onyx --cves cve-2017-16944
CVE-2017-16944
- score
- <0.1
- cvss
- 7.5
- epss
- 63.4%
- published
- 2017-11-25
- kev added
- —
- first seen
Exim 4.88 and 4.89 contain a denial of service caused by an infinite loop in receive_msg function due to improper check for '.' character in BDAT commands, letting remote attackers cause stack exhaustion, exploit requires sending specific BDAT commands.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC https://www.exploit-db.com/exploits/43184/
Exploit availability
Weaknesses
References 9
- http://openwall.com/lists/oss-security/2017/11/25/2
- http://openwall.com/lists/oss-security/2017/11/25/3
- http://www.securitytracker.com/id/1039873
- https://www.debian.org/security/2017/dsa-4053
- https://www.exploit-db.com/exploits/43184/
- https://bugs.exim.org/show_bug.cgi?id=2201
- http://openwall.com/lists/oss-security/2017/11/25/1
- https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html
- http://www.openwall.com/lists/oss-security/2021/05/04/7