ADVISORIES

• CVE-2013-4478 (NVD)
• GHSA-5f2p-6vjv-2q2m
• OSVDB-99074
• Vendor Advisory

GEM

sup

SEVERITY

CVSS v2.0: 6.8 (Medium)

PATCHED VERSIONS

• ~> 0.13.2.1
• >= 0.14.1.1

DESCRIPTION

Sup MUA contains a flaw that is triggered when handling email attachment content. This may allow a context-dependent attacker to execute arbitrary commands.

RELATED

• CVE-2013-4479 (NVD)
• GHSA-hh2x-7mf9-78fr
• https://nvd.nist.gov/vuln/detail/CVE-2013-4478
• https://github.com/sup-heliotrope/sup/blob/develop/History.txt
• https://www.openwall.com/lists/oss-security/2013/10/30/2
• https://web.archive.org/web/20140524012714/http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html
• https://github.com/sup-heliotrope/sup/commit/8b46cdbfc14e07ca07d403aa28b0e7bc1c544785
• https://www.mend.io/vulnerability-database/CVE-2013-4478
• https://security-tracker.debian.org/tracker/CVE-2013-4478
• https://lwn.net/Articles/575351
• https://github.com/advisories/GHSA-5f2p-6vjv-2q2m