Security bugs are reported here via bugzilla

[Thomas Houssin <Thomas.Houssin AT gmail.com>]

Synopsis
========
spamassassin is prone to a denial-of-service attack. A remote attacker
could craft a MIME E-Mail message that would waste a lot of CPU cycles
parsing the Content-Type header.

Background
==========
spamassassin is a mail filter which attempts to identify spam using text
analysis and several internet-based realtime blacklists.
Using its rule base, it uses a wide range of heuristic tests on mail
headers and body text to identify "spam", also known as unsolicited
commercial email.

Description
===========
CAN-2005-1266:
spamassassin contains a Denial of Service vulnerability when handling
special misformatted long message headers.

Affected packages
=================
spamassassin in all grimoires (devel, test, stable-rc and stable) is
affected.
This is now fixed in all grimoires (spamassassin updated to 3.0.4).

Resolution
==========
All spamassassin users should upgrade to the latest available version:
        # scribe update
        # cast -c spamassassin

References
==========
  [ 1 ] CAN-2005-1266
        http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1266


-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature