CVE-2017-16943

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://openwall.com/lists/oss-security/2017/11/25/1Mailing List
http://openwall.com/lists/oss-security/2017/11/25/2Mailing List
http://openwall.com/lists/oss-security/2017/11/25/3Mailing List
http://www.openwall.com/lists/oss-security/2021/05/04/7
http://www.securitytracker.com/id/1039872Third Party Advisory, VDB Entry
https://bugs.exim.org/show_bug.cgi?id=2199Exploit, Issue Tracking
https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bdePatch
https://git.exim.org/exim.git/commitdiff/4e6ae6235c68de243b1c2419027472d7659aa2b4Patch
https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944Exploit
https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.htmlMailing List
https://www.debian.org/security/2017/dsa-4053Third Party Advisory
http://openwall.com/lists/oss-security/2017/11/25/1Mailing List
http://openwall.com/lists/oss-security/2017/11/25/2Mailing List
http://openwall.com/lists/oss-security/2017/11/25/3Mailing List
http://www.openwall.com/lists/oss-security/2021/05/04/7
http://www.securitytracker.com/id/1039872Third Party Advisory, VDB Entry
https://bugs.exim.org/show_bug.cgi?id=2199Exploit, Issue Tracking
https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bdePatch
https://git.exim.org/exim.git/commitdiff/4e6ae6235c68de243b1c2419027472d7659aa2b4Patch
https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944Exploit
https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.htmlMailing List
https://www.debian.org/security/2017/dsa-4053Third Party Advisory

Timeline

Published: Nov 25, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-169447.5The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinit CVE-2017-169457.8The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privil CVE-2017-169464.9The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to di CVE-2017-169487.8TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified CVE-2017-169499.8An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization all CVE-2017-16957.5IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info CVE-2017-169506.1Cross - site scripting (XSS) vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML v CVE-2017-169515.5Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, or AIF file.CVE-2017-169525.5KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file.CVE-2017-169537.5connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE confi CVE-2017-169558.8SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via CVE-2017-169566.1b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter wit