Eric Allman ≫ Sendmail

mail.local in Sendmail 8.10.x does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and end...

Sendmail allows local users to reinitialize the aliases database via the newaliases command, then cause a denial of service by interrupting Sendmail.

Denial of service in Sendmail 8.6.11 and 8.6.12.

Remote attackers can cause a denial of service in Sendmail 8.8.x and 8.9.2 by sending messages with a large number of headers.

MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4.

In older versions of Sendmail, an attacker could use a pipe character to execute root commands.

Sendmail 8.6.9 allows remote attackers to execute root commands, using ident.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

Local users can start Sendmail in daemon mode and gain root privileges.

MIME buffer overflow in Sendmail 8.8.0 and 8.8.1 gives root access.