Vulnerability in Exim
CVE-2014-2972
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.
EPSS: 0.005 (39.2th percentile) — read the EPSS interpretation.
Affected products
- Exim — versions 4.00, 4.01, 4.02
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (vendor-advisory, x_refsource_FEDORA)
- cret@cert.org (x_refsource_CONFIRM)
- cret@cert.org (vendor-advisory, x_refsource_FEDORA)
- cret@cert.org (Vendor Advisory, mailing-list, x_refsource_MLIST, Patch)
- cret@cert.org (Vendor Advisory, mailing-list, x_refsource_MLIST)
- cret@cert.org (vendor-advisory, x_refsource_GENTOO)
- cret@cert.org (x_refsource_UBUNTU, vendor-advisory)
- cret@cert.org (x_refsource_CONFIRM)