CVE-2020-28013 - Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root

Back Back to CVE browser

HIGH

Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root

Published May 6, 2021

7.8

HIGH

CVSS 3.1

EPSS 0.39%

Description

Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-20504
Advisory
https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28013-PFPSN.txt
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-20504		Advisory
https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28013-PFPSN.txt		x_refsource_MISCVendor Advisory