Vulnerabilities (CVE)

Filtered by vendor Exim Subscribe
Total 49 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-51766 3 Debian, Exim, Fedoraproject 4 Debian Linux, Exim, Extra Packages For Enterprise Linux and 1 more 2024-02-02 N/A 5.3 MEDIUM
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.
CVE-2022-3620 2 Exim, Fedoraproject 2 Exim, Fedora 2023-12-10 N/A 9.8 CRITICAL
A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919.
CVE-2022-3559 2 Exim, Fedoraproject 2 Exim, Fedora 2023-12-10 N/A 7.5 HIGH
A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation leads to use after free. The name of the patch is 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is recommended to apply a patch to fix this issue. The identifier VDB-211073 was assigned to this vulnerability.
CVE-2022-37452 2 Debian, Exim 2 Debian Linux, Exim 2023-12-10 N/A 9.8 CRITICAL
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
CVE-2022-37451 2 Exim, Fedoraproject 2 Exim, Fedora 2023-12-10 N/A 7.5 HIGH
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
CVE-2020-28012 1 Exim 1 Exim 2023-12-10 7.2 HIGH 7.8 HIGH
Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag.
CVE-2021-38371 1 Exim 1 Exim 2023-12-10 5.0 MEDIUM 7.5 HIGH
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
CVE-2020-28022 1 Exim 1 Exim 2023-12-10 7.5 HIGH 9.8 CRITICAL
Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands.
CVE-2020-28020 1 Exim 1 Exim 2023-12-10 7.5 HIGH 9.8 CRITICAL
Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
CVE-2020-28018 1 Exim 1 Exim 2023-12-10 7.5 HIGH 9.8 CRITICAL
Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.
CVE-2020-28008 1 Exim 1 Exim 2023-12-10 7.2 HIGH 7.8 HIGH
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution.
CVE-2020-28013 1 Exim 1 Exim 2023-12-10 7.2 HIGH 7.8 HIGH
Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy.
CVE-2021-27216 1 Exim 1 Exim 2023-12-10 6.3 MEDIUM 6.3 MEDIUM
Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
CVE-2020-28009 1 Exim 1 Exim 2023-12-10 7.2 HIGH 7.8 HIGH
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days).
CVE-2020-28026 1 Exim 1 Exim 2023-12-10 9.3 HIGH 9.8 CRITICAL
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root.
CVE-2020-28024 1 Exim 1 Exim 2023-12-10 7.5 HIGH 9.8 CRITICAL
Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can actually push back non-character error codes such as EOF.
CVE-2020-28011 1 Exim 1 Exim 2023-12-10 7.2 HIGH 7.8 HIGH
Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root.
CVE-2020-28016 1 Exim 1 Exim 2023-12-10 7.2 HIGH 7.8 HIGH
Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase.
CVE-2020-28017 1 Exim 1 Exim 2023-12-10 7.5 HIGH 9.8 CRITICAL
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.
CVE-2020-28023 1 Exim 1 Exim 2023-12-10 5.0 MEDIUM 7.5 HIGH
Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from process memory to an unauthenticated SMTP client.