University of Cambridge Exim 3.21

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:exim:exim:3.21:*:*:*:*:*:*:*

part: a version: 3.21 update: *

VendorExim (394124fe-277b-5eb8-afc3-b5c498937ef9)
ProductExim (6f9e18d0-ac4f-5006-8db5-7919fb601764)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/exim4 purl2cpe 2026-06-01 10:18:20.279332
pkg:deb/ubuntu/exim4 purl2cpe 2026-06-01 10:18:20.279333
pkg:exim/exim purl2cpe 2026-06-01 10:18:20.279334
pkg:github/exim/exim purl2cpe 2026-06-01 10:18:20.279336
pkg:rpm/fedora/exim purl2cpe 2026-06-01 10:18:20.279337
pkg:rpm/opensuse/exim purl2cpe 2026-06-01 10:18:20.279338

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2011-1764 vulnerable 2026-06-08 04:58:01.961668 Details available
Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
Published: 2011-10-05T01:00:00.000Z
Updated: 2024-08-06T22:37:25.837Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-0017 vulnerable 2026-06-08 04:56:33.385762 Details available
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
Published: 2011-02-02T00:00:00.000Z
Updated: 2024-08-06T21:36:02.265Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.