Fedora: Security Advisory (FEDORA-2025-e694138ac5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 40 : exim (2025-e694138ac5)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e694138ac5 advisory. This is an update fixing possible remote SQL injection. Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Linux Distros Unpatched Vulnerability : CVE-2019-15846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. CVE-2019-15846 Note that Nessus relies on the presence of...

Linux Distros Unpatched Vulnerability : CVE-2017-1000369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exim supports the use of multiple -p command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cau...

Linux Distros Unpatched Vulnerability : CVE-2018-6789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This...

Linux Distros Unpatched Vulnerability : CVE-2010-2023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the stnlink field of mailbox files, which...

Linux Distros Unpatched Vulnerability : CVE-2010-2024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files,...

GHSA-W6WW-869J-CGM6 vulnerabilities

Vulnerabilities for packages: exim...

GHSA-W6WW-869J-CGM6 vulnerabilities

Vulnerabilities for packages: exim...

Exim 4.98 SQL Injection

Exim versions 4.98 before 4.98.1 suffer from a remote SQL injection vulnerability. CVE 2025-26794 - Sat, 08 Feb 2025 21:14:37 +0100: reported - by: "Oscar Bataille" - to: [email protected] - Sun, 9 Feb 2025 00:00:05 +0100: report confirmed - Tue, 11 Feb 2025 00:23:34 +0100: issue confirmed - Tue,...

Exim 4.98 < 4.98.1 SQLi Vulnerability

Exim is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:exim:exim"; if description...

FreeBSD : exim -- SQL injection (07c34df5-f299-11ef-a441-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 07c34df5-f299-11ef-a441-b42e991fc52e advisory. [email protected] reports: Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allo...

Exim 4.98 SQL Injection Vulnerability

Exim versions 4.98 before 4.98.1 suffer from a remote SQL injection vulnerability. CVE 2025-26794 - Sat, 08 Feb 2025 21:14:37 +0100: reported - by: "Oscar Bataille" - to: email protected - Sun, 9 Feb 2025 00:00:05 +0100: report confirmed - Tue, 11 Feb 2025 00:23:34 +0100: issue confirmed - Tue, 1...

Vulnerabilities include SQLite hint functions and ETRN serialization of the Exim mail server, which allows attackers to cause service interruptions.

The vulnerabilities of SQLite’s hints and Exim mail server’s ETRN serialization are related to the lack of measures taken to protect the SQL query structure. Exploiting these vulnerabilities can allow a malicious actor to cause service failures by sending specially crafted SQL queries...

CVE-2025-26794

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection...

Exploit for CVE-2025-26794

CVE-2025-26794: Blind SQL injection in Exim 4.98 SQLite DBM...

CVE-2025-26794

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection...

CVE-2025-26794

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations...

DEBIAN-CVE-2025-26794

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations...

Vulnerability fixed in Exim

Exim's developers have fixed an SQL injection vulnerability. A malicious party could exploit the vulnerability to execute an SQL injection. This allows the malicious party to gain access to sensitive data and potentially execute arbitrary code with privileges from the Exim installation. The exim...