Все бюллетени/sisyphus/ALT-PU-2023-7644-4
ALT-PU-2023-7644-4

Обновление пакета exim в ветке sisyphus

Версия4.97-alt1
Задание#335291
Опубликовано2026-02-04
Макс. серьёзностьCRITICAL
Серьёзность:

Закрытые проблемы (14)

BDU:2022-06645
HIGH7.5

Уязвимость компонента обработчика регулярных выражений Regex Handler почтового сервера Exim, связанная с использованием памяти после ее освобождения, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2022-11-07Изменено: 2025-10-24
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
Ссылки
BDU:2022-06693
CRITICAL9.8

Уязвимость реализации функции dmarc_dns_lookup (dmarc.c) обработчика DMARC почтового сервера Exim, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Опубликовано: 2022-11-09
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
Ссылки
BDU:2023-06268
CRITICAL9.8

Уязвимость cлужбы smtp почтового сервера Exim, позволяющая нарушителю выполнить произвольный код

Опубликовано: 2023-10-04Изменено: 2025-10-24
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
Ссылки
BDU:2023-06274
HIGH8.1

Уязвимость службы smtp почтового сервера Exim, позволяющая нарушителю выполнить произвольный код

Опубликовано: 2023-10-04Изменено: 2025-10-24
CVSS 3.xВЫСОКАЯ 8.1
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0ВЫСОКАЯ 7.6
CVSS:2.0/AV:N/AC:H/Au:N/C:C/I:C/A:C
Ссылки
BDU:2023-06276
LOW3.1

Уязвимость службы smtp почтового сервера Exim, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Опубликовано: 2023-10-04Изменено: 2026-01-20
CVSS 3.xНИЗКАЯ 3.1
CVSS:3.x/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0НИЗКАЯ 1.8
CVSS:2.0/AV:A/AC:H/Au:N/C:P/I:N/A:N
Ссылки
BDU:2023-06277
LOW3.7

Уязвимость реализации протокола NTLM (New Technology LAN Manager) почтового сервера Exim, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Опубликовано: 2023-10-04Изменено: 2026-01-20
CVSS 3.xНИЗКАЯ 3.7
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0НИЗКАЯ 2.6
CVSS:2.0/AV:N/AC:H/Au:N/C:P/I:N/A:N
Ссылки
BDU:2023-06278
HIGH8.1

Уязвимость реализации протокола SMTP почтового сервера Exim, позволяющая нарушителю выполнить произвольный код

Опубликовано: 2023-10-04Изменено: 2025-01-29
CVSS 3.xВЫСОКАЯ 8.1
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0ВЫСОКАЯ 7.6
CVSS:2.0/AV:N/AC:H/Au:N/C:C/I:C/A:C
Ссылки
CVE-2022-3559
HIGH7.5

A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation leads to use after free. The name of the patch is 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is recommended to apply a patch to fix this issue. The identifier VDB-211073 was assigned to this vulnerability.

Опубликовано: 2022-10-17Изменено: 2025-11-03
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2022-3620
CRITICAL9.8

A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919.

Опубликовано: 2022-10-20Изменено: 2025-05-23
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2023-42114
MEDIUM5.3

Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to disclose information in the context of the service account. . Was ZDI-CAN-17433.

Опубликовано: 2024-05-03Изменено: 2025-11-04
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2023-42115
CRITICAL9.8

Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17434.

Опубликовано: 2024-05-03Изменено: 2025-08-07
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2023-42116
CRITICAL9.8

Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17515.

Опубликовано: 2024-05-03Изменено: 2025-11-04
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2023-42117
CRITICAL9.8

Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17554.

Опубликовано: 2024-05-03Изменено: 2025-11-03
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2023-42119
LOW3.1

Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. . Was ZDI-CAN-17643.

Опубликовано: 2024-05-03Изменено: 2025-11-03
CVSS 3.xНИЗКАЯ 3.1
CVSS:3.x/CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Ссылки