CVE-2017-1000369

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-1000369
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000369.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-1000369
Downstream
CLEANSTART (1)
DEBIAN (1)
openSUSE (4)
UBUNTU (1)
Related
openSUSE (4)
Published
2017-06-19T16:29:00Z
Modified
2026-10-20T13:14:02Z
Severity
  • 4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "8.0"
                        },
                        {
                            "last_affected":  "8.0"
                        },
                        {
                            "introduced":  "9.0"
                        },
                        {
                            "last_affected":  "9.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "debian:debian_linux"
        }
    ]
}
References

Affected packages

Git / github.com/exim/exim

Affected ranges

Type
GIT
Repo
https://github.com/exim/exim
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
98ed60088eaf8ffd8bfdcc27643a116191f16340
Introduced
57091745e6d5ce4259c645b3ac63838668d55b7f
Last Affected
f5e69651703fc6cd7645ea4b4ce00d030a3c311b
Fixed
65e061b76867a9ea7aeeb535341b790b90ae6c21
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "4.87.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.88:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.88-NA"
                },
                {
                    "last_affected":  "4.88-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.88:rc1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.88-rc1"
                },
                {
                    "last_affected":  "4.88-rc1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.88:rc2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.88-rc2"
                },
                {
                    "last_affected":  "4.88-rc2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.88:rc3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.88-rc3"
                },
                {
                    "last_affected":  "4.88-rc3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.88:rc4:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.88-rc4"
                },
                {
                    "last_affected":  "4.88-rc4"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.88:rc5:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.88-rc5"
                },
                {
                    "last_affected":  "4.88-rc5"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.88:rc6:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.88-rc6"
                },
                {
                    "last_affected":  "4.88-rc6"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.89:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.89-NA"
                },
                {
                    "last_affected":  "4.89-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.89:rc1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.89-rc1"
                },
                {
                    "last_affected":  "4.89-rc1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.89:rc2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.89-rc2"
                },
                {
                    "last_affected":  "4.89-rc2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.89:rc3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.89-rc3"
                },
                {
                    "last_affected":  "4.89-rc3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.89:rc4:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.89-rc4"
                },
                {
                    "last_affected":  "4.89-rc4"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.89:rc5:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.89-rc5"
                },
                {
                    "last_affected":  "4.89-rc5"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.89:rc6:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.89-rc6"
                },
                {
                    "last_affected":  "4.89-rc6"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:exim:exim:4.89:rc7:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.89-rc7"
                },
                {
                    "last_affected":  "4.89-rc7"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "65e061b76867a9ea7aeeb535341b790b90ae6c21"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

4.*
4.88-NA
4.88-rc1
4.88-rc2
4.88-rc3
4.88-rc4
4.88-rc5
4.88-rc6
4.89-NA
4.89-rc1
4.89-rc2
4.89-rc3
4.89-rc4
4.89-rc5
4.89-rc6
4.89-rc7
Other
DEVEL_PDKIM_START
exim-4_50
exim-4_51
exim-4_52
exim-4_53
exim-4_54
exim-4_61
exim-4_62
exim-4_63
exim-4_64
exim-4_65
exim-4_66
exim-4_67
exim-4_68
exim-4_69
exim-4_70
exim-4_70_RC3
exim-4_70_RC4
exim-4_71
exim-4_72
exim-4_72_RC1
exim-4_72_RC2
exim-4_73
exim-4_73_RC00
exim-4_73_RC1
exim-4_74
exim-4_74_RC1
exim-4_75
exim-4_75_RC1
exim-4_75_RC2
exim-4_75_RC3
exim-4_76
exim-4_76_RC1
exim-4_76_RC2
exim-4_77
exim-4_77_RC1
exim-4_77_RC2
exim-4_77_RC3
exim-4_77_RC4
exim-4_80
exim-4_80_RC1
exim-4_80_RC2
exim-4_80_RC3
exim-4_80_RC4
exim-4_80_RC5
exim-4_80_RC6
exim-4_80_RC7
exim-4_82
exim-4_82_RC1
exim-4_82_RC2
exim-4_82_RC3
exim-4_82_RC4
exim-4_82_RC5
exim-4_83
exim-4_83_RC1
exim-4_83_RC2
exim-4_83_RC3
exim-4_84
exim-4_84_RC1
exim-4_84_RC2
exim-4_85
exim-4_85_RC1
exim-4_85_RC2
exim-4_85_RC3
exim-4_85_RC4
exim-4_86
exim-4_86_RC1
exim-4_86_RC2
exim-4_86_RC3
exim-4_86_RC4
exim-4_86_RC5
exim-4_87
exim-4_87_1
exim-4_87_RC1
exim-4_87_RC2
exim-4_87_RC3
exim-4_87_RC4
exim-4_87_RC5
exim-4_87_RC6
exim-4_87_RC7
exim-4_88
exim-4_89_RC1
exim-4_89_RC3
exim-4_89_RC4
exim-4_89_RC5
exim-4_89_RC6
exim-4_89_RC7
exim-4.*
exim-4.90devstart

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000369.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "38488530320842470824616492725579972249",
                "79606996488806108233328364524732095279",
                "283894696414702954052563933938780906082",
                "108584226054236280939790936839653366672",
                "151384877497265530925305136925611819412",
                "335622212625325209041321625245009772535",
                "205292432811187591063234023478821436168",
                "118920449216836268319752180160249136072"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2017-1000369-2d4f42a9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21",
        "target":  {
            "file":  "src/src/exim.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211929463205635578468219543010107225043",
            "length":  67179
        },
        "id":  "CVE-2017-1000369-923df71b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21",
        "target":  {
            "file":  "src/src/exim.c",
            "function":  "main"
        }
    }
]
vanir_signatures_modified 
"2026-10-20T13:14:02Z"