CVE-2014-2957
published 2014-09-04CVE-2014-2957: The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From…
PriorityP344medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
5.26%
91.5th percentile
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | exim4 | < exim4 4.82.1-1 (bookworm) | exim4 4.82.1-1 (bookworm) |
| exim | exim | <= 4.82 | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
| exim | exim | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8LOW
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r2xw-4p4f-wp3m: The dmarc_process function in dmarc
ghsa_unreviewed·2022-05-13
CVE-2014-2957 [MEDIUM] CWE-20 GHSA-r2xw-4p4f-wp3m: The dmarc_process function in dmarc
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
OSV
CVE-2014-2957: The dmarc_process function in dmarc
osv·2014-09-04·CVSS 6.8
CVE-2014-2957 [MEDIUM] CVE-2014-2957: The dmarc_process function in dmarc
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
Red Hat
exim: remote arbitrary code execution via DMARC code parsing
vendor_redhat·2014-05-28·CVSS 6.8
CVE-2014-2957 [MEDIUM] exim: remote arbitrary code execution via DMARC code parsing
exim: remote arbitrary code execution via DMARC code parsing
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
Statement: Not vulnerable. This issue did not affect the versions of Exim as shipped with Red Hat Enterprise Linux 5 as they did not include the experimental DMARC support.
Package: exim (Red Hat Enterprise Linux 5) - Not affected
Debian
CVE-2014-2957: exim4 - The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_D...
vendor_debian·2014·CVSS 6.8
CVE-2014-2957 [MEDIUM] CVE-2014-2957: exim4 - The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_D...
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
Scope: local
bookworm: resolved (fixed in 4.82.1-1)
bullseye: resolved (fixed in 4.82.1-1)
forky: resolved (fixed in 4.82.1-1)
sid: resolved (fixed in 4.82.1-1)
trixie: resolved (fixed in 4.82.1-1)
No detection rules found.
No public exploits indexed.
http://git.exim.org/exim.git/commitdiff/5b7a7c051c9ab9ee7c924a611f90ef2be03e0ad0http://www.openwall.com/lists/oss-security/2021/05/04/7https://lists.exim.org/lurker/message/20140528.122536.a31d60a4.en.htmlhttp://git.exim.org/exim.git/commitdiff/5b7a7c051c9ab9ee7c924a611f90ef2be03e0ad0http://www.openwall.com/lists/oss-security/2021/05/04/7https://lists.exim.org/lurker/message/20140528.122536.a31d60a4.en.html
2014-09-04
Published