What’s Vulnerable › Vulnerabilities

CVE-2015-7687

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-10-16 · updated 2026-06-17
• Weakness: CWE-416

Description

Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.

Affected products

• Fedoraproject Fedora: 22, 23
• OpenBSD Opensmtpd: through 5.7.1

References

• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170448.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169600.html
• http://www.openwall.com/lists/oss-security/2015/10/03/1
• http://www.securityfocus.com/bid/76975
• https://bugzilla.redhat.com/show_bug.cgi?id=1268793
• https://www.opensmtpd.org/announces/release-5.7.2.txt
• https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170448.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169600.html
• http://www.openwall.com/lists/oss-security/2015/10/03/1
• http://www.securityfocus.com/bid/76975
• https://bugzilla.redhat.com/show_bug.cgi?id=1268793

Get alerted when CVE-2015-7687 or the next vulnerability affects your stack