Vulnerability-Lookup

CVE-2012-5671 (GCVE-0-2012-5671)

Vulnerability from cvelistv5 – Published: 2012-10-31 16:00 – Updated: 2024-08-06 21:14

Summary

Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via an email from a malicious DNS server.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

15 references

URL	Tags
http://secunia.com/advisories/51115	third-party-advisoryx_refsource_SECUNIA
http://www.openwall.com/lists/oss-security/2012/10/26/5	mailing-listx_refsource_MLIST
http://secunia.com/advisories/51155	third-party-advisoryx_refsource_SECUNIA
https://lists.exim.org/lurker/message/20121026.08…	mailing-listx_refsource_MLIST
http://www.ubuntu.com/usn/USN-1618-1	vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/51098	third-party-advisoryx_refsource_SECUNIA
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://secunia.com/advisories/51153	third-party-advisoryx_refsource_SECUNIA
http://osvdb.org/86616	vdb-entryx_refsource_OSVDB
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/56285	vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.debian.org/security/2012/dsa-2566	vendor-advisoryx_refsource_DEBIAN

Date Public

2012-10-26 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:14:16.438Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "51115",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51115"
          },
          {
            "name": "[oss-security] 20121027 CVE-2012-5671: Exim \u003c= 4.80 DKIM heap-based buffer overflow",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/10/26/5"
          },
          {
            "name": "51155",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51155"
          },
          {
            "name": "[exim-announce] 20121026 Exim 4.80.1 Security Release",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
          },
          {
            "name": "USN-1618-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1618-1"
          },
          {
            "name": "51098",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51098"
          },
          {
            "name": "FEDORA-2012-17044",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html"
          },
          {
            "name": "FEDORA-2012-17085",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html"
          },
          {
            "name": "51153",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51153"
          },
          {
            "name": "86616",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/86616"
          },
          {
            "name": "openSUSE-SU-2012:1404",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html"
          },
          {
            "name": "56285",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/56285"
          },
          {
            "name": "exim-dkimeximquerydnstxt-bo(79615)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79615"
          },
          {
            "name": "FEDORA-2012-16899",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html"
          },
          {
            "name": "DSA-2566",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2566"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-10-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \"warn control = dkim_disable_verify,\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "51115",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51115"
        },
        {
          "name": "[oss-security] 20121027 CVE-2012-5671: Exim \u003c= 4.80 DKIM heap-based buffer overflow",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/10/26/5"
        },
        {
          "name": "51155",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51155"
        },
        {
          "name": "[exim-announce] 20121026 Exim 4.80.1 Security Release",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
        },
        {
          "name": "USN-1618-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1618-1"
        },
        {
          "name": "51098",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51098"
        },
        {
          "name": "FEDORA-2012-17044",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html"
        },
        {
          "name": "FEDORA-2012-17085",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html"
        },
        {
          "name": "51153",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51153"
        },
        {
          "name": "86616",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/86616"
        },
        {
          "name": "openSUSE-SU-2012:1404",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html"
        },
        {
          "name": "56285",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/56285"
        },
        {
          "name": "exim-dkimeximquerydnstxt-bo(79615)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79615"
        },
        {
          "name": "FEDORA-2012-16899",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html"
        },
        {
          "name": "DSA-2566",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2566"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-5671",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \"warn control = dkim_disable_verify,\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "51115",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/51115"
            },
            {
              "name": "[oss-security] 20121027 CVE-2012-5671: Exim \u003c= 4.80 DKIM heap-based buffer overflow",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/10/26/5"
            },
            {
              "name": "51155",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/51155"
            },
            {
              "name": "[exim-announce] 20121026 Exim 4.80.1 Security Release",
              "refsource": "MLIST",
              "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
            },
            {
              "name": "USN-1618-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1618-1"
            },
            {
              "name": "51098",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/51098"
            },
            {
              "name": "FEDORA-2012-17044",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html"
            },
            {
              "name": "FEDORA-2012-17085",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html"
            },
            {
              "name": "51153",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/51153"
            },
            {
              "name": "86616",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/86616"
            },
            {
              "name": "openSUSE-SU-2012:1404",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html"
            },
            {
              "name": "56285",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/56285"
            },
            {
              "name": "exim-dkimeximquerydnstxt-bo(79615)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79615"
            },
            {
              "name": "FEDORA-2012-16899",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html"
            },
            {
              "name": "DSA-2566",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2566"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-5671",
    "datePublished": "2012-10-31T16:00:00.000Z",
    "dateReserved": "2012-10-24T00:00:00.000Z",
    "dateUpdated": "2024-08-06T21:14:16.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2012-5671",
      "date": "2026-09-15",
      "epss": "0.08382",
