Description
Heap-based buffer overflow in smtp_in.c for Exim 3 (exim3) before 3.36 and Exim 4 (exim4) before 4.21 may allow remote attackers to execute arbitrary code via an invalid (1) HELO or (2) EHLO argument with a large number of spaces followed by a NULL character and a newline, which is not properly trimmed before the "(no argument given)" string is appended to the buffer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-376 exim - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-376 vendor-advisory
- CLA-2003:735 vendor-advisory
- [Exim] 20030814 Minor security bug mailing-list
- http://www.exim.org/pipermail/exim-announce/2003q3/000094.html
- 20030901 exim remote heap overflow, probably not exploitable mailing-list
- 20030903 Re: exim remote heap overflow, probably not exploitable mailing-list
- [Exim] 20030815 Minor security bug mailing-list
- http://packages.debian.org/changelogs/pool/main/e/exim/exim_3.36-13/changelog
- http://packages.debian.org/changelogs/pool/main/e/exim4/exim4_4.34-10/changelog