oss-sec mailing list archives
Exim4 MTA CVEs assigned from ZDI
From: Heiko Schlittermann <hs () nodmarc schlittermann de>
Date: Fri, 29 Sep 2023 18:06:11 +0200
Hello Exim users, the ZDI assigned multiple CVEs to the Exim-MTA and published them recently: CVE Link Exim-Bug --------------+---------------------------------------------------------+----- CVE-2023-42114 https://www.zerodayinitiative.com/advisories/ZDI-23-1468/ 3001 fixed CVE-2023-42115 https://www.zerodayinitiative.com/advisories/ZDI-23-1469/ 2999 fixed CVE-2023-42116 https://www.zerodayinitiative.com/advisories/ZDI-23-1470/ 3000 fixed CVE-2023-42117 https://www.zerodayinitiative.com/advisories/ZDI-23-1471/ CVE-2023-42118 https://www.zerodayinitiative.com/advisories/ZDI-23-1472/ CVE-2023-42119 https://www.zerodayinitiative.com/advisories/ZDI-23-1473/ The ZDI contacted us in June 2022. We asked about details but didn't get answers we were able to work with. Next contact with ZDI was in May 2023. Right after this contact we created project bug tracker for 3 of the 6 issues. 2 high scored of them are fixed (OOB access). A minor scored (info leak) is fixed too. Fixes are available in a protected repository and are ready to be applied by the distribution maintainers. The remaining issues are debatable or miss information we need to fix them. We're more than happy to provide fixes for all issues as soon as we receive detailed information. Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Attachment:
signature.asc
Description:
Current thread:
- Multiple Exim4 Zero Days Markus Gschwendt (Sep 29)
- Re: Multiple Exim4 Zero Days Alex Gaynor (Sep 29)
- Exim4 MTA CVEs assigned from ZDI Heiko Schlittermann (Sep 29)
- Re: Exim4 MTA CVEs assigned from ZDI Solar Designer (Sep 29)
- RE: Exim4 MTA CVEs assigned from ZDI zdi () trendmicro com (Sep 29)
- Re: Exim4 MTA CVEs assigned from ZDI Solar Designer (Sep 29)