Unscored severity · published May 16, 2011
CVE-2011-1407
The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute…
–
CVSS
3.8%
EPSS
No
On KEV
Description
The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Exim · Exim
4.70; 4.71; 4.72; 4.73; 4.74; 4.75 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1407
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1407
www.debian.org
http://www.debian.org/security/2011/dsa-2236
www.securityfocus.com
http://www.securityfocus.com/bid/47836
www.ubuntu.com
http://www.ubuntu.com/usn/USN-1135-1
Patch
https://lists.exim.org/lurker/message/20110509.091632.daed0206.en.html
Patch
https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html
More from Exim
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation
9.8
CVE-2018-6789
Exim Buffer Overflow Vulnerability
9.8
CVE-2010-4344
Exim Heap-Based Buffer Overflow Vulnerability
7.8
CVE-2010-4345
Exim Privilege Escalation Vulnerability