CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Exim » Exim » * * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-38371 74 2021-08-10 2021-08-20
5.0
None Remote Low Not required None Partial None
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
2 CVE-2021-27216 269 2021-05-06 2021-05-13
6.3
None Local Medium Not required None Complete Complete
Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
3 CVE-2020-28026 88 Exec Code 2021-05-06 2021-05-10
9.3
None Remote Medium Not required Complete Complete Complete
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root.
4 CVE-2020-28025 125 +Info 2021-05-06 2021-05-10
5.0
None Remote Low Not required Partial None None
Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to a leak of sensitive information from process memory.
5 CVE-2020-28024 119 Overflow 2021-05-06 2021-05-10
7.5
None Remote Low Not required Partial Partial Partial
Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can actually push back non-character error codes such as EOF.
6 CVE-2020-28023 125 2021-05-06 2021-05-10
5.0
None Remote Low Not required Partial None None
Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from process memory to an unauthenticated SMTP client.
7 CVE-2020-28022 119 Overflow 2021-05-06 2021-05-10
7.5
None Remote Low Not required Partial Partial Partial
Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands.
8 CVE-2020-28021 Exec Code 2021-05-06 2021-05-10
9.0
None Remote Low ??? Complete Complete Complete
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which indirectly leads to remote code execution as root) via AUTH= in a MAIL FROM command.
9 CVE-2020-28020 190 Exec Code Overflow 2021-05-06 2021-09-03
7.5
None Remote Low Not required Partial Partial Partial
Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
10 CVE-2020-28019 665 2021-05-06 2021-05-10
5.0
None Remote Low Not required None None Partial
Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA.
11 CVE-2020-28018 416 2021-05-06 2021-05-26
7.5
None Remote Low Not required Partial Partial Partial
Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.
12 CVE-2020-28017 190 Overflow 2021-05-06 2021-05-10
7.5
None Remote Low Not required Partial Partial Partial
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.
13 CVE-2020-28016 787 2021-05-06 2021-05-10
7.2
None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase.
14 CVE-2020-28015 2021-05-06 2021-05-10
7.2
None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character.
15 CVE-2020-28014 DoS 2021-05-06 2021-05-10
5.6
None Local Low Not required None Partial Complete
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten.
16 CVE-2020-28013 787 Overflow 2021-05-06 2021-05-10
7.2
None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy.
17 CVE-2020-28012 668 2021-05-06 2021-05-10
7.2
None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag.
18 CVE-2020-28011 787 Overflow 2021-05-06 2021-05-10
7.2
None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root.
19 CVE-2020-28010 787 2021-05-06 2021-12-03
7.2
None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms).
20 CVE-2020-28009 190 Overflow 2021-05-06 2021-05-10
7.2
None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days).
21 CVE-2020-28008 269 Exec Code 2021-05-06 2021-05-10
7.2
None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution.
22 CVE-2020-28007 59 2021-05-06 2021-05-10
7.2
None Local Low Not required Complete Complete Complete
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.
23 CVE-2020-12783 125 Bypass 2020-05-11 2021-05-04
5.0
None Remote Low Not required Partial None None
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
24 CVE-2019-16928 787 Exec Code Overflow 2019-09-27 2022-03-31
7.5
None Remote Low Not required Partial Partial Partial
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
25 CVE-2019-15846 Exec Code 2019-09-06 2020-08-24
10.0
None Remote Low Not required Complete Complete Complete
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
26 CVE-2019-13917 19 Exec Code 2019-07-25 2019-09-07
10.0
None Remote Low Not required Complete Complete Complete
Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).
27 CVE-2019-10149 78 Exec Code 2019-06-05 2021-10-28
10.0
None Remote Low Not required Complete Complete Complete
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
28 CVE-2018-6789 119 Exec Code Overflow 2018-02-08 2021-06-03
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
29 CVE-2017-1000369 404 Exec Code 2017-06-19 2019-12-12
2.1
None Local Low Not required None Partial None
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
30 CVE-2016-9963 320 2017-02-01 2017-02-15
2.6
None Remote High Not required Partial None None
Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.
31 CVE-2016-1531 264 +Priv 2016-04-07 2017-09-08
6.9
None Local Medium Not required Complete Complete Complete
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
32 CVE-2014-2972 189 Exec Code +Priv 2014-09-04 2016-12-03
4.6
None Local Low Not required Partial Partial Partial
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.
33 CVE-2014-2957 20 Exec Code 2014-09-04 2021-05-04
6.8
None Remote Medium Not required Partial Partial Partial
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
34 CVE-2011-1764 134 DoS Exec Code 2011-10-05 2014-02-21
7.5
None Remote Low Not required Partial Partial Partial
Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
35 CVE-2011-0017 20 2011-02-02 2017-08-17
6.9
None Local Medium Not required Complete Complete Complete
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
36 CVE-2010-4345 264 1 +Priv 2010-12-14 2021-05-04
6.9
None Local Medium Not required Complete Complete Complete
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
37 CVE-2010-4344 119 1 Exec Code Overflow 2010-12-14 2021-05-04
9.3
None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
38 CVE-2010-2024 362 DoS +Priv 2010-06-07 2018-10-10
4.4
None Local Medium Not required Partial Partial Partial
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
39 CVE-2010-2023 362 DoS +Priv 2010-06-07 2018-10-10
4.4
None Local Medium Not required Partial Partial Partial
transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the st_nlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's file.
Total number of vulnerabilities : 39   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.