Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Aug 2022 15:44:25 +0100
From: Graeme Fowler <>
Subject: Re: [Exim-Security] Exim < 4.95 heap overflow

On 7 Aug 2022, at 16:39, Roxana Bradescu via Security <> wrote:
> Adding the Exim security folks to this thread to shed some light on the original report and CVE discussion. 

Responding separately to each list...

The Exim developers don't use github to track bugs, there is a bugzilla instance used for that which is detailed on the Github Readme.pod page.

This issue (and others) weren't "silently fixed"; they were openly tracked in Bugzilla, and an example is here: (fixing the observed issue in this thread).

The pages detailing CVEs were regularly updated by a developer who is no longer involved. These have not been updated since 2019 as you observe, yet there have been 23 CVEs addressed by the developers. These are fairly easy to find using your favourite CVE tracker.

The development process - excepting times when a CVE has been allocated - is pretty open and easy to find, as all the commits are in the Git repo and bugzilla updates are mirrored into the exim-dev mailing list, often including the commit also.


(wearing my exim mailing list admin hat)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.