GCVE - cpe:2.3:a:exim:exim:4.11:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:exim:exim:4.11:*:*:*:*:*:*:*

part: a version: 4.11 update: *

Vendor	Exim (`394124fe-277b-5eb8-afc3-b5c498937ef9`)
Product	Exim (`6f9e18d0-ac4f-5006-8db5-7919fb601764`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/exim4`	purl2cpe	2026-06-01 10:18:20.279470
`pkg:deb/ubuntu/exim4`	purl2cpe	2026-06-01 10:18:20.279471
`pkg:exim/exim`	purl2cpe	2026-06-01 10:18:20.279473
`pkg:github/exim/exim`	purl2cpe	2026-06-01 10:18:20.279474
`pkg:rpm/fedora/exim`	purl2cpe	2026-06-01 10:18:20.279476
`pkg:rpm/opensuse/exim`	purl2cpe	2026-06-01 10:18:20.279477

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-2972`	vulnerable	2026-06-08 05:05:30.571897	Details available expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value. Published: 2014-09-04T17:00:00.000Z Updated: 2024-08-06T10:28:46.371Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136264.html http://git.exim.org/exim.git/commitdiff/7685ce68148a083d7759e78d01aa5198fc099c44 http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136251.html https://lists.exim.org/lurker/message/20140722.145949.42c043f5.en.html https://lists.exim.org/lurker/message/20140722.152452.d6c019e8.en.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2957`	vulnerable	2026-06-08 05:05:30.519954	Details available The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function. Published: 2014-09-04T17:00:00.000Z Updated: 2024-08-06T10:28:46.230Z Open on db.gcve.eu Reference links https://lists.exim.org/lurker/message/20140528.122536.a31d60a4.en.html http://git.exim.org/exim.git/commitdiff/5b7a7c051c9ab9ee7c924a611f90ef2be03e0ad0 http://www.openwall.com/lists/oss-security/2021/05/04/7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1764`	vulnerable	2026-06-08 04:58:01.970960	Details available Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character. Published: 2011-10-05T01:00:00.000Z Updated: 2024-08-06T22:37:25.837Z Open on db.gcve.eu Reference links http://secunia.com/advisories/51155 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://www.debian.org/security/2011/dsa-2232 http://git.exim.org/exim.git/commit/337e3505b0e6cd4309db6bf6062b33fa56e06cf8 https://bugzilla.redhat.com/show_bug.cgi?id=702474	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0017`	vulnerable	2026-06-08 04:56:33.394207	Details available The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack. Published: 2011-02-02T00:00:00.000Z Updated: 2024-08-06T21:36:02.265Z Open on db.gcve.eu Reference links http://secunia.com/advisories/43128 http://osvdb.org/70696 ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74 http://www.vupen.com/english/advisories/2011/0364 http://www.securityfocus.com/bid/46065	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.