CVE-2017-16943: Use After Free
The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-16943?
CVE-2017-16943 is a vulnerability in Exim 4.88 and 4.89 that allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
How severe is CVE-2017-16943?
CVE-2017-16943 has a severity value of 9.8, which is considered critical.
What software is affected by CVE-2017-16943?
Exim 4.88 and 4.89 are affected by CVE-2017-16943. Additionally, certain versions of Exim 4.92-8+deb10u6, 4.92-8+deb10u8, 4.94.2-7, 4.94.2-7+deb11u1, 4.96-15+deb12u1, 4.96-15+deb12u2, and 4.97~RC2-2 on Debian are also affected.
How can I fix CVE-2017-16943?
To fix CVE-2017-16943, you should update Exim to version 4.92-8+deb10u6, 4.92-8+deb10u8, 4.94.2-7, 4.94.2-7+deb11u1, 4.96-15+deb12u1, 4.96-15+deb12u2, or 4.97~RC2-2 on Debian. If you are using Exim 4.89, you should update to version 4.89-12, 4.90~RC3-1, or 4.89-2+deb9u2.
What is the Common Weakness Enumeration (CWE) for CVE-2017-16943?
The CWE for CVE-2017-16943 is CWE-416.