Exim

exim

64 CVEs • 1 product

Products (1)

Click to collapse

Toggle

Exim

exim

64 CVEs

CVEs (64)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-28008 1Exim 1Exim Jun 17, 2026 May 6, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in...Show more Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution.Show less
CVE-2020-28007 1Exim 1Exim Jun 17, 2026 May 6, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files...Show more Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.Show less
CVE-2020-12783 4Canonical DebianExim+1 more 4Debian Linux EximFedora+1 more Jun 17, 2026 May 11, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
CVE-2020-8015 1Exim 1Exim Jun 17, 2026 Apr 2, 2020 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4...Show more A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.Show less
CVE-2019-16928 4Canonical DebianExim+1 more 4Debian Linux EximFedora+1 more Jun 17, 2026 Sep 27, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-15846 2Debian Exim 2Debian Linux Exim Jun 17, 2026 Sep 6, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
CVE-2019-13917 2Debian Exim 2Debian Linux Exim Jun 17, 2026 Jul 25, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).
CVE-2019-10149 3Canonical DebianExim 3Debian Linux EximUbuntu Linux Jun 17, 2026 Jun 5, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-6789 3Canonical DebianExim 3Debian Linux EximUbuntu Linux Jun 17, 2026 Feb 8, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
CVE-2017-16944 2Debian Exim 2Debian Linux Exim May 13, 2026 Nov 25, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper...Show more The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.Show less
CVE-2017-16943 2Debian Exim 2Debian Linux Exim May 13, 2026 Nov 25, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
CVE-2017-1000369 2Debian Exim 2Debian Linux Exim May 13, 2026 Jun 19, 2017 N/A· v4 4.0 MEDIUM· v3 2.1 LOW· v2 Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version...Show more Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.Show less
CVE-2016-9963 3Canonical DebianExim 3Debian Linux EximUbuntu Linux May 13, 2026 Feb 1, 2017 N/A· v4 5.9 MEDIUM· v3 2.6 LOW· v2 Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.
CVE-2016-1531 1Exim 1Exim May 6, 2026 Apr 7, 2016 N/A· v4 7.0 HIGH· v3 6.9 MEDIUM· v2 Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
CVE-2014-2972 1Exim 1Exim May 6, 2026 Sep 4, 2014 N/A· v4 N/A· v3 4.6 MEDIUM· v2 expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.
CVE-2014-2957 1Exim 1Exim May 6, 2026 Sep 4, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string fun...Show more The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.Show less
CVE-2012-5671 1Exim 1Exim Apr 29, 2026 Oct 31, 2012 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_veri...Show more Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via an email from a malicious DNS server.Show less
CVE-2011-1764 1Exim 1Exim Apr 29, 2026 Oct 5, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string s...Show more Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.Show less
CVE-2011-1407 1Exim 1Exim Apr 29, 2026 May 16, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via...Show more The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.Show less
CVE-2011-0017 1Exim 1Exim Apr 29, 2026 Feb 2, 2011 N/A· v4 N/A· v3 6.9 MEDIUM· v2 The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.

Previous 1 234 Next