Exim: Multiple vulnerabilities — GLSA 202105-01

Multiple vulnerabilities have been found in Exim, the worst of which allows remote attackers to execute arbitrary code.

Affected packages

mail-mta/exim on all architectures
Affected versions < 4.94.2
Unaffected versions >= 4.94.2

Background

Exim is a message transfer agent (MTA) designed to be a a highly configurable, drop-in replacement for sendmail.

Description

Multiple vulnerabilities have been discovered in Exim. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker, by connecting to the SMTP listener daemon, could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Furthermore, a local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running the application or escalate privileges.

Workaround

There is no known workaround at this time.

Resolution

All Exim users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=mail-mta/exim-4.94.2"
 

References

Release date
May 04, 2021

Latest revision
May 04, 2021: 1

Severity
high

Exploitable
local, remote

Bugzilla entries