CVE-2017-16944
High · 7.5CVSS
7.5
EPSS
63.4%
Published
Nov 25, 2017
CISA due date
—
The record
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | exim4 | 0 | 4.89-13 |
| Debian:12 | exim4 | 0 | 4.89-13 |
| Debian:13 | exim4 | 0 | 4.89-13 |
| Debian:9 | exim4 | 0 | 4.89-2+deb9u2 |
| SUSE:Package Hub 15 SP1 | exim | 0 | 4.94.2-bp151.2.4.1 |
| SUSE:Package Hub 15 SP1 | libspf2 | 0 | 1.2.10-bp151.4.1 |
| SUSE:Package Hub 15 SP2 | exim | 0 | 4.94.2-bp152.6.4.1 |
| SUSE:Package Hub 15 SP2 | libspf2 | 0 | 1.2.10-bp152.5.1 |
| Ubuntu:14.04:LTS | exim4 | 0 | 4.82-3ubuntu2.3 |
| Ubuntu:16.04:LTS | exim4 | 0 | 4.86.2-2ubuntu2.2 |
| openSUSE:Leap 15.2 | exim | 0 | 4.94.2-lp152.8.3.1 |
| openSUSE:Tumbleweed | exim | 0 | 4.94.2-4.2 |
Related vulnerabilities
- CVE-2023-42115 Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. Also affects exim4
- CVE-2023-42117 Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. Also affects exim4
- CVE-2023-42116 Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. Also affects exim4
- CVE-2023-42119 Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. Also affects exim4
- CVE-2023-42114 Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. Also affects exim4
- CVE-2022-3559 A vulnerability was found in Exim and classified as problematic. Also affects exim4
- CVE-2017-16943 The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows… Also affects exim4
- CVE-2017-1000369 Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and… Also affects exim4