Upstream information

CVE-2010-4344 at MITRE

Description

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 9.3
Vector AV:N/AC:M/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
SUSE Bugzilla entry: 658731 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE 11.1
  • exim-debuginfo >= 4.69-70.15.1
  • exim-debugsource >= 4.69-70.15.1
openSUSE 11.1
  • exim >= 4.69-70.15.1
  • eximon >= 4.69-70.15.1
  • eximstats-html >= 4.69-70.15.1
openSUSE 11.2
  • exim-debuginfo >= 4.69-72.6.1
  • exim-debugsource >= 4.69-72.6.1
  • eximon-debuginfo >= 4.69-72.6.1
openSUSE 11.2
  • exim >= 4.69-72.6.1
  • eximon >= 4.69-72.6.1
  • eximstats-html >= 4.69-72.6.1
openSUSE 11.3
  • exim-debuginfo >= 4.71-4.3.1
  • exim-debugsource >= 4.71-4.3.1
  • eximon-debuginfo >= 4.71-4.3.1
openSUSE 11.3
  • exim >= 4.71-4.3.1
  • eximon >= 4.71-4.3.1
  • eximstats-html >= 4.71-4.3.1
openSUSE Tumbleweed
  • exim >= 4.86.2-2.2
  • eximon >= 4.86.2-2.2
  • eximstats-html >= 4.86.2-2.2
Patchnames:
openSUSE Tumbleweed GA exim