Exim vulnerabilities

Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.

Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.

In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.

In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.

Exim 4.88 before 4.99.4 in some proxy configurations mishandles short payloads, disclosing uninitialized stack memory values to a client.

Buffer overflow in Exim allows local users to gain root privileges via a long :include: option in a .forward file.