Lucene search

Ubuntu.comUB:CVE-2014-2972

HistorySep 04, 2014 - 12:00 a.m.

CVE-2014-2972

2014-09-0400:00:00

ubuntu.com

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%

JSON

expand.c in Exim before 4.83 expands mathematical comparisons twice, which
allows local users to gain privileges and execute arbitrary commands via a
crafted lookup value.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=1122552>

Notes

Author	Note
mdeslaur	patch may introduce behaviour change

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchexim4< 4.76-3ubuntu3.3UNKNOWN
ubuntu14.04noarchexim4< 4.82-3ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	exim4	< 4.76-3ubuntu3.3	UNKNOWN
ubuntu	14.04	noarch	exim4	< 4.82-3ubuntu2.1	UNKNOWN

References

lists.fedoraproject.org/pipermail/package-announce/2014-August/136251.html

lists.fedoraproject.org/pipermail/package-announce/2014-August/136264.html

launchpad.net/bugs/cve/CVE-2014-2972

lists.exim.org/lurker/message/20140722.145949.42c043f5.en.html

lists.exim.org/lurker/message/20140722.152452.d6c019e8.en.html

nvd.nist.gov/vuln/detail/CVE-2014-2972

security-tracker.debian.org/tracker/CVE-2014-2972

ubuntu.com/security/notices/USN-2933-1

www.cve.org/CVERecord?id=CVE-2014-2972

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%

JSON

Related for UB:CVE-2014-2972