Am 04.05.21 um 15:40 schrieb Heiko Schlittermann via Exim-users:
> Local vulnerabilities
> - CVE-2020-28007: Link attack in Exim's log directory
> - CVE-2020-28008: Assorted attacks in Exim's spool directory
> - CVE-2020-28014: Arbitrary PID file creation
> - CVE-2020-28011: Heap buffer overflow in queue_run()
> - CVE-2020-28010: Heap out-of-bounds write in main()
> - CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
> - CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
> - CVE-2020-28015: New-line injection into spool header file (local)
> - CVE-2020-28012: Missing close-on-exec flag for privileged pipe
> - CVE-2020-28009: Integer overflow in get_stdinput()
> Remote vulnerabilities
> - CVE-2020-28017: Integer overflow in receive_add_recipient()
> - CVE-2020-28020: Integer overflow in receive_msg()
> - CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
> - CVE-2020-28021: New-line injection into spool header file (remote)
> - CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
> - CVE-2020-28026: Line truncation and injection in spool_read_header()
> - CVE-2020-28019: Failure to reset function pointer after BDAT error
> - CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
> - CVE-2020-28018: Use-after-free in tls-openssl.c
> - CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
„These vulnerabilities were reported by Qualys via security@???
back in October 2020.”
Please don't take this the wrong way - but I have to ask: is the Exim
project in a viable state? Seven Months for bugs like this are a very
long time.
