CVE-2022-37452: Buffer Overflow
Exim before 4.95 has a heap-based buffer overflow for the alias list in hostnamelookup in host.c when senderhostname is set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/exim4to a version that resolves this vulnerability.Fixed in 4.96-15+deb12u10Fixed in 4.98.2-1+deb13u4Fixed in 4.98.2-1+deb13u5Fixed in 4.100.1-4 - Upgrade
Upgrade
debian/exim4to a version that resolves this vulnerability.Fixed in 4.94.2-5
Event History
Frequently Asked Questions
What is CVE-2022-37452?
CVE-2022-37452 is a vulnerability in the Exim email server that allows a heap-based buffer overflow when handling the alias list in host name lookup.
What is the severity of CVE-2022-37452?
CVE-2022-37452 has a severity rating of 9.8, which is considered critical.
Which software versions are affected by CVE-2022-37452?
Exim versions up to exclusive 4.95 and Debian Linux version 10.0 are affected by CVE-2022-37452.
How can I fix CVE-2022-37452?
To fix CVE-2022-37452, it is recommended to update to Exim version 4.95 or higher, or apply the necessary patches provided by the vendor.
What are the Common Weakness Enumeration (CWE) identifiers associated with CVE-2022-37452?
CVE-2022-37452 is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-787 (Out-of-bounds Write).