Known exploited vulnerabilities
Exim vulnerabilities attackers have used
Every Exim vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 5 Exim vulnerabilities as exploited in the wild, 0 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2010-4345, added Mar 25, 2022. Exim has the most entries (3).
- In KEV, all time
- 5
- Added, last 12 months
- 0
- Used in ransomware
- 1
- New CVEs this week
- 0
By product
Exim (3), Exim Internet Mailer (1), Mail Transfer Agent (MTA) (1).
Every Exim entry in CISA KEV
CVE-2010-4345
Added · dueExim Privilege Escalation Vulnerability
Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.
CVE-2010-4344
Added · dueExim Heap-Based Buffer Overflow Vulnerability
Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.
CVE-2019-16928
Added · dueExim Out-of-bounds Write Vulnerability
Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.
CVE-2019-10149
Added · dueExim Mail Transfer Agent (MTA) Improper Input Validation
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Exim Buffer Overflow Vulnerability
Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.