[ASA-201802-6] exim: arbitrary code execution
Jelle van der Waa
jelle at archlinux.org
Tue Feb 13 20:38:03 UTC 2018
Arch Linux Security Advisory ASA-201802-6
Date : 2018-02-12
CVE-ID : CVE-2018-6789
Package : exim
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-608
The package exim before version 4.90.1-1 is vulnerable to arbitrary
Upgrade to 4.90.1-1.
# pacman -Syu "exim>=4.90.1-1"
The problem has been fixed upstream in version 4.90.1.
An issue was discovered in the base64d function in the SMTP listener in
Exim before 4.90.1. By sending a handcrafted message, a buffer overflow
may happen. This can be used to execute code remotely.
A remote attacker is able to execute arbitrary code on the affected
host by sending a crafted message.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 488 bytes
Desc: not available
More information about the arch-security