      "percentile": "0.94657"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:exim:exim:4.70:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"452E9C94-B7FF-40A9-A7F9-FC38824F6135\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:exim:exim:4.71:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A8EB3709-D51F-46D1-99B8-CFB4C2275077\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:exim:exim:4.72:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CBDB2156-072B-4392-9DC8-266FF1B8C7A4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:exim:exim:4.73:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"02F8A053-4578-4C45-A193-C188E45ED010\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:exim:exim:4.74:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A5DC11D6-F67F-40A8-B8BF-2E76DD2F9091\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:exim:exim:4.75:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5854CAF2-1587-4B91-9F9B-E2C57C22C426\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:exim:exim:4.76:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"24D504C3-139D-4627-BD72-B6B46B360CE6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:exim:exim:4.77:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF796BE5-380B-4DBF-A4FF-4CDF98B69C97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:exim:exim:4.80:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6526E201-30CC-4C12-B2B4-06EBA663D39F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \\\"warn control = dkim_disable_verify,\\\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server.\"}, {\"lang\": \"es\", \"value\": \"Desbordamiento de b\\u00fafer basado en memoria din\\u00e1mica en la funci\\u00f3n dkim_exim_query_dns_txt en dkim.c en Exim v4.70 hasta v4.80, cuando el soporte DKIM est\\u00e1 habilitado y acl_smtp_connect y acl_smtp_rcpt no est\\u00e1n establecidos en \\\"warn control = dkim_disable_verify\\\", permite a atacantes remotos ejecutar c\\u00f3digo arbitrario a trav\\u00e9s de un correo electr\\u00f3nico de un servidor DNS malicioso.\"}]",
      "id": "CVE-2012-5671",
      "lastModified": "2024-11-21T01:45:05.460",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2012-10-31T16:55:06.577",
      "references": "[{\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/86616\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/51098\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/51115\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/51153\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/51155\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.debian.org/security/2012/dsa-2566\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2012/10/26/5\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/56285\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-1618-1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/79615\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://osvdb.org/86616\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/51098\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/51115\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/51153\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/51155\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.debian.org/security/2012/dsa-2566\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2012/10/26/5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/56285\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-1618-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/79615\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-119\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2012-5671\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2012-10-31T16:55:06.577\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \\\"warn control = dkim_disable_verify,\\\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de b\u00fafer basado en memoria din\u00e1mica en la funci\u00f3n dkim_exim_query_dns_txt en dkim.c en Exim v4.70 hasta v4.80, cuando el soporte DKIM est\u00e1 habilitado y acl_smtp_connect y acl_smtp_rcpt no est\u00e1n establecidos en \\\"warn control = dkim_disable_verify\\\", permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de un correo electr\u00f3nico de un servidor DNS malicioso.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:4.70:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"452E9C94-B7FF-40A9-A7F9-FC38824F6135\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:4.71:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8EB3709-D51F-46D1-99B8-CFB4C2275077\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:4.72:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBDB2156-072B-4392-9DC8-266FF1B8C7A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:4.73:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02F8A053-4578-4C45-A193-C188E45ED010\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:4.74:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5DC11D6-F67F-40A8-B8BF-2E76DD2F9091\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:4.75:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5854CAF2-1587-4B91-9F9B-E2C57C22C426\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:4.76:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"24D504C3-139D-4627-BD72-B6B46B360CE6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:4.77:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF796BE5-380B-4DBF-A4FF-4CDF98B69C97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:4.80:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6526E201-30CC-4C12-B2B4-06EBA663D39F\"}]}]}],\"references\":[{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/86616\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/51098\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/51115\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/51153\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/51155\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2012/dsa-2566\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/10/26/5\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/56285\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-1618-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/79615\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/86616\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/51098\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/51115\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/51153\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/51155\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2012/dsa-2566\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/10/26/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/56285\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-1618-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/79615\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Critical",
      "current_release_date": "2025-11-21T12:49:27+00:00",
      "cve": "CVE-2012-5671",
      "id": "CVE-2012-5671",
      "initial_release_date": "2012-10-26T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "exim: Heap-buffer overflow in DNS decode logic used for DKIM",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2012/cve-2012-5671.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-03-16T13:48:33Z",
      "cve": "CVE-2012-5671",
      "id": "CVE-2012-5671",
      "initial_release_date": "2023-02-15T05:43:25Z",
      "product_status:recommended": "3",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2012-5671",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2012-5671.json",
      "version": "6"
    }
  }
}

