CVE-2020-28020 - log back

CVE-2020-28020 edited at 06 May 2021 17:26:23
Severity
- Medium
+ High
Description
- An integer overflow in receive_msg() has been found in Exim before version 4.92 that allows for unauthenticated remote code as the "exim" user.
+ Exim 4 before 4.92 allows integer overflow to buffer overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
References
https://www.openwall.com/lists/oss-security/2021/05/04/6
https://www.qualys.com/2021/05/04/21nails/21nails.txt
+ https://git.exim.org/exim.git/commitdiff/c5f2f5cf2a6b45ae7ba0ed15e04fbe014727b210
CVE-2020-28020 edited at 04 May 2021 14:43:12
Description
- An integer overflow in receive_msg() has been found in Exim before version 4.94.2.
+ An integer overflow in receive_msg() has been found in Exim before version 4.92 that allows for unauthenticated remote code as the "exim" user.
References
https://www.openwall.com/lists/oss-security/2021/05/04/6
https://www.qualys.com/2021/05/04/21nails/21nails.txt
Notes
CVE-2020-28020 edited at 04 May 2021 14:03:01
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Arbitrary code execution
Description
+ An integer overflow in receive_msg() has been found in Exim before version 4.94.2.
References
+ https://www.openwall.com/lists/oss-security/2021/05/04/6
+ https://www.qualys.com/2021/05/04/21nails/21nails.txt
CVE-2020-28020 created at 04 May 2021 13:46:53