CVE-2020-28020
CRITICALExim 4.00-4.91 - Unauthenticated Remote Code Execution via Header Length Continuation Mishandling
Title source: llmDescription
Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
References (3)
Core 3
Core References
Patch, Third Party Advisory x_refsource_misc
https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28020-HSIZE.txt
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/07/25/1
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/08/03/1
Scores
CVSS v3
9.8
EPSS
0.0780
EPSS Percentile
93.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-190
Status
published
Products (1)
exim/exim
4.00 - 4.92
Published
May 06, 2021
Tracked Since
Feb 18, 2026