CVE-2022-37452

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743Patch, Third Party Advisory
https://github.com/Exim/exim/compare/exim-4.94...exim-4.95Patch, Release Notes, Third Party Advisory
https://github.com/Exim/exim/wiki/EximSecurityRelease Notes, Third Party Advisory
https://github.com/ivd38/exim_overflowExploit, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00014.htmlMailing List, Third Party Advisory
https://www.exim.org/static/doc/security/Vendor Advisory
https://www.openwall.com/lists/oss-security/2022/08/06/8Mailing List, Third Party Advisory
https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743Patch, Third Party Advisory
https://github.com/Exim/exim/compare/exim-4.94...exim-4.95Patch, Release Notes, Third Party Advisory
https://github.com/Exim/exim/wiki/EximSecurityRelease Notes, Third Party Advisory
https://github.com/ivd38/exim_overflowExploit, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00014.htmlMailing List, Third Party Advisory
https://www.exim.org/static/doc/security/Vendor Advisory
https://www.openwall.com/lists/oss-security/2022/08/06/8Mailing List, Third Party Advisory

Timeline

Published: Aug 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-374537.5An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and CVE-2022-374549.8The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to CVE-2022-374587.2Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.CVE-2022-374597.8Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses CVE-2022-37466.7A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat CVE-2022-374616.1Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary CVE-2022-374625.4A stored Cross-Site Scripting (XSS) vulnerability in the Chat gadget in Upstream Works Agent Desktop for Cisco Finesse through 4.2.12 and 5.CVE-2022-37476.5The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to miss CVE-2022-37489.8Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management:CVE-2022-37504.7The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.CVE-2022-37519.8SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.CVE-2022-37527.5An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-