CVE-2017-16944

None...

CVE-2017-16944

The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service infinite loop and stack exhaustion via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the...

CVE-2017-16943

The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via vectors involving BDAT commands...

exim -- remote DoS attack in BDAT processing

Exim developers team reports: The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service infinite loop and stack exhaustion via vectors involving BDAT commands and an improper check for a '.' character signifying the end of t...

PT-2017-3323

Name of the Vulnerable Software and Affected Versions Exim versions 4.88 through 4.89 Description The issue is related to the receive msg function in receive.c within the SMTP daemon of Exim. It allows remote attackers to execute arbitrary code or cause a denial of service due to a use-after-free...

exim -- remote code execution, deny of service in BDAT

Exim team reports: The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via vectors involving BDAT commands...

GHSA-RP63-JFMW-532W Mail Gem Improper Input Validation vulnerability

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a 1 sendmail or 2 exim delivery...

Mail Gem Improper Input Validation vulnerability

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a 1 sendmail or 2 exim delivery...

GLSA-201709-19 : Exim: Local privilege escalation (Stack Clash)

The remote host is affected by the vulnerability described in GLSA-201709-19 Exim: Local privilege escalation Exim supports the use of multiple -p command line arguments causing a memory leak. This could lead to a stack-clash in user-space and as result the attacker can, clash or smash the stack ...

Exim: Local privilege escalation

Background Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. Description Exim supports the use of multiple “-p” command line arguments causing a memory leak. This could lead to a stack-clash in user-space and as result...

Fedora Update for exim FEDORA-2017-f5177f3a16

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 26 : exim (2017-f5177f3a16) (Stack Clash)

This is an update fixing multiple memory leaks and other problems. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 26 Update: exim-4.89-5.fc26

Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...

openSUSE Security Update : exim (openSUSE-2017-980) (Stack Clash)

This update for exim fixes the following issues : Changes in exim : - specify users with ref:mail, to make them dynamic. boo1046971 - CVE-2017-1000369: Fixed memory leaks that could be exploited to 'stack crash' local privilege escalation boo1044692 - Require usermail groupmail to meet new users...

openSUSE: Security Advisory for exim (openSUSE-SU-2017:2289-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for exim (important)

This update for exim fixes the following issues: Changes in exim: - specify users with ref:mail, to make them dynamic. boo1046971 - CVE-2017-1000369: Fixed memory leaks that could be exploited to "stack crash" local privilege escalation boo1044692 - Require usermail groupmail to meet new users...

openSUSE Security Update : exim (openSUSE-2017-714) (Stack Clash)

This update for exim fixes the following issues : - CVE-2017-1000369: Fixed a memory leak in exim commandline handling, which could be used to exhaust memory and make 'stack crash' attacks likely. boo1044692 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

FreeBSD : exim -- Privilege escalation via multiple memory leaks (8c1a271d-56cf-11e7-b9fe-c13eb7bcbf4f) (Stack Clash)

Qualsys reports : Exim supports the use of multiple '-p' command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has...

PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution Exploit

Exploit for php platform in category web applications !/usr/bin/python Exploit Title: RCE for PHPMailer 5.2.20 with Exim MTA Date: 16/06/2017 Exploit Author: @phacktul Software Link: https://github.com/PHPMailer/PHPMailer Version: 5.2.20 Tested on: Debian x86/x64 CVE :...

CVE-2017-1000369

Exim supports the use of multiple "-p" command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch...