6.9

CVE-2011-0017

The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exim ≫ Exim Version <= 4.72
Exim ≫ Exim Version2.10
Exim ≫ Exim Version2.11
Exim ≫ Exim Version2.12
Exim ≫ Exim Version3.00
Exim ≫ Exim Version3.01
Exim ≫ Exim Version3.02
Exim ≫ Exim Version3.03
Exim ≫ Exim Version3.10
Exim ≫ Exim Version3.11
Exim ≫ Exim Version3.12
Exim ≫ Exim Version3.13
Exim ≫ Exim Version3.14
Exim ≫ Exim Version3.15
Exim ≫ Exim Version3.16
Exim ≫ Exim Version3.20
Exim ≫ Exim Version3.21
Exim ≫ Exim Version3.22
Exim ≫ Exim Version3.30
Exim ≫ Exim Version3.31
Exim ≫ Exim Version3.32
Exim ≫ Exim Version3.33
Exim ≫ Exim Version3.34
Exim ≫ Exim Version3.35
Exim ≫ Exim Version3.36
Exim ≫ Exim Version4.00
Exim ≫ Exim Version4.01
Exim ≫ Exim Version4.02
Exim ≫ Exim Version4.03
Exim ≫ Exim Version4.04
Exim ≫ Exim Version4.05
Exim ≫ Exim Version4.10
Exim ≫ Exim Version4.11
Exim ≫ Exim Version4.12
Exim ≫ Exim Version4.14
Exim ≫ Exim Version4.20
Exim ≫ Exim Version4.21
Exim ≫ Exim Version4.22
Exim ≫ Exim Version4.23
Exim ≫ Exim Version4.24
Exim ≫ Exim Version4.30
Exim ≫ Exim Version4.31
Exim ≫ Exim Version4.32
Exim ≫ Exim Version4.33
Exim ≫ Exim Version4.34
Exim ≫ Exim Version4.40
Exim ≫ Exim Version4.41
Exim ≫ Exim Version4.42
Exim ≫ Exim Version4.43
Exim ≫ Exim Version4.44
Exim ≫ Exim Version4.50
Exim ≫ Exim Version4.51
Exim ≫ Exim Version4.52
Exim ≫ Exim Version4.53
Exim ≫ Exim Version4.54
Exim ≫ Exim Version4.60
Exim ≫ Exim Version4.61
Exim ≫ Exim Version4.62
Exim ≫ Exim Version4.63
Exim ≫ Exim Version4.64
Exim ≫ Exim Version4.65
Exim ≫ Exim Version4.66
Exim ≫ Exim Version4.67
Exim ≫ Exim Version4.68
Exim ≫ Exim Version4.69
Exim ≫ Exim Version4.70
Exim ≫ Exim Version4.71
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.32
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.