Exim Out-of-bounds Write Vulnerability

Exim Mail Transfer Agent (MTA) Improper Input Validation

Exim Buffer Overflow Vulnerability

Exim Heap-Based Buffer Overflow Vulnerability

Exim Privilege Escalation Vulnerability

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path

In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an…

Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal…

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection

Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability

Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability

Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability

Exim DMARC dmarc.c dmarc_dns_lookup use after free

Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN)

Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back…

Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer

Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation…

Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL

Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients

Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash

Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an…

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via…

In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or…

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters

Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled

A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges

Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters

Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root

Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag

Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S

Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on…

Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records

Exim Regex use after free

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc

The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending

Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, a crafted…

Exim 4 before 4.94.2 allows Out-of-bounds Read

Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences

Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via…

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument

Exim 4 before 4.94.2 has Execution with Unnecessary Privileges