Improper input validation in Exim
CVE-2014-2957
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.053 (91.7th percentile) — read the EPSS interpretation.
Affected products
- Exim — versions 4.00, 4.01, 4.02
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (Vendor Advisory, mailing-list, x_refsource_MLIST, Patch)
- cret@cert.org (x_refsource_CONFIRM)
- cret@cert.org (mailing-list, x_refsource_MLIST)