2281 matches found
exim: Fix of CVE-2021-38371
CVE-2021-38371: Enforce STARTTLS sync point, client side in src/transports/smtp.c...
Medium: exim
Issue Overview: Exim before 4.96 has an invalid free in pamconverse in auths/callpam.c because storefree is not used after storemalloc. CVE-2022-37451 Affected Packages: exim Issue Correction: Run yum update exim or yum update --advisory ALAS-2023-1753 to update your system. New Packages: i686: ...
Amazon Linux AMI : exim (ALAS-2023-1753)
The version of exim installed on the remote host is prior to 4.92-1.37. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1753 advisory. Exim before 4.96 has an invalid free in pamconverse in auths/callpam.c because storefree is not used after storemalloc. CVE-2022-3745...
Amazon Linux AMI : exim (ALAS-2023-1722)
The version of exim installed on the remote host is prior to 4.92-1.36. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1722 advisory. The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending. CVE-2021-38371 Tenable has...
Important: exim
Issue Overview: The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending. CVE-2021-38371 Affected Packages: exim Issue Correction: Run yum update exim or yum update --advisory ALAS-2023-1722 to update your system. New Packages: i686: ...
SUSE CVE-2004-0400
Stack-based buffer overflow in Exim 4 before 4.33, when the headerschecksyntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check...
SUSE CVE-2004-0399
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the senderverify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification...
SUSE CVE-2005-0022
Buffer overflow in the spabase64tobits function in Exim before 4.43, as originally obtained from Samba code, and as called by the authspaclient function, may allow attackers to execute arbitrary code during SPA authentication...
SUSE CVE-2005-0021
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via 1 an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the hostaton function, or 2 the -bh command line option or dnsdb PTR...
SUSE CVE-2010-2023
transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the stnlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's file...
SUSE CVE-2010-2024
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/...
SUSE CVE-2010-4345
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spooldirectory directive...
SUSE CVE-2010-4344
Heap-based buffer overflow in the stringvformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging...
SUSE CVE-2011-0017
The openlog function in log.c in Exim 4.72 and earlier does not check the return value from 1 setuid or 2 setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack...
SUSE CVE-2011-1407
The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity...
SUSE CVE-2011-1764
Format string vulnerability in the dkimeximverifyfinish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service daemon crash via format string specifiers in data used in DKIM logging, as demonstrated by an identity field...
SUSE CVE-2012-2140
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a 1 sendmail or 2 exim delivery...
SUSE CVE-2012-5671
Heap-based buffer overflow in the dkimeximquerydnstxt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and aclsmtpconnect and aclsmtprcpt are not set to "warn control = dkimdisableverify," allows remote attackers to execute arbitrary code via an email from a malicious DN...
SUSE CVE-2014-2957
The dmarcprocess function in dmarc.c in Exim before 4.82.1, when EXPERIMENTALDMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expandstring function...