Exim finally fixes 3 out of 6 vulnerabilities

Exim is a message transfer agent MTA originally developed at the University of Cambridge for use on Unix systems connected to the internet, and is freely available under the terms of the GNU General Public Licence. Even though the name may be new to you, a Shodan search revealed 3.5 million serve...

Security update for exim (critical)

openSUSE Security Update: Security update for exim Announcement ID: openSUSE-SU-2023:0293-1 Rating: critical References: 1215784 1215785 1215786 Cross-References: CVE-2023-42114 CVE-2023-42115 CVE-2023-42116 Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 An update...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : Exim vulnerabilities (USN-6411-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6411-1 advisory. It was discovered that Exim incorrectly handled certain challenge requests. A remote attacker could possibly...

Information Disclosure

Firefox is vulnerable to Information Disclosure. The vulnerability exists after downloading a Windows .url shortcut from the local filesystem, which allows an attacker to supply a remote path that would lead to unexpected network requests from the operating system, leaking the NTLM credentials to...

Stack-based Overflow

exim is vulnerable to Stack-based Overflow. The vulnerability arises from the absence of proper validation of user-supplied data length before copying it into a fixed-length stack-based buffer during the handling of NTLM challenge requests in the SMTP challenge component. This allows an attacker ...

Information Disclosure

exim is vulnerable to Information Disclosure. The vulnerability exists due to the absence of validation for user-supplied data during the handling of NTLM challenge requests. This allows an attacker to read beyond allocated data structures, potentially leading to the disclosure of information...

[SECURITY] [DLA 3599-1] exim4 security update

Debian LTS Advisory DLA-3599-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany October 02, 2023 https://wiki.debian.org/LTS Package : exim4 Version : 4.92-8+deb10u8 CVE ID : CVE-2023-42114 CVE-2023-42116 Several vulnerabilities were discovered in Exim, a mail...

Debian DSA-5512-1 : exim4 - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5512 advisory. Several vulnerabilities were discovered in Exim, a mail transport agent, which could result in remote code execution if the EXTERNAL or SPA/NTLM authenticato...

CVE-2023-42114

An out-of-bounds read vulnerability was found in Exim within the handling of NTLM challenge requests. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to...

CVE-2023-42116

The vulnerability was found in Exim within the handling of NTLM challenge requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the...

SUSE CVE-2023-42116

Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling o...

Exim < 4.96.1 Multiple Vulnerabilities (Sep 2023)

Exim is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:exim:exim"; if description...

CVE-2023-42114

Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling o...

CVE-2023-42116

Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling o...

(0Day) Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validati...

(0Day) Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of th...

Microsoft Releases Patch for Two New Actively Exploited Zero-Days Flaws

Microsoft has released software fixes to remediate 59 bugs spanning its product portfolio, including two zero-day flaws that have been actively exploited by malicious cyber actors. Of the 59 vulnerabilities, five are rated Critical, 55 are rated Important, and one is rated Moderate in severity. T...

Patch now! September Microsoft Patch Tuesday includes two actively exploited zero-days

Microsoft's September 2023 Patch Tuesday is another important one. Not because it's a busy one, but because we have some special cases. Patch Tuesday includes security updates for 59 bugs, two of which are known to be actively exploited. The Cybersecurity & Infrastructure Security Agency CISA has...

Microsoft Word 2013 Service Pack 1 Information Disclosure Vulnerability (KB5002483)

This host is missing an important security update according to Microsoft KB5002483 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Patch Tuesday - September 2023

Microsoft is addressing 65 vulnerabilities this September Patch Tuesday, including two zero-day vulnerabilities, as well as four critical remote code execution RCE vulnerabilities, and six republished third-party vulnerabilities. Word: zero-day NTLM hash disclosure Microsoft Word receives a patch...