7.5

CVE-2011-1764

Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exim ≫ Exim Version <= 4.75
Exim ≫ Exim Version2.10
Exim ≫ Exim Version2.11
Exim ≫ Exim Version2.12
Exim ≫ Exim Version3.00
Exim ≫ Exim Version3.01
Exim ≫ Exim Version3.02
Exim ≫ Exim Version3.03
Exim ≫ Exim Version3.10
Exim ≫ Exim Version3.11
Exim ≫ Exim Version3.12
Exim ≫ Exim Version3.13
Exim ≫ Exim Version3.14
Exim ≫ Exim Version3.15
Exim ≫ Exim Version3.16
Exim ≫ Exim Version3.20
Exim ≫ Exim Version3.21
Exim ≫ Exim Version3.22
Exim ≫ Exim Version3.30
Exim ≫ Exim Version3.31
Exim ≫ Exim Version3.32
Exim ≫ Exim Version3.33
Exim ≫ Exim Version3.34
Exim ≫ Exim Version3.35
Exim ≫ Exim Version3.36
Exim ≫ Exim Version4.00
Exim ≫ Exim Version4.01
Exim ≫ Exim Version4.02
Exim ≫ Exim Version4.03
Exim ≫ Exim Version4.04
Exim ≫ Exim Version4.05
Exim ≫ Exim Version4.10
Exim ≫ Exim Version4.11
Exim ≫ Exim Version4.12
Exim ≫ Exim Version4.14
Exim ≫ Exim Version4.20
Exim ≫ Exim Version4.21
Exim ≫ Exim Version4.22
Exim ≫ Exim Version4.23
Exim ≫ Exim Version4.24
Exim ≫ Exim Version4.30
Exim ≫ Exim Version4.31
Exim ≫ Exim Version4.32
Exim ≫ Exim Version4.33
Exim ≫ Exim Version4.34
Exim ≫ Exim Version4.40
Exim ≫ Exim Version4.41
Exim ≫ Exim Version4.42
Exim ≫ Exim Version4.43
Exim ≫ Exim Version4.44
Exim ≫ Exim Version4.50
Exim ≫ Exim Version4.51
Exim ≫ Exim Version4.52
Exim ≫ Exim Version4.53
Exim ≫ Exim Version4.54
Exim ≫ Exim Version4.60
Exim ≫ Exim Version4.61
Exim ≫ Exim Version4.62
Exim ≫ Exim Version4.63
Exim ≫ Exim Version4.64
Exim ≫ Exim Version4.65
Exim ≫ Exim Version4.66
Exim ≫ Exim Version4.67
Exim ≫ Exim Version4.68
Exim ≫ Exim Version4.69
Exim ≫ Exim Version4.70
Exim ≫ Exim Version4.71
Exim ≫ Exim Version4.72
Exim ≫ Exim Version4.73
Exim ≫ Exim Version4.74
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.94% 0.89
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624670
Patch
http://bugs.exim.org/show_bug.cgi?id=1106
Patch
http://git.exim.org/exim.git/commit/337e3505b0e6cd4309db6bf6062b33fa56e06cf8
Patch
http://secunia.com/advisories/51155
http://www.debian.org/security/2011/dsa-2232
https://bugzilla.redhat.com/show_bug.cgi?id=702474
Patch