Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <7b2e3fb3afc05aa39864e62b0c87a631b746f5c7.camel@runout.at>
Date: Fri, 29 Sep 2023 15:59:09 +0200
From: Markus Gschwendt <office+osssecurity@...out.at>
To: oss-security@...ts.openwall.com
Subject: Multiple Exim4 Zero Days

I bring this up as I have not yet seen any information here about
several CVEs related to Exim Mailserver which were published by ZDI on
2023-09-27 [1]:

* CVE-2023-42114 [CVSS 3.7]
* CVE-2023-42115 [CVSS 9.8]
* CVE-2023-42116 [CVSS 8.1]
* CVE-2023-42117 [CVSS 8.1]
* CVE-2023-42118 [CVSS 7.5]
* CVE-2023-42119 [CVSS 3.1]

There also seem to be issues in Exim's bug tracker related to those:
https://bugs.exim.org/show_bug.cgi?id=2999
https://bugs.exim.org/show_bug.cgi?id=3000
https://bugs.exim.org/show_bug.cgi?id=3001
https://bugs.exim.org/show_bug.cgi?id=3002
https://bugs.exim.org/show_bug.cgi?id=3003

According to ZDI the original reports were sent in June 2022.

I'm wondering if somebody knows anything about mitigations and/or why
there are still no fixes for these issues after more than a year.

Markus

[1] https://www.zerodayinitiative.com/advisories/published/
    search for exim

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.