'd guess that 4.57 was already under development, but not ready for release, so 4.58 is just 4.56 with the holes fixed...
