CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Exim » Exim : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2022-37452 787 Overflow 2022-08-07 2022-10-28
0.0
 None ??? ??? ??? ??? ??? ???
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
2 CVE-2022-37451 763 2022-08-06 2022-09-29
0.0
 None ??? ??? ??? ??? ??? ???
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
3 CVE-2022-3620 119 Overflow 2022-10-20 2023-01-20
0.0
 None ??? ??? ??? ??? ??? ???
A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919.
4 CVE-2022-3559 119 Overflow 2022-10-17 2022-11-16
0.0
 None ??? ??? ??? ??? ??? ???
A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation leads to use after free. The name of the patch is 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is recommended to apply a patch to fix this issue. The identifier VDB-211073 was assigned to this vulnerability.
5 CVE-2021-38371 74 2021-08-10 2021-08-20
5.0
 None Remote Low Not required None Partial None
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
6 CVE-2021-27216 269 2021-05-06 2021-05-13
6.3
 None Local Medium Not required None Complete Complete
Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
7 CVE-2020-28026 Exec Code 2021-05-06 2022-07-12
9.3
 None Remote Medium Not required Complete Complete Complete
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root.
8 CVE-2020-28025 125 +Info 2021-05-06 2021-05-10
5.0
 None Remote Low Not required Partial None None
Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to a leak of sensitive information from process memory.
9 CVE-2020-28024 119 Overflow 2021-05-06 2021-05-10
7.5
 None Remote Low Not required Partial Partial Partial
Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can actually push back non-character error codes such as EOF.
10 CVE-2020-28023 125 2021-05-06 2021-05-10
5.0
 None Remote Low Not required Partial None None
Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from process memory to an unauthenticated SMTP client.
11 CVE-2020-28022 119 Overflow 2021-05-06 2021-05-10
7.5
 None Remote Low Not required Partial Partial Partial
Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands.
12 CVE-2020-28021 Exec Code 2021-05-06 2021-05-10
9.0
 None Remote Low ??? Complete Complete Complete
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which indirectly leads to remote code execution as root) via AUTH= in a MAIL FROM command.
13 CVE-2020-28020 190 Exec Code Overflow 2021-05-06 2021-09-03
7.5
 None Remote Low Not required Partial Partial Partial
Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
14 CVE-2020-28019 665 2021-05-06 2021-05-10
5.0
 None Remote Low Not required None None Partial
Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA.
15 CVE-2020-28018 416 2021-05-06 2021-05-26
7.5
 None Remote Low Not required Partial Partial Partial
Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.
16 CVE-2020-28017 190 Overflow 2021-05-06 2022-10-04
7.5
 None Remote Low Not required Partial Partial Partial
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.
17 CVE-2020-28016 787 2021-05-06 2021-05-10
7.2
 None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase.
18 CVE-2020-28015 2021-05-06 2021-05-10
7.2
 None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character.
19 CVE-2020-28014 269 DoS 2021-05-06 2022-07-12
5.6
 None Local Low Not required None Partial Complete
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten.
20 CVE-2020-28013 787 Overflow 2021-05-06 2021-05-10
7.2
 None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy.
21 CVE-2020-28012 2021-05-06 2022-07-12
7.2
 None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag.
22 CVE-2020-28011 787 Overflow 2021-05-06 2021-05-10
7.2
 None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root.
23 CVE-2020-28010 787 2021-05-06 2021-12-03
7.2
 None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms).
24 CVE-2020-28009 190 Overflow 2021-05-06 2021-05-10
7.2
 None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days).
25 CVE-2020-28008 269 Exec Code 2021-05-06 2021-05-10
7.2
 None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution.
26 CVE-2020-28007 59 2021-05-06 2021-05-10
7.2
 None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.
27 CVE-2020-12783 125 Bypass 2020-05-11 2022-11-16
5.0
 None Remote Low Not required Partial None None
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
28 CVE-2019-16928 787 Exec Code Overflow 2019-09-27 2022-03-31
7.5
 None Remote Low Not required Partial Partial Partial
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
29 CVE-2019-15846 Exec Code 2019-09-06 2020-08-24
10.0
 None Remote Low Not required Complete Complete Complete
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
30 CVE-2019-13917 19 Exec Code 2019-07-25 2019-09-07
10.0
 None Remote Low Not required Complete Complete Complete
Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).
31 CVE-2019-10149 78 Exec Code 2019-06-05 2022-11-07
10.0
 None Remote Low Not required Complete Complete Complete
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
32 CVE-2018-6789 119 Exec Code Overflow 2018-02-08 2021-06-03
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
33 CVE-2017-1000369 404 Exec Code 2017-06-19 2019-12-12
2.1
 None Local Low Not required None Partial None
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
34 CVE-2017-16944 835 DoS 2017-11-25 2021-05-04
5.0
 None Remote Low Not required None None Partial
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.
35 CVE-2017-16943 416 DoS Exec Code 2017-11-25 2021-05-04
7.5
 None Remote Low Not required Partial Partial Partial
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
36 CVE-2016-9963 320 2017-02-01 2017-02-15
2.6
 None Remote High Not required Partial None None
Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.
37 CVE-2016-1531 264 +Priv 2016-04-07 2017-09-08
6.9
 None Local Medium Not required Complete Complete Complete
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
38 CVE-2014-2972 189 Exec Code +Priv 2014-09-04 2016-12-03
4.6
 None Local Low Not required Partial Partial Partial
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.
39 CVE-2014-2957 20 Exec Code 2014-09-04 2021-05-04
6.8
 None Remote Medium Not required Partial Partial Partial
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
40 CVE-2012-5671 119 Exec Code Overflow 2012-10-31 2017-08-29
6.8
 None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via an email from a malicious DNS server.
41 CVE-2011-1764 134 DoS Exec Code 2011-10-05 2014-02-21
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
42 CVE-2011-1407 20 Exec Code 2011-05-16 2011-09-07
7.5
 None Remote Low Not required Partial Partial Partial
The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.
43 CVE-2011-0017 20 2011-02-02 2017-08-17
6.9
 None Local Medium Not required Complete Complete Complete
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
44 CVE-2010-4345 264 1 +Priv 2010-12-14 2023-02-13
6.9
 None Local Medium Not required Complete Complete Complete
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
45 CVE-2010-4344 119 1 Exec Code Overflow 2010-12-14 2023-02-13
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
46 CVE-2010-2024 362 DoS +Priv 2010-06-07 2018-10-10
4.4
 None Local Medium Not required Partial Partial Partial
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
47 CVE-2010-2023 362 DoS +Priv 2010-06-07 2018-10-10
4.4
 None Local Medium Not required Partial Partial Partial
transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the st_nlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's file.
Total number of vulnerabilities : 47   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.