Vulnerability · Published Aug 7, 2022 · Assigned by mitre
CVE-2022-37452
Critical 9.8
In plain English
A critical-severity security flaw in the exim4 package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.8%top 10.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | exim4 | 4.94.2-5 | DEBIAN-CVE-2022-37452 |
| Debian:13 | exim4 | 4.94.2-5 | DEBIAN-CVE-2022-37452 |
| Debian:14 | exim4 | 4.94.2-5 | DEBIAN-CVE-2022-37452 |
Affected products (as reported)
References
- https://github.com/Exim/exim/wiki/EximSecurity x_refsource_MISC
- https://www.exim.org/static/doc/security/ x_refsource_MISC
- https://github.com/ivd38/exim_overflow x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2022/08/06/8 x_refsource_MISC
- https://github.com/Exim/exim/compare/exim-4.94...exim-4.95 x_refsource_MISC
- https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743 x_refsource_MISC
- [debian-lts-announce] 20220827 [SECURITY] [DLA 3082-1] exim4 security update mailing-list, x_refsource_MLIST