University of Cambridge Exim 3.31

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:exim:exim:3.31:*:*:*:*:*:*:*

part: a version: 3.31 update: *

VendorExim (394124fe-277b-5eb8-afc3-b5c498937ef9)
ProductExim (6f9e18d0-ac4f-5006-8db5-7919fb601764)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/exim4 purl2cpe 2026-06-01 10:18:20.279356
pkg:deb/ubuntu/exim4 purl2cpe 2026-06-01 10:18:20.279357
pkg:exim/exim purl2cpe 2026-06-01 10:18:20.279358
pkg:github/exim/exim purl2cpe 2026-06-01 10:18:20.279360
pkg:rpm/fedora/exim purl2cpe 2026-06-01 10:18:20.279361
pkg:rpm/opensuse/exim purl2cpe 2026-06-01 10:18:20.279362

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2011-1764 vulnerable 2026-06-08 04:58:01.963405 Details available
Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
Published: 2011-10-05T01:00:00.000Z
Updated: 2024-08-06T22:37:25.837Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-0017 vulnerable 2026-06-08 04:56:33.387373 Details available
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
Published: 2011-02-02T00:00:00.000Z
Updated: 2024-08-06T21:36:02.265Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.