Description
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | exim4 | 4.94.2-5 | — |
| Debian 13 | exim4 | 4.94.2-5 | — |
| Debian 12 | exim4 | 4.94.2-5 | — |
| Debian 10 | exim4 | 4.92-8+deb10u7 | DLA-3082-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | exim4 | 4.93-13ubuntu1.6 | USN-5574-1 |
| Ubuntu 18.04 LTS | exim4 | 4.90.1-1ubuntu1.9 | USN-5574-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | exim4 | 4.86.2-2ubuntu2.6+esm2 | USN-5574-1 |
| Ubuntu Pro 14.04 LTS | exim4 | 4.82-3ubuntu2.4+esm4 | USN-5574-1 |
Advisories 3
- USN-5574-1 exim4 vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- DLA-3082-1 exim4 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2022-0934 Exim: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jun 6, 2023
References
- https://github.com/Exim/exim/wiki/EximSecurity
- https://www.exim.org/static/doc/security/
- https://github.com/ivd38/exim_overflow
- https://www.openwall.com/lists/oss-security/2022/08/06/8
- https://github.com/Exim/exim/compare/exim-4.94...exim-4.95
- https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743
- [debian-lts-announce] 20220827 [SECURITY] [DLA 3082-1] exim4 security update mailing-list