openSUSE: Security Advisory for exim (openSUSE-SU-2017:3220-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for exim (important)

This update for exim fixes the following issues: Security issue fixed: - CVE-2017-16943: Fix possible remote code execution boo1069857...

FreeBSD : exim -- remote DoS attack in BDAT processing (75dd622c-d5fd-11e7-b9fe-c13eb7bcbf4f)

Exim developers team reports : The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service infinite loop and stack exhaustion via vectors involving BDAT commands and an improper check for a '.' character signifying the end of...

[ASA-201711-32] exim: multiple issues

Arch Linux Security Advisory ASA-201711-32 ========================================== Severity: Critical Date : 2017-11-30 CVE-ID : CVE-2017-1000369 CVE-2017-10140 CVE-2017-16943 CVE-2017-16944 Package : exim Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-518 Summar...

Exim Use-After-Free Exploit

Exploit for multiple platform in category dos / poc On 25 November 2017 Phil Pennock announced the new release of Exim which included a fix for a use-after-free vulnerability which can result in Remote Code Execution RCE. The vulnerability was reported by a user with the handle “meh” and it all...

Ubuntu 17.04 / 17.10 : exim4 vulnerability (USN-3499-1)

It was discovered that Exim incorrectly handled certain BDAT data headers. A remote attacker could possibly use this issue to cause Exim to crash, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security...

USN-3499-1: Exim vulnerability

It was discovered that Exim incorrectly handled certain BDAT data headers. A remote attacker could possibly use this issue to cause Exim to crash, resulting in a denial of service...

Exim < 4.89.1 Use-After-Free BDAT Remote Code Execution

According to its banner and supported extensions, the remote installation of Exim is affected by a code execution flaw. The implementation of the BDAT SMTP verb for sending large binary messages introduced in Exim 4.88 can incorrectly free an in-use region of memory, leading to memory corruption...

Exim MTA BDAT Denial Of Service (CVE-2017-16944)

A denial of service vulnerability exists in Exim message transfer agent. The vulnerability is due to improper pointer resetting. A remote attacker can exploit this vulnerability by crafting a sequence of BDAT commands. Successful exploitation can lead to program crash on the effected system...

Exim 4.89 - 'BDAT' Denial of Service(CVE-2017-16944)

On 23 November, 2017, we reported two vulnerabilities to Exim. These bugs exist in the SMTP daemon and attackers do not need to be authenticated, including CVE-2017-16943 for a use-after-free UAF vulnerability, which leads to Remote Code Execution RCE; and CVE-2017-16944 for a Denial-of-Service D...

Exim Use-After-Free(CVE-2017-16943)

On 23 November, 2017, we reported two vulnerabilities to Exim. These bugs exist in the SMTP daemon and attackers do not need to be authenticated, including CVE-2017-16943 for a use-after-free UAF vulnerability, which leads to Remote Code Execution RCE; and CVE-2017-16944 for a Denial-of-Service D...

Exim MTA BDAT Remote Code Execution (CVE-2017-16943)

A remote code execution vulnerability exists in Exim message transfer agent. The vulnerability is due to improper pointer resetting. A remote attacker can exploit this vulnerability by crafting a sequence of BDAT commands. Successful exploitation can lead to arbitrary code execution on the effect...

FreeBSD : exim -- remote code execution, deny of service in BDAT (68b29058-d348-11e7-b9fe-c13eb7bcbf4f)

Exim team reports : The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via vectors involving BDAT commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

USN-3493-1: Exim vulnerability

It was discovered that Exim incorrectly handled memory in the ESMTP CHUNKING extension. A remote attacker could use this issue to cause Exim to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the...

CVE-2017-16944

The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service infinite loop and stack exhaustion via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the...

Exim 4.89 Denial Of Service

While parsing BDAT data header, exim still scans for '.' and consider it the end of mail. https://github.com/Exim/exim/blob/master/src/src/receive.cL1867 Exim goes into an incorrect state after this message is sent because the function pointer receivegetc is not reset. If the following command is...

Exim 4.89 - BDAT Denial of Service

Exim 4.89 - BDAT Denial of Service While parsing BDAT data header, exim still scans for '.' and consider it the end of mail. https://github.com/Exim/exim/blob/master/src/src/receive.cL1867 Exim goes into an incorrect state after this message is sent because the function pointer receivegetc is not...

CVE-2017-16944

The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service infinite loop and stack exhaustion via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the...

CVE-2017-16943

The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via vectors involving BDAT commands...

Exim Denial of Service Vulnerability

Exim is an open source messaging agent MTA developed by the University of Cambridge in the UK that runs on Unix systems and is responsible for routing, forwarding and delivering mail. A security vulnerability exists in the 'receivemsg' function of the receive.c file of the SMTP daemon in Exim...