Upstream information
Description
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
National Vulnerability Database | |
---|---|
Base Score | 6.9 |
Vector | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Access Vector | Local |
Access Complexity | Medium |
Authentication | None |
Confidentiality Impact | Complete |
Integrity Impact | Complete |
Availability Impact | Complete |
SUSE Security Advisories:
- SUSE-SA:2010:059, published Mon, 13 Dec 2010 09:00:00 +0000
- openSUSE-SU-2010:1052-1, published Mon, 13 Dec 2010 12:08:12 +0100 (CET)
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
openSUSE Tumbleweed |
| Patchnames: openSUSE Tumbleweed GA exim-4.86.2-2.2 |
SUSE Timeline for this CVE
CVE page created: Fri Jun 28 07:42:36 2013CVE page last modified: Mon Feb 13 11:31:24 2023