Threats affecting pkg:github/vmime

VMime versions up to 0.9.2 have an information disclosure vulnerability in the uuEncoder::decode function. This flaw causes uninitialized stack memory to be written into decoded output when processing over-long lines in uuencoded MIME parts. An attacker can exploit this by sending crafted uuencode or x-uuencode MIME parts with large line length bytes, potentially leaking up to 15 bytes of stack memory per line in decoded attachments.

VMime versions up to 0.9.2 contain a stack-based buffer overflow vulnerability in the uuEncoder::decode function. This flaw arises from an integer underflow triggered by crafted uuencoded MIME parts in emails. An attacker can send a specially crafted email with a uuencoded line whose length character is 'b' but is not a 'begin' line, leading to stack memory corruption. This can cause the application to crash or potentially allow remote code execution.