onyx --cves cve-2017-16943
CVE-2017-16943
- score
- <0.1
- cvss
- 9.8
- epss
- 47.1%
- published
- 2017-11-25
- kev added
- —
- first seen
Exim 4.88 and 4.89 contain a use-after-free vulnerability in the receive_msg function in receive.c of the SMTP daemon, allowing remote attackers to execute arbitrary code or cause a denial of service via BDAT command vectors.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944
Exploit availability
Weaknesses
References 11
- https://git.exim.org/exim.git/commitdiff/4e6ae6235c68de243b1c2419027472d7659aa2b4
- http://openwall.com/lists/oss-security/2017/11/25/1
- http://openwall.com/lists/oss-security/2017/11/25/2
- https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html
- https://bugs.exim.org/show_bug.cgi?id=2199
- https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944
- http://openwall.com/lists/oss-security/2017/11/25/3
- http://www.securitytracker.com/id/1039872
- https://www.debian.org/security/2017/dsa-4053
- http://www.openwall.com/lists/oss-security/2021/05/04/7
- https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde