[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <7b2e3fb3afc05aa39864e62b0c87a631b746f5c7.camel@runout.at>
Date: Fri, 29 Sep 2023 15:59:09 +0200
From: Markus Gschwendt <office+osssecurity@...out.at>
To: oss-security@...ts.openwall.com
Subject: Multiple Exim4 Zero Days
I bring this up as I have not yet seen any information here about
several CVEs related to Exim Mailserver which were published by ZDI on
2023-09-27 [1]:
* CVE-2023-42114 [CVSS 3.7]
* CVE-2023-42115 [CVSS 9.8]
* CVE-2023-42116 [CVSS 8.1]
* CVE-2023-42117 [CVSS 8.1]
* CVE-2023-42118 [CVSS 7.5]
* CVE-2023-42119 [CVSS 3.1]
There also seem to be issues in Exim's bug tracker related to those:
https://bugs.exim.org/show_bug.cgi?id=2999
https://bugs.exim.org/show_bug.cgi?id=3000
https://bugs.exim.org/show_bug.cgi?id=3001
https://bugs.exim.org/show_bug.cgi?id=3002
https://bugs.exim.org/show_bug.cgi?id=3003
According to ZDI the original reports were sent in June 2022.
I'm wondering if somebody knows anything about mitigations and/or why
there are still no fixes for these issues after more than a year.
Markus
[1] https://www.zerodayinitiative.com/advisories/published/
search for exim
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
