CVE Vulnerability Advisory Database

[Affected Scope] Exim mail server versions 4.92 through 4.92.2

[Impact] Unauthenticated remote attackers can trigger a heap-based buffer overflow by sending a crafted, long EHLO command, leading to arbitrary code execution or complete denial of service (DoS)

[Mitigation] Immediately upgrade Exim to the latest stable version (4.92.3 or higher) and restrict SMTP command lengths as a temporary workaround

[Affected Scope] Exim mail server versions 4.87 to 4.91 inclusive

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted recipient addresses

[Mitigation] Immediately upgrade Exim packages to a patched version (4.92 or higher) and apply temporary configuration workarounds

[Affected Scope] Mail server environments running Exim version 4.72 and earlier

[Impact] Local attackers or compromised 'exim' service accounts can execute arbitrary system commands with root privileges by specifying a malicious alternate configuration file, leading to full system compromise

[Mitigation] Immediately upgrade Exim to a secure version (4.73 or later) and restrict execution permissions on the Exim binary

[Affected Scope] Exim Mail Transfer Agent (MTA) versions prior to 4.70

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges and fully compromise the mail server via a crafted SMTP session.

[Mitigation] Immediately upgrade Exim to the latest stable version (4.70 or higher) and restrict SMTP port access to trusted networks until patched.