Filtered by vendor Exim
Subscriptions
Filtered by product Exim
Subscriptions
Total
49 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-38371 | 1 Exim | 1 Exim | 2021-08-20 | 7.5 High |
| The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending. | ||||
| CVE-2018-6789 | 3 Canonical, Debian, Exim | 3 Ubuntu Linux, Debian Linux, Exim | 2021-06-03 | N/A |
| An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely. | ||||
| CVE-2020-28018 | 1 Exim | 1 Exim | 2021-05-26 | 9.8 Critical |
| Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL. | ||||
| CVE-2020-28008 | 1 Exim | 1 Exim | 2021-05-10 | 7.8 High |
| Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution. | ||||
| CVE-2020-28007 | 1 Exim | 1 Exim | 2021-05-10 | 7.8 High |
| Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem. | ||||
| CVE-2020-28009 | 1 Exim | 1 Exim | 2021-05-10 | 7.8 High |
| Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days). | ||||
| CVE-2020-28011 | 1 Exim | 1 Exim | 2021-05-10 | 7.8 High |
| Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root. | ||||
| CVE-2020-28013 | 1 Exim | 1 Exim | 2021-05-10 | 7.8 High |
| Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy. | ||||
| CVE-2020-28016 | 1 Exim | 1 Exim | 2021-05-10 | 7.8 High |
| Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase. | ||||
| CVE-2020-28015 | 1 Exim | 1 Exim | 2021-05-10 | 7.8 High |
| Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character. | ||||
| CVE-2020-28019 | 1 Exim | 1 Exim | 2021-05-10 | 7.5 High |
| Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA. | ||||
| CVE-2020-28021 | 1 Exim | 1 Exim | 2021-05-10 | 8.8 High |
| Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which indirectly leads to remote code execution as root) via AUTH= in a MAIL FROM command. | ||||
| CVE-2020-28023 | 1 Exim | 1 Exim | 2021-05-10 | 7.5 High |
| Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from process memory to an unauthenticated SMTP client. | ||||
| CVE-2020-28025 | 1 Exim | 1 Exim | 2021-05-10 | 7.5 High |
| Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to a leak of sensitive information from process memory. | ||||
| CVE-2017-16944 | 2 Debian, Exim | 2 Debian Linux, Exim | 2021-05-04 | N/A |
| The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function. | ||||
| CVE-2017-16943 | 2 Debian, Exim | 2 Debian Linux, Exim | 2021-05-04 | N/A |
| The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands. | ||||
| CVE-2014-2957 | 1 Exim | 1 Exim | 2021-05-04 | N/A |
| The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function. | ||||
| CVE-2020-8015 | 2 Exim, Opensuse | 2 Exim, Opensuse | 2020-11-20 | 7.8 High |
| A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1. | ||||
| CVE-2017-1000369 | 2 Debian, Exim | 2 Debian Linux, Exim | 2019-12-12 | 4.0 Medium |
| Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time. | ||||
| CVE-2019-13917 | 2 Debian, Exim | 2 Debian Linux, Exim | 2019-09-07 | N/A |
| Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain). | ||||