CVE-2006-1520

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-05-22 · updated 2026-06-16

Description

Format string vulnerability in ANSI C Sender Policy Framework library (libspf) before 1.0.0-p5, when debugging is enabled, allows remote attackers to execute arbitrary code via format string specifiers, possibly in an e-mail address.

Affected products

Libspf: 1.0.0_p4

References

http://permalink.gmane.org/gmane.mail.spam.spf.devel/849
http://www.gossamer-threads.com/lists/spf/devel/27053?page=last
http://www.libspf.org/index.html
http://www.vupen.com/english/advisories/2006/1846
https://exchange.xforce.ibmcloud.com/vulnerabilities/26535
http://permalink.gmane.org/gmane.mail.spam.spf.devel/849
http://www.gossamer-threads.com/lists/spf/devel/27053?page=last
http://www.libspf.org/index.html
http://www.vupen.com/english/advisories/2006/1846
https://exchange.xforce.ibmcloud.com/vulnerabilities/26535

Get alerted when CVE-2006-1520 or the next vulnerability affects your stack