7.5

CVE-2011-1764

Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exim ≫ Exim Version <= 4.75
Exim ≫ Exim Version 2.10
Exim ≫ Exim Version 2.11
Exim ≫ Exim Version 2.12
Exim ≫ Exim Version 3.00
Exim ≫ Exim Version 3.01
Exim ≫ Exim Version 3.02
Exim ≫ Exim Version 3.03
Exim ≫ Exim Version 3.10
Exim ≫ Exim Version 3.11
Exim ≫ Exim Version 3.12
Exim ≫ Exim Version 3.13
Exim ≫ Exim Version 3.14
Exim ≫ Exim Version 3.15
Exim ≫ Exim Version 3.16
Exim ≫ Exim Version 3.20
Exim ≫ Exim Version 3.21
Exim ≫ Exim Version 3.22
Exim ≫ Exim Version 3.30
Exim ≫ Exim Version 3.31
Exim ≫ Exim Version 3.32
Exim ≫ Exim Version 3.33
Exim ≫ Exim Version 3.34
Exim ≫ Exim Version 3.35
Exim ≫ Exim Version 3.36
Exim ≫ Exim Version 4.00
Exim ≫ Exim Version 4.01
Exim ≫ Exim Version 4.02
Exim ≫ Exim Version 4.03
Exim ≫ Exim Version 4.04
Exim ≫ Exim Version 4.05
Exim ≫ Exim Version 4.10
Exim ≫ Exim Version 4.11
Exim ≫ Exim Version 4.12
Exim ≫ Exim Version 4.14
Exim ≫ Exim Version 4.20
Exim ≫ Exim Version 4.21
Exim ≫ Exim Version 4.22
Exim ≫ Exim Version 4.23
Exim ≫ Exim Version 4.24
Exim ≫ Exim Version 4.30
Exim ≫ Exim Version 4.31
Exim ≫ Exim Version 4.32
Exim ≫ Exim Version 4.33
Exim ≫ Exim Version 4.34
Exim ≫ Exim Version 4.40
Exim ≫ Exim Version 4.41
Exim ≫ Exim Version 4.42
Exim ≫ Exim Version 4.43
Exim ≫ Exim Version 4.44
Exim ≫ Exim Version 4.50
Exim ≫ Exim Version 4.51
Exim ≫ Exim Version 4.52
Exim ≫ Exim Version 4.53
Exim ≫ Exim Version 4.54
Exim ≫ Exim Version 4.60
Exim ≫ Exim Version 4.61
Exim ≫ Exim Version 4.62
Exim ≫ Exim Version 4.63
Exim ≫ Exim Version 4.64
Exim ≫ Exim Version 4.65
Exim ≫ Exim Version 4.66
Exim ≫ Exim Version 4.67
Exim ≫ Exim Version 4.68
Exim ≫ Exim Version 4.69
Exim ≫ Exim Version 4.70
Exim ≫ Exim Version 4.71
Exim ≫ Exim Version 4.72
Exim ≫ Exim Version 4.73
Exim ≫ Exim Version 4.74
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.94% 0.89
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624670
Patch
http://bugs.exim.org/show_bug.cgi?id=1106
Patch
http://git.exim.org/exim.git/commit/337e3505b0e6cd4309db6bf6062b33fa56e06cf8
Patch
http://secunia.com/advisories/51155
http://www.debian.org/security/2011/dsa-2232
https://bugzilla.redhat.com/show_bug.cgi?id=702474
Patch