University of Cambridge Exim 3.16

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:exim:exim:3.16:*:*:*:*:*:*:*

part: a version: 3.16 update: *

VendorExim (394124fe-277b-5eb8-afc3-b5c498937ef9)
ProductExim (6f9e18d0-ac4f-5006-8db5-7919fb601764)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/exim4 purl2cpe 2026-06-01 10:18:20.279316
pkg:deb/ubuntu/exim4 purl2cpe 2026-06-01 10:18:20.279317
pkg:exim/exim purl2cpe 2026-06-01 10:18:20.279318
pkg:github/exim/exim purl2cpe 2026-06-01 10:18:20.279320
pkg:rpm/fedora/exim purl2cpe 2026-06-01 10:18:20.279321
pkg:rpm/opensuse/exim purl2cpe 2026-06-01 10:18:20.279322

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2011-1764 vulnerable 2026-06-08 04:58:01.960641 Details available
Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
Published: 2011-10-05T01:00:00.000Z
Updated: 2024-08-06T22:37:25.837Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-0017 vulnerable 2026-06-08 04:56:33.384591 Details available
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
Published: 2011-02-02T00:00:00.000Z
Updated: 2024-08-06T21:36:02.265Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.