What is CVE-2011-1764?

CVE-2011-1764 is a vulnerability in Exim, classified under Use of Externally-Controlled Format String. Published 2011-10-05.

Is CVE-2011-1764 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Exim

CVE-2011-1764

Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.

EPSS: 0.039 (89.3th percentile) — read the EPSS interpretation.

Affected products

Exim — versions 2.10, 2.11, 2.12
N/a — versions n/a

Weakness classification (CWE)

CWE-134 — Use of Externally-Controlled Format String

Public proof-of-concept exploits

References

secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (x_refsource_CONFIRM, Patch)

Frequently asked questions

What is CVE-2011-1764?: CVE-2011-1764 is a vulnerability in Exim, classified under Use of Externally-Controlled Format String. Published 2011-10-05.
Is CVE-2011-1764 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.