CVE-2017-16943
Critical · 9.8CVSS
9.8
EPSS
47.1%
Published
Nov 25, 2017
CISA due date
—
The record
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | exim4 | 0 | 4.89-12 |
| Debian:12 | exim4 | 0 | 4.89-12 |
| Debian:13 | exim4 | 0 | 4.89-12 |
| Debian:9 | exim4 | 0 | 4.89-2+deb9u2 |
| SUSE:Package Hub 15 SP1 | exim | 0 | 4.94.2-bp151.2.4.1 |
| SUSE:Package Hub 15 SP1 | libspf2 | 0 | 1.2.10-bp151.4.1 |
| SUSE:Package Hub 15 SP2 | exim | 0 | 4.94.2-bp152.6.4.1 |
| SUSE:Package Hub 15 SP2 | libspf2 | 0 | 1.2.10-bp152.5.1 |
| Ubuntu:14.04:LTS | exim4 | 0 | 4.82-3ubuntu2.3 |
| Ubuntu:16.04:LTS | exim4 | 0 | 4.86.2-2ubuntu2.2 |
| openSUSE:Leap 15.2 | exim | 0 | 4.94.2-lp152.8.3.1 |
| openSUSE:Tumbleweed | exim | 0 | 4.94.2-4.2 |
Related vulnerabilities
- CVE-2023-42115 Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. Also affects exim4
- CVE-2023-42117 Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. Also affects exim4
- CVE-2023-42116 Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. Also affects exim4
- CVE-2023-42119 Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. Also affects exim4
- CVE-2023-42114 Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. Also affects exim4
- CVE-2022-3559 A vulnerability was found in Exim and classified as problematic. Also affects exim4
- CVE-2017-16944 The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows… Also affects exim4
- CVE-2017-1000369 Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and… Also affects exim4