PT-2022-6997 · Exim+5 · Exim+5

Published 2022-06-06 · Updated 2025-08-07 · CVE-2023-42114

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Exim (affected versions not specified)

Description The issue is related to the handling of NTLM challenge requests in Exim, which can result in a read past the end of an allocated data structure due to the lack of proper validation of user-supplied data. This allows remote attackers to disclose sensitive information on affected installations of Exim without requiring authentication. The specific flaw exists within the handling of NTLM challenge requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2023-7644

BDU:2023-06277

CVE-2023-42114

DLA-3599-1

DSA-5512-1

OPENSUSE-SU-2023:0293-1

OPENSUSE-SU-2024:0007-1

OPENSUSE-SU-2024:13282-1

USN-6411-1

ZDI-23-1468

Affected Products

Alt Linux

Astra Linux

Exim

Linuxmint

Red Os

Ubuntu

References · 53

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42114 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42114 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3599-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13282-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-42114 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0293-1 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1468 · Security Note
• https://debian.org/security/2023/dsa-5512 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5512-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6411-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-42115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42114 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-42114 · Vendor Advisory