Skip to content
OpenAdvisories
Critical USN-6411-1 3 CVEs

exim4 vulnerabilities

Published Oct 4, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Exim incorrectly handled certain challenge requests.
A remote attacker could possibly use this issue to perform out-of-bounds
reads, resulting in information leakage. (CVE-2023-42114)

It was discovered that Exim incorrectly handled validation of user-supplied
data. A remote attacker could possibly use this issue to perform
out-of-bounds writes, resulting in arbitrary code execution. This issue
only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.04.
(CVE-2023-42115)

It was discovered that Exim incorrectly handled certain challenge requests.
A remote attacker could possibly use this issue to perform out-of-bounds
writes, resulting in arbitrary code execution. (CVE-2023-42116)

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS exim4 4.93-13ubuntu1.8
Ubuntu · 22.04 LTS 22.04:LTS exim4 4.95-4ubuntu2.3
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS exim4 4.82-3ubuntu2.4+esm6
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS exim4 4.86.2-2ubuntu2.6+esm4
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS exim4 4.90.1-1ubuntu1.10+esm1

Vulnerabilities 3

  • Critical 9.8
    CVE-2023-42115 Public exploit EPSS 12%

    Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability

    Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists w…

    Exim Exim exim4 exim4 Debian Ubuntu Alpine Wolfi
  • High 8.1
    CVE-2023-42116

    Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability

    Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The spec…

    Exim Exim exim4 exim4 Debian Ubuntu Alpine Wolfi
  • Low 3.7
    CVE-2023-42114 EPSS 27%

    Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability

    Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The spec…

    Exim Exim exim4 exim4 Debian Ubuntu Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2023-42114
  • report
    https://ubuntu.com/security/CVE-2023-42115
  • report
    https://ubuntu.com/security/CVE-2023-42116