CVE-2016-9963

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-320

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2016/dsa-3747Third Party Advisory
http://www.exim.org/static/doc/CVE-2016-9963.txtMitigation, Vendor Advisory
http://www.securityfocus.com/bid/94947Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037484Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3164-1Third Party Advisory
https://bugs.exim.org/show_bug.cgi?id=1996Issue Tracking, Mitigation, Vendor Advisory
http://www.debian.org/security/2016/dsa-3747Third Party Advisory
http://www.exim.org/static/doc/CVE-2016-9963.txtMitigation, Vendor Advisory
http://www.securityfocus.com/bid/94947Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037484Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3164-1Third Party Advisory
https://bugs.exim.org/show_bug.cgi?id=1996Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: Feb 1, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-99646.5redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233 CVE-2016-99659.8Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7 CVE-2016-99669.8Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7 CVE-2016-99679.8Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7 CVE-2016-99697.5In libwebp 0.5.1, there is a double free bug in libwebpmux.CVE-2016-99725.9IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict T CVE-2016-99735.4IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI CVE-2016-99758.8IBM Jazz for Service Management 1.1.2.1 and 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malic CVE-2016-99768.4IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a speci CVE-2016-99778.8IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate CVE-2016-99784.3IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information. IBM X-Force I CVE-2016-99795.4IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr