GCVE - cpe:2.3:a:exim:exim:4.65:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:exim:exim:4.65:*:*:*:*:*:*:*

part: a version: 4.65 update: *

Vendor	Exim (`394124fe-277b-5eb8-afc3-b5c498937ef9`)
Product	Exim (`6f9e18d0-ac4f-5006-8db5-7919fb601764`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/exim4`	purl2cpe	2026-06-01 10:18:20.279716
`pkg:deb/ubuntu/exim4`	purl2cpe	2026-06-01 10:18:20.279718
`pkg:exim/exim`	purl2cpe	2026-06-01 10:18:20.279720
`pkg:github/exim/exim`	purl2cpe	2026-06-01 10:18:20.279721
`pkg:rpm/fedora/exim`	purl2cpe	2026-06-01 10:18:20.279723
`pkg:rpm/opensuse/exim`	purl2cpe	2026-06-01 10:18:20.279724

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-2972`	vulnerable	2026-06-08 05:05:30.572472	Details available expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value. Published: 2014-09-04T17:00:00.000Z Updated: 2024-08-06T10:28:46.371Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136264.html http://git.exim.org/exim.git/commitdiff/7685ce68148a083d7759e78d01aa5198fc099c44 http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136251.html https://lists.exim.org/lurker/message/20140722.145949.42c043f5.en.html https://lists.exim.org/lurker/message/20140722.152452.d6c019e8.en.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2957`	vulnerable	2026-06-08 05:05:30.534348	Details available The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function. Published: 2014-09-04T17:00:00.000Z Updated: 2024-08-06T10:28:46.230Z Open on db.gcve.eu Reference links https://lists.exim.org/lurker/message/20140528.122536.a31d60a4.en.html http://git.exim.org/exim.git/commitdiff/5b7a7c051c9ab9ee7c924a611f90ef2be03e0ad0 http://www.openwall.com/lists/oss-security/2021/05/04/7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1764`	vulnerable	2026-06-08 04:58:01.986024	Details available Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character. Published: 2011-10-05T01:00:00.000Z Updated: 2024-08-06T22:37:25.837Z Open on db.gcve.eu Reference links http://secunia.com/advisories/51155 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://www.debian.org/security/2011/dsa-2232 http://git.exim.org/exim.git/commit/337e3505b0e6cd4309db6bf6062b33fa56e06cf8 https://bugzilla.redhat.com/show_bug.cgi?id=702474	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0017`	vulnerable	2026-06-08 04:56:33.409303	Details available The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack. Published: 2011-02-02T00:00:00.000Z Updated: 2024-08-06T21:36:02.265Z Open on db.gcve.eu Reference links http://secunia.com/advisories/43128 http://osvdb.org/70696 ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74 http://www.vupen.com/english/advisories/2011/0364 http://www.securityfocus.com/bid/46065	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-2024`	vulnerable	2026-06-08 04:54:11.299590	Details available transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/. Published: 2010-06-07T14:00:00.000Z Updated: 2024-08-07T02:17:14.464Z Open on db.gcve.eu Reference links http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0079.html https://bugzilla.redhat.com/show_bug.cgi?id=600097 http://www.vupen.com/english/advisories/2010/1402 http://www.securityfocus.com/bid/40454 http://www.vupen.com/english/advisories/2011/0364	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-2023`	vulnerable	2026-06-08 04:54:11.295566	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.