CVE catalog

CVE-2008-3962

ssmtp: CVE-2008-3962

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.98% · Oct 25, 2026

The from_format function in ssmtp.c in ssmtp 2.61 and 2.62, in certain configurations, uses uninitialized memory for the From: field of an e-mail message, which might allow remote attackers to obtain sensitive information (memory contents) in opportunistic circumstances by reading a message.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianssmtpsid2.66-1fixed
Debianssmtpforky2.66-1fixed
Debianssmtptrixie2.64-12fixed
Debianssmtpbookworm2.64-11fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianssmtpsourcesid2.62-1.1lowNot reported[498366]
Debianssmtpsourceforky2.62-1.1lowNot reported[498366]
Debianssmtpsourcetrixie2.62-1.1lowNot reported[498366]
Debianssmtpsourcebookworm2.62-1.1lowNot reported[498366]

[Debian bug #498366]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ssmtp]Fixed
    Details (2)

    • 2.64-11 · amd64 · bookworm

      Fixed · Fixed: 2.62-1.1

      dsa · ssmtp · debian · bookworm; dsa · ssmtp · debian · 12

    • 2.64-11 · arm64 · bookworm

      Fixed · Fixed: 2.62-1.1

      dsa · ssmtp · debian · bookworm; dsa · ssmtp · debian · 12

[Debian 13 (Trixie)]

  • [ssmtp]Fixed
    Details (2)

    • 2.64-12 · amd64 · trixie

      Fixed · Fixed: 2.62-1.1

      dsa · ssmtp · debian · 13

    • 2.64-12 · arm64 · trixie

      Fixed · Fixed: 2.62-1.1

      dsa · ssmtp · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]