CVE-2006-1173

CVE-2006-1173 is a medium-severity vulnerability in Sendmail with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-399.

Key facts

• Severity: Medium (CVSS 2.0 base score 5.0)
• EPSS exploit prediction: 5% (91st percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-399
• Affected product: Sendmail
• Published: 2006-06-07
• Last modified: 2026-06-16

Description

Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.

Frequently asked questions

What is CVE-2006-1173?

Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.

How severe is CVE-2006-1173?

CVE-2006-1173 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2006-1173 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (91st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-1173?

CVE-2006-1173 primarily affects Sendmail. In total, 41 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2006-1173?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2006-1173 published?

CVE-2006-1173 was published on 2006-06-07 and last updated on 2026-06-16.

References

• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:17.sendmail.asc
• ftp://patches.sgi.com/support/free/security/advisories/20060601-01-P
• ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc
• http://itrc.hp.com/service/cki/docDisplay.do?docId=c00692635
• http://lists.suse.com/archive/suse-security-announce/2006-Jun/0006.html
• http://secunia.com/advisories/15779
• http://secunia.com/advisories/20473
• http://secunia.com/advisories/20641
• http://secunia.com/advisories/20650
• http://secunia.com/advisories/20651
• http://secunia.com/advisories/20654
• http://secunia.com/advisories/20673
• http://secunia.com/advisories/20675
• http://secunia.com/advisories/20679
• http://secunia.com/advisories/20683
• http://secunia.com/advisories/20684
• http://secunia.com/advisories/20694
• http://secunia.com/advisories/20726
• http://secunia.com/advisories/20782
• http://secunia.com/advisories/21042
• http://secunia.com/advisories/21160
• http://secunia.com/advisories/21327
• http://secunia.com/advisories/21612
• http://secunia.com/advisories/21647
• http://securitytracker.com/id?1016295
• http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.631382
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102460-1
• http://support.avaya.com/elmodocs2/security/ASA-2006-148.htm
• http://www-1.ibm.com/support/search.wss?rs=0&q=IY85415&apar=only
• http://www-1.ibm.com/support/search.wss?rs=0&q=IY85930&apar=only

Affected products (41)

• cpe:2.3:a:sendmail:sendmail:*:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.8.8:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.9.0:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.9.2:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.9.3:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.10:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.10.1:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.10.2:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.11.0:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.11.1:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.11.2:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.11.3:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.11.4:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.11.5:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.11.6:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.11.7:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12:beta10:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12:beta12:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12:beta16:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12:beta5:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12:beta7:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.0:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.1:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.2:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.3:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.4:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.5:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.6:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.7:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.8:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.9:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.10:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.12.11:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.13.0:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.13.1:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.13.1.2:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.13.2:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.13.3:*:*:*:*:*:*:*
• cpe:2.3:a:sendmail:sendmail:8.13.4:*:*:*:*:*:*:*

More vulnerabilities in Sendmail

• CVE-2003-0694 — Critical (CVSS 10.0): The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks,…
• CVE-2003-0161 — Critical (CVSS 10.0): The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain…
• CVE-2002-1337 — Critical (CVSS 10.0): Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted…
• CVE-2007-2246 — High (CVSS 7.8): Unspecified vulnerability in HP-UX B.11.00 and B.11.11, when running sendmail 8.9.3 or 8.11.1; and HP-UX B.11.23 when…
• CVE-2006-0058 — High (CVSS 7.6): Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by…
• CVE-2009-4565 — High (CVSS 7.5): sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate,…

All CVEs affecting Sendmail →

Other CWE-399 (Resource Management Errors) vulnerabilities

• CVE-2015-8104 — Critical (CVSS 10.0): The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a…
• CVE-2015-0339 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
• CVE-2015-0335 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
• CVE-2015-0333 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
• CVE-2014-4121 — Critical (CVSS 10.0): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized…
• CVE-2014-0560 — Critical (CVSS 10.0): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS…

Browse all CWE-399 (Resource Management Errors) vulnerabilities →