Vulnerabilities > Exim
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-05-06 | CVE-2020-28011 | Out-of-bounds Write vulnerability in Exim Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. | 7.8 |
| 2021-05-06 | CVE-2020-28012 | Unspecified vulnerability in Exim Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag. | 7.8 |
| 2021-05-06 | CVE-2020-28013 | Out-of-bounds Write vulnerability in Exim Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. | 7.8 |
| 2021-05-06 | CVE-2020-28014 | Improper Privilege Management vulnerability in Exim Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. | 6.1 |
| 2021-05-06 | CVE-2020-28015 | Unspecified vulnerability in Exim Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. | 7.8 |
| 2021-05-06 | CVE-2020-28016 | Out-of-bounds Write vulnerability in Exim Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase. | 7.8 |
| 2021-05-06 | CVE-2020-28017 | Integer Overflow or Wraparound vulnerability in Exim Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. | 9.8 |
| 2021-05-06 | CVE-2020-28018 | Use After Free vulnerability in Exim Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL. | 9.8 |
| 2021-05-06 | CVE-2020-28019 | Improper Initialization vulnerability in Exim Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. | 7.5 |
| 2021-05-06 | CVE-2020-28020 | Integer Overflow or Wraparound vulnerability in Exim Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction. | 9.8 |