| Name | CVE-2025-62875 |
| Description | An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1119840 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| opensmtpd (PTS) | bullseye | 6.8.0p2-3 | vulnerable |
| bookworm | 6.8.0p2-4 | vulnerable |
| trixie | 7.6.0p1-1 | vulnerable |
| forky, sid | 7.8.0p0-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| opensmtpd | source | (unstable) | 7.8.0p0-1 | | | 1119840 |
Notes
[trixie] - opensmtpd <no-dsa> (Minor issue)
[bookworm] - opensmtpd <no-dsa> (Minor issue)
[bullseye] - opensmtpd <postponed> (Minor issue)
https://www.openwall.com/lists/oss-security/2025/10/31/3
https://github.com/OpenSMTPD/OpenSMTPD/commit/653abf00f5283a2d3247eb9aabf8987d1b2f0510 (7.8.0p0)
270e23a6eb upstream (7.7.0p0) made major changes to the message parsing code
including the call to fatal(), but it is not excluded that earlier versions
are affected by (a variant of this issue) as well.