Multiple vulnerabilities have been found in Exim, the worst of which allows remote attackers to execute arbitrary code.
Package | mail-mta/exim on all architectures |
---|---|
Affected versions | < 4.94.2 |
Unaffected versions | >= 4.94.2 |
Exim is a message transfer agent (MTA) designed to be a a highly configurable, drop-in replacement for sendmail.
Multiple vulnerabilities have been discovered in Exim. Please review the CVE identifiers referenced below for details.
A remote attacker, by connecting to the SMTP listener daemon, could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Furthermore, a local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running the application or escalate privileges.
There is no known workaround at this time.
All Exim users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/exim-4.94.2"
Release date
May 04, 2021
Latest revision
May 04, 2021: 1
Severity
high
Exploitable
local, remote
Bugzilla entries