CVE-2010-4344

2010-12-1000:00:00

ubuntu.com

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.931 High

EPSS

Percentile

99.1%

JSON

Heap-based buffer overflow in the string_vformat function in string.c in
Exim before 4.70 allows remote attackers to execute arbitrary code via an
SMTP session that includes two MAIL commands in conjunction with a large
message containing crafted headers, leading to improper rejection logging.

Bugs

Notes

Author	Note
mdeslaur	fixed in 4.70
jdstrand	while the bug was fixed in 2008, it was not known to be a security bug. Public exploit made available on 2010-12-10 (UTC)

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchexim4< 4.60-3ubuntu3.2UNKNOWN
ubuntu8.04noarchexim4< 4.69-2ubuntu0.2UNKNOWN
ubuntu9.10noarchexim4< 4.69-11ubuntu4.1UNKNOWN