阿里云漏洞库

漏洞描述

A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://vuldb.com/?id.211919

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	exim	exim	2022-10-18	-
	运行在以下环境
	系统	debian_10	exim4	*		Up to (excluding) 4.92-8+deb10u9
	运行在以下环境
	系统	debian_11	exim4	*		Up to (excluding) 4.94.2-7+deb11u2
	运行在以下环境
	系统	debian_12	exim4	*		Up to (excluding) 4.96-7
	运行在以下环境
	系统	fedora_35	exim	*		Up to (excluding) 4.96-5.fc35
	运行在以下环境
	系统	fedora_36	exim	*		Up to (excluding) 4.96-5.fc36
	运行在以下环境
	系统	fedora_37	exim	*		Up to (excluding) 4.96-5.fc37
	运行在以下环境
	系统	fedora_EPEL_7	exim	*		Up to (excluding) 4.96-4.el7
	运行在以下环境
	系统	fedora_EPEL_8	exim	*		Up to (excluding) 4.96-4.el8
	运行在以下环境
	系统	fedora_EPEL_9	exim	*		Up to (excluding) 4.96-4.el9

攻击路径

本地
攻击复杂度

容易
权限要求

无需权限
影响范围

全局影响
EXP成熟度

未验证
补丁情况

官方补丁
数据保密性

数据泄露
数据完整性

无影响
服务器危害

无影响
全网数量

N/A

CWE-ID	漏洞类型
CWE-119	内存缓冲区边界内操作的限制不恰当
CWE-416	释放后使用

中危 exim exim 内存缓冲区边界内操作的限制不恰当

漏洞描述

解决建议

参考链接

受影响软件情况