CVE-2020-28008

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution.

Affected products

Alt Linux, Astra Linux, Exim, Linuxmint, Suse, Ubuntu

Exim

< 4.94.2

Fix

Available

CVSS 3.1

7.8 HIGH

EPSS

0.4% (33th percentile)

Weakness

CWE-269

NVD status

Modified

Published

2021-05-06