Description
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | exim4 | 4.72-4 | — |
| Debian 13 | exim4 | 4.72-4 | — |
| Debian 12 | exim4 | 4.72-4 | — |
| Debian 5.0 | exim4 | 4.69-9+lenny3 | DSA-2154-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | exim | 4.86.2-2.2 | openSUSE-SU-2024:10017-1 |
Advisories 2
- DSA-2154-1 exim4 - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10017-1 exim-4.86.2-2.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 43128 third-party-advisory
- 70696 vdb-entry
- ADV-2011-0364 vdb-entry
- 46065 vdb-entry
- 43243 third-party-advisory
- exim-openlog-privilege-escalation(65028) vdb-entry
- [exim-announce] 20110125 Exim 4.74 Release mailing-list
- ADV-2011-0224 vdb-entry
- DSA-2154 vendor-advisory
- SUSE-SR:2011:004 vendor-advisory
- ADV-2011-0464 vdb-entry
- 43101 third-party-advisory
- ADV-2011-0245 vdb-entry
- USN-1060-1 vendor-advisory