Unscored severity · published Sep 4, 2014
CVE-2014-2957
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email,…
–
CVSS
5.3%
EPSS
No
On KEV
Description
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Exim · Exim
through 4.82; 4.00; 4.01; 4.02; 4.03; 4.04; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2957
git.exim.org
http://git.exim.org/exim.git/commitdiff/5b7a7c051c9ab9ee7c924a611f90ef2be03e0ad0
www.openwall.com
http://www.openwall.com/lists/oss-security/2021/05/04/7
Patch
https://lists.exim.org/lurker/message/20140528.122536.a31d60a4.en.html
More from Exim
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation
9.8
CVE-2018-6789
Exim Buffer Overflow Vulnerability
9.8
CVE-2010-4344
Exim Heap-Based Buffer Overflow Vulnerability
7.8
CVE-2010-4345
Exim Privilege Escalation Vulnerability