PT-2022-5379 · Exim+1 · Exim+1

Published 2022-08-31 · Updated 2025-05-23 · CVE-2022-3620

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exim (affected versions not specified)

Description The issue affects the function dmarc dns lookup of the file dmarc.c of the component DMARC Handler. This is related to a use after free condition, which can be exploited by a remote attacker to gain unauthorized access to protected information. The attack may be initiated remotely.

Recommendations Apply a patch to fix this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-416

CWE-119

Related Identifiers

BDU:2022-06645

BDU:2022-06693

CVE-2022-3620

Affected Products

Exim

Red Os

References · 27

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/667V3ADXQ2MHUJMSXA3VZZEWLVSCIBEU · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3620 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIH4W5R7SHTUEQFWWKB4TUO5YFZX64KV · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XV2K2AWF62FSJ64B5CUZPFT4COK7P5PM · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06693 · Security Note
• https://bdu.fstec.ru/vul/2022-06645 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3620 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-3620 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TMQ6OCKPNPBPSD37YR4FOWV2R54M2UEP · Vendor Advisory
• https://goslinux.fssp.gov.ru/2726972 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3559 · Security Note