CVE-2020-28021

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file which indirectly leads to remote code execution as root via AUTH= in a MAIL FROM command...

CVE-2020-28021

Exim 4 prior to 4.94.2 contains an improper neutralization of line delimiters vulnerability. An authenticated remote SMTP client can inject newline characters via AUTH= in MAIL FROM, potentially enabling remote code execution as root. Remediation: upgrade to Exim 4.94.2 or later.

CVE-2020-28021

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file which indirectly leads to remote code execution as root via AUTH= in a MAIL FROM command...

EUVD-2020-20511

Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction...

CVE-2020-28020

Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction...

CVE-2020-28020

CVE-2020-28020 affects Exim 4.x prior to the 4.92 baseline, where an Integer Overflow to Buffer Overflow defect exists in the handling of continuation lines during header-length restriction (unauthenticated remote code execution). Connected advisories confirm this CVE is among multiple OpenSUSE/D...

CVE-2020-28020

Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction...

CVE-2020-28020

Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction...

CVE-2020-28019

Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA...

CVE-2020-28019

CVE-2020-28019 is an Exim 4 vulnerability: versions prior to 4.94.2 suffer from Improper Initialization that can cause recursion-based stack consumption or other consequences when a client uses BDAT instead of DATA. The issue stems from how certain getc functions are mishandled in that BDAT flow,...

CVE-2020-28019

Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA...

CVE-2020-28019

Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA...

CVE-2020-28018

Exim 4 before 4.94.2 allows Use After Free in smtpreset in certain situations that may be common for builds with OpenSSL...

CVE-2020-28018

Exim 4 before 4.94.2 is affected by a Use-After-Free in smtp_reset when TLS/OpenSSL is in use, enabling remote code execution via crafted TLS/SMTP sequences. The flaw centers on a freed gstring buffer in tls_write(), which can be referenced after smtp_reset frees pool memory, potentially leaking ...

CVE-2020-28018

Exim 4 before 4.94.2 allows Use After Free in smtpreset in certain situations that may be common for builds with OpenSSL...

CVE-2020-28017

Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receiveaddrecipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption...

CVE-2020-28017

Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receiveaddrecipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption...

CVE-2020-28017

Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receiveaddrecipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption...

CVE-2020-28017

Exim 4 prior to 4.94.2 is vulnerable to an Integer Overflow to Buffer Overflow in receive_add_recipient when processing an e-mail with a very large recipient list (e.g., fifty million recipients). This can lead to buffer overflow conditions. Public sources (e.g., Exim advisories and Debian securi...

CVE-2020-28016

Exim 4 before 4.94.2 is affected by a heap/out-of-bounds write (off-by-two) caused by mishandling of -F '' in parse_fix_phrase. If exploiting, this could enable local/write conditions as outlined in CVE-2020-28016. The issue is fixed in Exim 4.94.2; upgrading to that version is the recommended re...