4

CVE-2017-1000369

Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exim ≫ Exim Version <= 4.87.1
Exim ≫ Exim Version4.88 Update-
Exim ≫ Exim Version4.88 Updaterc1
Exim ≫ Exim Version4.88 Updaterc2
Exim ≫ Exim Version4.88 Updaterc3
Exim ≫ Exim Version4.88 Updaterc4
Exim ≫ Exim Version4.88 Updaterc5
Exim ≫ Exim Version4.88 Updaterc6
Exim ≫ Exim Version4.89 Update-
Exim ≫ Exim Version4.89 Updaterc1
Exim ≫ Exim Version4.89 Updaterc2
Exim ≫ Exim Version4.89 Updaterc3
Exim ≫ Exim Version4.89 Updaterc4
Exim ≫ Exim Version4.89 Updaterc5
Exim ≫ Exim Version4.89 Updaterc6
Exim ≫ Exim Version4.89 Updaterc7
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.518
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4 2.5 1.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:N/I:P/A:N
CWE-404 Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

http://www.securityfocus.com/bid/99252
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038779
Third Party Advisory
VDB Entry