CERTA-2012-AVI-608

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité critique a été corrigée dans Exim. Elle permet à un attaquant d'exécuter du code arbitraire à distance au moyen d'un email spécialement conçu. Il s'agit d'un débordement de mémoire tampon dans le tas. La vulnérabilité concerne le composant DKIM de Exim.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Exim de la version 4.70 à la version 4.80 inclue

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Exim du 26 octobre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eExim de la version 4.70 \u00e0 la version 4.80 inclue\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-5671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-5671"
    }
  ],
  "links": [],
  "reference": "CERTA-2012-AVI-608",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-10-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 critique a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan\nclass=\"textit\"\u003eExim\u003c/span\u003e. Elle permet \u00e0 un attaquant d\u0027ex\u00e9cuter du\ncode arbitraire \u00e0 distance au moyen d\u0027un email sp\u00e9cialement con\u00e7u. Il\ns\u0027agit d\u0027un d\u00e9bordement de m\u00e9moire tampon dans le tas. La vuln\u00e9rabilit\u00e9\nconcerne le composant \u003cspan class=\"textit\"\u003eDKIM\u003c/span\u003e de \u003cspan\nclass=\"textit\"\u003eExim\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Exim DKIM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Exim du 26 octobre 2012",
      "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
    }
  ]
}

CERTA-2012-AVI-664

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été corrigée dans Sophos UTM. Elle permet à un attaquant d'exécuter du code arbitraire à distance au moyen de courriels spécialement conçus. Elle concerne le serveur de courriels Exim.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Sophos UTM versions antérieures à 9.004

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Sophos UTM9004 du 16 novembre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eSophos UTM versions ant\u00e9rieures \u00e0 9.004\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-5671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-5671"
    }
  ],
  "links": [],
  "reference": "CERTA-2012-AVI-664",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-11-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eSophos\nUTM\u003c/span\u003e. Elle permet \u00e0 un attaquant d\u0027ex\u00e9cuter du code arbitraire \u00e0\ndistance au moyen de courriels sp\u00e9cialement con\u00e7us. Elle concerne le\nserveur de courriels \u003cspan class=\"textit\"\u003eExim\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Sophos UTM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Sophos UTM9004 du 16 novembre 2012",
      "url": "http://www.astaro.com/blog/up2date/UTM9004"
    }
  ]
}

CERTA-2012-AVI-608

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Exim de la version 4.70 à la version 4.80 inclue

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Exim du 26 octobre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eExim de la version 4.70 \u00e0 la version 4.80 inclue\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-5671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-5671"
    }
  ],
  "links": [],
  "reference": "CERTA-2012-AVI-608",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-10-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 critique a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan\nclass=\"textit\"\u003eExim\u003c/span\u003e. Elle permet \u00e0 un attaquant d\u0027ex\u00e9cuter du\ncode arbitraire \u00e0 distance au moyen d\u0027un email sp\u00e9cialement con\u00e7u. Il\ns\u0027agit d\u0027un d\u00e9bordement de m\u00e9moire tampon dans le tas. La vuln\u00e9rabilit\u00e9\nconcerne le composant \u003cspan class=\"textit\"\u003eDKIM\u003c/span\u003e de \u003cspan\nclass=\"textit\"\u003eExim\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Exim DKIM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Exim du 26 octobre 2012",
      "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
    }
  ]
}

CERTA-2012-AVI-664

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Sophos UTM versions antérieures à 9.004

