The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade exim4 | Jul 30, 2024 | Feb 2, 2011 |
| Exim | — | Upgrade Exim to version 4.72.0 | Dec 3, 2019 | Feb 2, 2011 |
| Freebsd | — | Upgrade exim-ldapUpgrade exim-sa-eximUpgrade exim-ldap2Upgrade exim-mysqlUpgrade exim-postgresqlUpgrade exim | Dec 10, 2025 | Feb 10, 2011 |
| Gentoo Linux | — | Upgrade mail-mta/exim. | Oct 30, 2017 | Feb 1, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 25, 2011 |
| Suse | — | Upgrade eximstats-htmlUpgrade eximUpgrade eximon | Feb 17, 2015 | Feb 1, 2011 |
| Ubuntu | — | Upgrade exim4-daemon-heavyUpgrade exim4-daemon-lightUpgrade exim4-daemon-custom | Nov 8, 2024 | Feb 2, 2011 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub