CVE-2020-28016: High severity Exim Exim vulnerability
Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parsefixphrase.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/eximto a version that resolves this vulnerability.Fixed in 4.94.2-r0 - Upgrade
Upgrade
Eximto a version that resolves this vulnerability.Fixed in 4.94.2
Event History
Frequently Asked Questions
What is CVE-2020-28016?
CVE-2020-28016 is a vulnerability in Exim 4 before version 4.94.2 that allows an off-by-two out-of-bounds write.
How severe is CVE-2020-28016?
CVE-2020-28016 has a severity score of 7.8 (high) based on the CVSS v3.0 rating system.
Which software versions are affected by CVE-2020-28016?
CVE-2020-28016 affects Exim 4 versions from 4.00 to 4.94.1.
How is CVE-2020-28016 exploited?
CVE-2020-28016 is exploited by mishandling the "-F ''" option in Exim, leading to an off-by-two out-of-bounds write.
Is there a fix available for CVE-2020-28016?
Yes, the fix for CVE-2020-28016 is included in Exim version 4.94.2, so upgrading to this version or later will resolve the vulnerability.