| CVE-2020-28014 | 中危6.1 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten. | 06/05/2021 |
| CVE-2020-28013 | 高危7.8 | Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy. | 06/05/2021 |
| CVE-2020-28012 | 高危7.8 | Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag. | 06/05/2021 |
| CVE-2020-28011 | 高危7.8 | Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root. | 06/05/2021 |
| CVE-2020-28010 | 高危7.8 | Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms). | 06/05/2021 |
| CVE-2020-28009 | 高危7.8 | Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days). | 06/05/2021 |
| CVE-2020-28008 | 高危7.8 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution. | 06/05/2021 |
| CVE-2020-28007 | 高危7.8 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem. | 06/05/2021 |
| CVE-2020-12783 | 高危7.5 | Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. | 11/05/2020 |
| CVE-2020-8015 | 高危7.8 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1. | 02/04/2020 |
| CVE-2019-16928KEV | 严重9.8 | Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command. | 27/09/2019 |
| CVE-2019-15846 | 严重9.8 | Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. | 06/09/2019 |
| CVE-2019-13917 | 严重9.8 | Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain). | 25/07/2019 |
| CVE-2019-10149KEV | 严重9.8 | A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. | 05/06/2019 |
| CVE-2018-6789KEV | 严重9.8 | An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely. | 08/02/2018 |
| CVE-2017-16944 | 高危7.5 | The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function. | 25/11/2017 |
| CVE-2017-16943 | 严重9.8 | The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands. | 25/11/2017 |
| CVE-2017-1000369 | 中危4.0 | Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a | 19/06/2017 |
| CVE-2016-9963 | 中危5.9 | Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages. | 01/02/2017 |
| CVE-2016-1531 | 高危7.0 | Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. | 07/04/2016 |