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Sophos UTM9004 du 16 novembre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eSophos UTM versions ant\u00e9rieures \u00e0 9.004\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-5671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-5671"
    }
  ],
  "links": [],
  "reference": "CERTA-2012-AVI-664",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-11-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eSophos\nUTM\u003c/span\u003e. Elle permet \u00e0 un attaquant d\u0027ex\u00e9cuter du code arbitraire \u00e0\ndistance au moyen de courriels sp\u00e9cialement con\u00e7us. Elle concerne le\nserveur de courriels \u003cspan class=\"textit\"\u003eExim\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Sophos UTM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Sophos UTM9004 du 16 novembre 2012",
      "url": "http://www.astaro.com/blog/up2date/UTM9004"
    }
  ]
}

FKIE_CVE-2012-5671

Vulnerability from fkie_nvd - Published: 2012-10-31 16:55 - Updated: 2026-06-16 23:47

Severity

Summary

References

URL	Tags
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html
cve@mitre.org	http://osvdb.org/86616
cve@mitre.org	http://secunia.com/advisories/51098	Vendor Advisory
cve@mitre.org	http://secunia.com/advisories/51115
cve@mitre.org	http://secunia.com/advisories/51153
cve@mitre.org	http://secunia.com/advisories/51155
cve@mitre.org	http://www.debian.org/security/2012/dsa-2566
cve@mitre.org	http://www.openwall.com/lists/oss-security/2012/10/26/5
cve@mitre.org	http://www.securityfocus.com/bid/56285
cve@mitre.org	http://www.ubuntu.com/usn/USN-1618-1
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/79615
cve@mitre.org	https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/86616
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/51098	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/51115
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/51153
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/51155
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2012/dsa-2566
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2012/10/26/5
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/56285
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/USN-1618-1
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/79615
af854a3a-2127-422b-91ae-364da2661108	https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html

Impacted products

Vendor	Product	Version
exim	exim	4.70
exim	exim	4.71
exim	exim	4.72
exim	exim	4.73
exim	exim	4.74
exim	exim	4.75
exim	exim	4.76
exim	exim	4.77
exim	exim	4.80

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:exim:exim:4.70:*:*:*:*:*:*:*",
              "matchCriteriaId": "452E9C94-B7FF-40A9-A7F9-FC38824F6135",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:exim:exim:4.71:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8EB3709-D51F-46D1-99B8-CFB4C2275077",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:exim:exim:4.72:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBDB2156-072B-4392-9DC8-266FF1B8C7A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:exim:exim:4.73:*:*:*:*:*:*:*",
              "matchCriteriaId": "02F8A053-4578-4C45-A193-C188E45ED010",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:exim:exim:4.74:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5DC11D6-F67F-40A8-B8BF-2E76DD2F9091",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:exim:exim:4.75:*:*:*:*:*:*:*",
              "matchCriteriaId": "5854CAF2-1587-4B91-9F9B-E2C57C22C426",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:exim:exim:4.76:*:*:*:*:*:*:*",
              "matchCriteriaId": "24D504C3-139D-4627-BD72-B6B46B360CE6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:exim:exim:4.77:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF796BE5-380B-4DBF-A4FF-4CDF98B69C97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:exim:exim:4.80:*:*:*:*:*:*:*",
              "matchCriteriaId": "6526E201-30CC-4C12-B2B4-06EBA663D39F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \"warn control = dkim_disable_verify,\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en memoria din\u00e1mica en la funci\u00f3n dkim_exim_query_dns_txt en dkim.c en Exim v4.70 hasta v4.80, cuando el soporte DKIM est\u00e1 habilitado y acl_smtp_connect y acl_smtp_rcpt no est\u00e1n establecidos en \"warn control = dkim_disable_verify\", permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de un correo electr\u00f3nico de un servidor DNS malicioso."
    }
  ],
  "id": "CVE-2012-5671",
  "lastModified": "2026-06-16T23:47:13.503",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-10-31T16:55:06.577",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/86616"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/51098"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/51115"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/51153"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/51155"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2012/dsa-2566"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2012/10/26/5"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/56285"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-1618-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79615"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/86616"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/51098"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/51115"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/51153"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/51155"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2012/dsa-2566"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/10/26/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/56285"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-1618-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79615"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-9MJ7-G6P8-V73F

