Exim
by Exim
Source repositories
CVEs (77)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2002-1381 | 0.03 | — | 0.02 | Dec 23, 2002 | Format string vulnerability in daemon.c for Exim 4.x through 4.10, and 3.x through 3.36, allows exim administrative users to execute arbitrary code by modifying the pid_file_path value. | |||
| CVE-1999-0971 | 0.03 | — | 0.01 | Jul 22, 1997 | Buffer overflow in Exim allows local users to gain root privileges via a long :include: option in a .forward file. | |||
| CVE-2012-5671 | 0.01 | — | 0.08 | Oct 31, 2012 | Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via… | |||
| CVE-2004-0400 | 0.01 | — | 0.07 | Jul 7, 2004 | Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check. | |||
| CVE-2001-0889 | 0.01 | — | 0.06 | Dec 19, 2001 | Exim 3.22 and earlier, in some configurations, does not properly verify the local part of an address when redirecting the address to a pipe, which could allow remote attackers to execute arbitrary commands via shell metacharacters. | |||
| CVE-2022-37452 | Cri | 0.00 | 9.8 | 0.04 | Aug 7, 2022 | Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set. | ||
| CVE-2022-37451 | Hig | 0.00 | 7.5 | 0.03 | Aug 6, 2022 | Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc. | ||
| CVE-2014-2972 | 0.00 | — | 0.00 | Sep 4, 2014 | expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value. | |||
| CVE-2014-2957 | 0.00 | — | 0.05 | Sep 4, 2014 | The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function. | |||
| CVE-2011-1764 | 0.00 | — | 0.04 | Oct 5, 2011 | Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by… | |||
| CVE-2011-1407 | 0.00 | — | 0.04 | May 16, 2011 | The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity. | |||
| CVE-2011-0017 | 0.00 | — | 0.00 | Feb 2, 2011 | The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack. | |||
| CVE-2010-2024 | 0.00 | — | 0.00 | Jun 7, 2010 | transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/. | |||
| CVE-2010-2023 | 0.00 | — | 0.00 | Jun 7, 2010 | transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the st_nlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's… | |||
| CVE-2005-0022 | 0.00 | — | 0.01 | May 2, 2005 | Buffer overflow in the spa_base64_to_bits function in Exim before 4.43, as originally obtained from Samba code, and as called by the auth_spa_client function, may allow attackers to execute arbitrary code during SPA authentication. | |||
| CVE-2003-0743 | 0.00 | — | 0.06 | Oct 20, 2003 | Heap-based buffer overflow in smtp_in.c for Exim 3 (exim3) before 3.36 and Exim 4 (exim4) before 4.21 may allow remote attackers to execute arbitrary code via an invalid (1) HELO or (2) EHLO argument with a large number of spaces followed by a NULL character and a newline, which… | |||
| CVE-2002-0274 | 0.00 | — | 0.00 | May 31, 2002 | Exim 3.34 and earlier may allow local users to gain privileges via a buffer overflow in long -C (configuration file) and other command line arguments. |
- CVE-2002-1381Dec 23, 2002risk 0.03cvss —epss 0.02
Format string vulnerability in daemon.c for Exim 4.x through 4.10, and 3.x through 3.36, allows exim administrative users to execute arbitrary code by modifying the pid_file_path value.
- CVE-1999-0971Jul 22, 1997risk 0.03cvss —epss 0.01
Buffer overflow in Exim allows local users to gain root privileges via a long :include: option in a .forward file.
- CVE-2012-5671Oct 31, 2012risk 0.01cvss —epss 0.08
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via…
- CVE-2004-0400Jul 7, 2004risk 0.01cvss —epss 0.07
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
- CVE-2001-0889Dec 19, 2001risk 0.01cvss —epss 0.06
Exim 3.22 and earlier, in some configurations, does not properly verify the local part of an address when redirecting the address to a pipe, which could allow remote attackers to execute arbitrary commands via shell metacharacters.
- risk 0.00cvss 9.8epss 0.04
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- risk 0.00cvss 7.5epss 0.03
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
- CVE-2014-2972Sep 4, 2014risk 0.00cvss —epss 0.00
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.
- CVE-2014-2957Sep 4, 2014risk 0.00cvss —epss 0.05
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
- CVE-2011-1764Oct 5, 2011risk 0.00cvss —epss 0.04
Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by…
- CVE-2011-1407May 16, 2011risk 0.00cvss —epss 0.04
The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.
- CVE-2011-0017Feb 2, 2011risk 0.00cvss —epss 0.00
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
- CVE-2010-2024Jun 7, 2010risk 0.00cvss —epss 0.00
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
- CVE-2010-2023Jun 7, 2010risk 0.00cvss —epss 0.00
transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the st_nlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's…
- CVE-2005-0022May 2, 2005risk 0.00cvss —epss 0.01
Buffer overflow in the spa_base64_to_bits function in Exim before 4.43, as originally obtained from Samba code, and as called by the auth_spa_client function, may allow attackers to execute arbitrary code during SPA authentication.
- CVE-2003-0743Oct 20, 2003risk 0.00cvss —epss 0.06
Heap-based buffer overflow in smtp_in.c for Exim 3 (exim3) before 3.36 and Exim 4 (exim4) before 4.21 may allow remote attackers to execute arbitrary code via an invalid (1) HELO or (2) EHLO argument with a large number of spaces followed by a NULL character and a newline, which…
- CVE-2002-0274May 31, 2002risk 0.00cvss —epss 0.00
Exim 3.34 and earlier may allow local users to gain privileges via a buffer overflow in long -C (configuration file) and other command line arguments.
Page 4 of 4