Headline
CVE-2022-37451: Index of /static/doc/security/
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
…/ CVE-2020-qualys/ 07-Jun-2021 19:57 - CVE-2016-1531.txt 28-Jul-2022 23:28 2043 CVE-2016-9963.txt 28-Jul-2022 23:28 3614 CVE-2018-6789.txt 28-Jul-2022 23:28 877 CVE-2019-10149.txt 28-Jul-2022 23:28 1444 CVE-2019-13917.txt 28-Jul-2022 23:28 2715 CVE-2019-15846.txt 28-Jul-2022 23:28 2349 CVE-2019-16928.txt 28-Jul-2022 23:28 1567 README 16-Jan-2019 04:35 578
Related news
Multiple security vulnerabilities have been disclosed in the Exim mail transfer agent that, if successfully exploited, could result in information disclosure and remote code execution. The list of flaws, which were reported anonymously way back in June 2022, is as follows - CVE-2023-42114 (CVSS score: 3.7) - Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.
This week, MSRC confirmed the presence of an active Linux worm leveraging a critical Remote Code Execution (RCE) vulnerability, CVE-2019-10149, in Linux Exim email servers running Exim version 4.87 to 4.91. Microsoft Azure infrastructure and Services are not affected; only customer’s Linux IaaS instances running a vulnerable version of Exim are affected.
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.