Veracode Vulnerability DatabaseVERACODE:36685Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
41.4%
exim is vulnerable to denial of service. The vulnerability exists due to an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
| CPE | Name | Operator | Version |
|---|---|---|---|
| exim4:sid | eq | 4.94-9 | |
| exim4:sid | eq | 4.95~RC2-1 | |
| exim4:sid | eq | 4.94-9 | |
| exim4:sid | eq | 4.95~RC2-1 |
References
cwe.mitre.org/data/definitions/762.html
github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42
github.com/Exim/exim/compare/exim-4.95...exim-4.96
github.com/Exim/exim/wiki/EximSecurity
github.com/ivd38/exim_invalid_free
lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html
lists.fedoraproject.org/archives/list/[email protected]/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/
lists.fedoraproject.org/archives/list/[email protected]/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/
security-tracker.debian.org/tracker/CVE-2022-37451
www.exim.org/static/doc/security/
www.openwall.com/lists/oss-security/2022/08/06/1
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
41.4%