Vulnerability from github – Published: 2022-05-17 01:39 – Updated: 2022-05-17 01:39

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2012-5671"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-10-31T16:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \"warn control = dkim_disable_verify,\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server.",
  "id": "GHSA-9mj7-g6p8-v73f",
  "modified": "2022-05-17T01:39:17Z",
  "published": "2022-05-17T01:39:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5671"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79615"
    },
    {
      "type": "WEB",
      "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/86616"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/51098"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/51115"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/51153"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/51155"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2012/dsa-2566"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2012/10/26/5"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/56285"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-1618-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2012-5671

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2012-5671

Aliases

CVE-2012-5671

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2012-5671",
    "description": "Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \"warn control = dkim_disable_verify,\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server.",
    "id": "GSD-2012-5671",
    "references": [
      "https://www.suse.com/security/cve/CVE-2012-5671.html",
      "https://www.debian.org/security/2012/dsa-2566"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2012-5671"
      ],
      "details": "Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \"warn control = dkim_disable_verify,\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server.",
      "id": "GSD-2012-5671",
      "modified": "2023-12-13T01:20:19.339423Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2012-5671",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \"warn control = dkim_disable_verify,\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "51115",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/51115"
          },
          {
            "name": "[oss-security] 20121027 CVE-2012-5671: Exim \u003c= 4.80 DKIM heap-based buffer overflow",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2012/10/26/5"
          },
          {
            "name": "51155",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/51155"
          },
          {
            "name": "[exim-announce] 20121026 Exim 4.80.1 Security Release",
            "refsource": "MLIST",
            "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
          },
          {
            "name": "USN-1618-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-1618-1"
          },
          {
            "name": "51098",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/51098"
          },
          {
            "name": "FEDORA-2012-17044",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html"
          },
          {
            "name": "FEDORA-2012-17085",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html"
          },
          {
            "name": "51153",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/51153"
          },
          {
            "name": "86616",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/86616"
          },
          {
            "name": "openSUSE-SU-2012:1404",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html"
          },
          {
            "name": "56285",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/56285"
          },
          {
            "name": "exim-dkimeximquerydnstxt-bo(79615)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79615"
          },
          {
            "name": "FEDORA-2012-16899",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html"
          },
          {
            "name": "DSA-2566",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2012/dsa-2566"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:exim:exim:4.76:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:exim:exim:4.77:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:exim:exim:4.72:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:exim:exim:4.73:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:exim:exim:4.74:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:exim:exim:4.75:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:exim:exim:4.70:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:exim:exim:4.71:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:exim:exim:4.80:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-5671"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to \"warn control = dkim_disable_verify,\" allows remote attackers to execute arbitrary code via an email from a malicious DNS server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2012:1404",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00018.html"
            },
            {
              "name": "[oss-security] 20121027 CVE-2012-5671: Exim \u003c= 4.80 DKIM heap-based buffer overflow",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2012/10/26/5"
            },
            {
              "name": "86616",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/86616"
            },
            {
              "name": "51098",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/51098"
            },
            {
              "name": "DSA-2566",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2012/dsa-2566"
            },
            {
              "name": "[exim-announce] 20121026 Exim 4.80.1 Security Release",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
            },
            {
              "name": "USN-1618-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-1618-1"
            },
            {
              "name": "56285",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/56285"
            },
            {
              "name": "FEDORA-2012-16899",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html"
            },
            {
              "name": "51153",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/51153"
            },
            {
              "name": "FEDORA-2012-17044",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html"
            },
            {
              "name": "51115",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/51115"
            },
            {
              "name": "FEDORA-2012-17085",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html"
            },
            {
              "name": "51155",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/51155"
            },
            {
              "name": "exim-dkimeximquerydnstxt-bo(79615)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79615"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2017-08-29T01:32Z",
      "publishedDate": "2012-10-31T16:55Z"
    }
  }
}

OPENSUSE-SU-2024:10017-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

exim-4.86.2-2.2 on GA media

Severity

Moderate

Scope

11 vulnerabilities in this advisory, including CVE-2012-5671.

CVE-2012-5671

Recommended: 12 products

Open the full advisory

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2012-5671 (GCVE-0-2012-5671)

Solution

Solution

Solution

Solution

Tags

Sightings

Nomenclature

Related by attack behaviour