Critical
crashmail — security advisory
Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed attempts potentially causing denial of service.
- Products
- crashmail
- Affected versions
- 1.5-1, 1.6-1, 1.7-1, 1.7-2build1, 1.7-4, 1.7-5, 1.7-5build1
- Fixed versions
- Not specified
- CVEs
- CVE-2018-25223
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:29 UTC · Revision 1
Source evidence
Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed attempts potentially causing denial of service.
osv:UBUNTU-CVE-2018-25223
crashmail
Fixed versions: Not specified
crashmail
Fixed versions: Not specified
crashmail
Fixed versions: Not specified
crashmail
Fixed versions: Not specified
crashmail
Fixed versions: Not specified
crashmail
Fixed versions: Not specified
crashmail
Fixed versions: Not specified
crashmail
Fixed versions: Not specified
Complete source record
{
"id": "66f7733cddc1a07840d20f750c0611988a255618e84df250a36adddba3a42bc5",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2018-25223",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2018-25223",
"summary": "Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed attempts potentially causing denial of service.",
"evidence": "osv:UBUNTU-CVE-2018-25223",
"products": [
{
"name": {
"value": "crashmail",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "crashmail",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "crashmail",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "crashmail",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7-2build1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "crashmail",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7-4",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "crashmail",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7-4",
"evidence": "/affected/5/versions"
},
{
"value": "1.7-5",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "crashmail",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7-5build1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "crashmail",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7-5",
"evidence": "/affected/7/versions"
},
{
"value": "1.7-5build1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2018-25223",
"aliases": [
"UBUNTU-CVE-2018-25223"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "high"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "crashmail",
"purl": "pkg:deb/ubuntu/crashmail?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.5-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25223.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "crashmail",
"binary_version": "1.5-1"
}
],
"priority_reason": "remote-code-execution"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "crashmail",
"purl": "pkg:deb/ubuntu/crashmail?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.5-1",
"1.6-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25223.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "crashmail",
"binary_version": "1.6-1"
}
],
"priority_reason": "remote-code-execution"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "crashmail",
"purl": "pkg:deb/ubuntu/crashmail?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.7-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25223.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "crashmail",
"binary_version": "1.7-1"
}
],
"priority_reason": "remote-code-execution"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "crashmail",
"purl": "pkg:deb/ubuntu/crashmail?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.7-2build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25223.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "crashmail",
"binary_version": "1.7-2build1"
}
],
"priority_reason": "remote-code-execution"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "crashmail",
"purl": "pkg:deb/ubuntu/crashmail?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.7-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25223.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "crashmail",
"binary_version": "1.7-4"
}
],
"priority_reason": "remote-code-execution"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "crashmail",
"purl": "pkg:deb/ubuntu/crashmail?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.7-4",
"1.7-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25223.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "crashmail",
"binary_version": "1.7-5"
}
],
"priority_reason": "remote-code-execution"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "crashmail",
"purl": "pkg:deb/ubuntu/crashmail?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.7-5build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25223.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "crashmail",
"binary_version": "1.7-5build1"
}
],
"priority_reason": "remote-code-execution"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "crashmail",
"purl": "pkg:deb/ubuntu/crashmail?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.7-5",
"1.7-5build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25223.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "crashmail",
"binary_version": "1.7-5build1"
}
],
"priority_reason": "remote-code-execution"
}
}
],
"modified": "2026-10-17T12:55:26.227368344Z",
"provider": "osv",
"upstream": [
"CVE-2018-25223"
],
"references": [
"https://ubuntu.com/security/CVE-2018-25223",
"https://www.cve.org/CVERecord?id=CVE-2018-25223",
"https://www.exploit-db.com/exploits/44331",
"https://www.vulncheck.com/advisories/crashmail-stack-based-buffer-overflow-remote-code-execution"
]
},
"related_cves": [
{
"value": "CVE-2018-25223",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 353757,
"published_at": "2026-03-28T12:16:00+00:00"
}