CVE-2018-11780: Apache Spamassassin

Critical severity, CVSS 9.8. EPSS: 10.8% chance of exploitation in the next 30 days.

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

Affected products

• Apache Spamassassin: before 3.4.2 (fixed in 3.4.2)
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only
• Debian Debian Linux: version 8.0 only
• Pdfinfo Project Pdfinfo: affected versions not specified

Published 2018-09-17. Last modified 2026-06-17.