exim

The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.

Exim 4 before 4.94.2 has improper neutralization of line delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN)....

Exim 4 before 4.94.2 allows out-of-bounds read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len;...

Exim 4 before 4.94.2 allows buffer underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only...

Exim 4 before 4.94.2 allows out-of-bounds read. smtp_setup_msg may disclose sensitive information from process memory to an unauthenticated SMTP client.

Exim 4 before 4.94.2 has improper restriction of write operations within the bounds of a memory buffer. This occurs when processing name=value pairs within...

Exim 4 before 4.94.2 has improper neutralization of line delimiters. An authenticated remote SMTP client can insert newline characters into a spool file...

Exim 4 before 4.92 allows integer overflow to buffer overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the...

Exim 4 before 4.94.2 has improper initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of...

Exim 4 before 4.94.2 allows use after free in smtp_reset in certain situations that may be common for builds with OpenSSL.

Exim 4 before 4.94.2 allows integer overflow to buffer overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote...

Exim 4 before 4.94.2 allows an off-by-two out-of-bounds write because "-F ''" is mishandled by parse_fix_phrase.

Exim 4 before 4.94.2 has improper neutralization of line delimiters. Local users can alter the behavior of root processes because a recipient address can...

Exim 4 before 4.94.2 allows execution with unnecessary privileges. The -oP option is available to the exim user, and allows a denial of service because...

Exim 4 before 4.94.2 allows heap-based buffer overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any...

Exim 4 before 4.94.2 allows exposure of file descriptors to an unintended control sphere because rda_interpret uses a privileged pipe that lacks a...

Exim 4 before 4.94.2 allows heap-based buffer overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root.

Exim 4 before 4.94.2 allows out-of-bounds writes because the main function, while setuid root, copies the current working directory pathname into a buffer...

Exim 4 before 4.94.2 allows integer overflow to buffer overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a...

Exim 4 before 4.94.2 allows execution with unnecessary privileges. Because Exim operates as root in the spool directory (owned by a non- root user), an...

Exim 4 before 4.94.2 allows execution with unnecessary privileges. Because Exim operates as root in the log directory (owned by a non- root user), a symlink...

It has been discovered that Exim before 4.92.3 is vulnerable to a heap-based buffer overflow in string_vformat (string.c) involving a long EHLO command...

Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.

Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that...

A flaw was found in the way exim validated recipient addresses. A remote attacker could use this flaw to execute arbitrary commands on the exim server with...

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen....

An uncontrolled resource consumption flaw has been discovered in Exim before 4.89.1. The use of multiple "-p" command line arguments which are malloc()'ed...

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack...

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of...

It was found that Berkeley DB reads the DB_CONFIG configuration file from the current working directory by default. This happens when calling db_create()...

It was found that Exim leaked DKIM signing private keys to the "mainlog" log file. As a result, an attacker with access to system log files could...