A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in delivermessage() function in /src/deliver.c may lead to remote command execution.
Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.
End of life: 12/18/2016, Latest version: 4.87.1
End of life: 12/18/2016, Latest version: 4.87.1