Integer Overflow or Wraparound Affecting exim/exim package, versions [4.00,4.92)


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
2.91% (91st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-EXIMEXIM-2364595
  • published26 Jan 2022
  • disclosed6 May 2021
  • creditUnknown

Introduced: 6 May 2021

CVE-2020-28020  (opens in a new tab)
CWE-120  (opens in a new tab)
CWE-190  (opens in a new tab)

How to fix?

Upgrade exim/exim to version 4.92 or higher.

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.

CVSS Scores

version 3.1