Unscored severity · published Sep 4, 2014
CVE-2014-2972
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value
–
CVSS
0.5%
EPSS
No
On KEV
Description
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Exim · Exim
through 4.82.1; 4.00; 4.01; 4.02; 4.03; 4.04; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2972
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2972
git.exim.org
http://git.exim.org/exim.git/commitdiff/7685ce68148a083d7759e78d01aa5198fc099c44
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136251.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136264.html
www.ubuntu.com
http://www.ubuntu.com/usn/USN-2933-1
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1122552
Patch
https://lists.exim.org/lurker/message/20140722.145949.42c043f5.en.html
More from Exim
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation
9.8
CVE-2018-6789
Exim Buffer Overflow Vulnerability
9.8
CVE-2010-4344
Exim Heap-Based Buffer Overflow Vulnerability
7.8
CVE-2010-4345
Exim Privilege Escalation Vulnerability