Exim Privilege Escalation Vulnerability

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters

Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled

A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges

Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters

Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root

Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag

Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S

Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on…

Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records

Exim Regex use after free

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc

The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending

Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, a crafted…

Exim 4 before 4.94.2 allows Out-of-bounds Read

Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences

Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via…

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument