{"id":"CVE-2017-1000369","details":"Exim supports the use of multiple \"-p\" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.","modified":"2026-07-08T12:05:13.667997Z","published":"2017-06-19T16:29:00.343Z","related":["openSUSE-SU-2021:0677-1","openSUSE-SU-2021:0753-1","openSUSE-SU-2021:0754-1","openSUSE-SU-2024:10746-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"ADVISORY","url":"http://www.debian.org/security/2017/dsa-3888"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/99252"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1038779"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2017-1000369"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201709-19"},{"type":"ADVISORY","url":"https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt"},{"type":"FIX","url":"https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/exim/exim","events":[{"introduced":"0"},{"last_affected":"98ed60088eaf8ffd8bfdcc27643a116191f16340"},{"introduced":"57091745e6d5ce4259c645b3ac63838668d55b7f"},{"last_affected":"f5e69651703fc6cd7645ea4b4ce00d030a3c311b"},{"fixed":"65e061b76867a9ea7aeeb535341b790b90ae6c21"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.88:-:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.88:rc1:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.88:rc2:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.88:rc3:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.88:rc4:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.88:rc5:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.88:rc6:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.89:-:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.89:rc1:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.89:rc2:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.89:rc3:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.89:rc4:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.89:rc5:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.89:rc6:*:*:*:*:*:*","cpe:2.3:a:exim:exim:4.89:rc7:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"4.87.1"},{"introduced":"4.88-NA"},{"last_affected":"4.88-NA"},{"introduced":"4.88-rc1"},{"last_affected":"4.88-rc1"},{"introduced":"4.88-rc2"},{"last_affected":"4.88-rc2"},{"introduced":"4.88-rc3"},{"last_affected":"4.88-rc3"},{"introduced":"4.88-rc4"},{"last_affected":"4.88-rc4"},{"introduced":"4.88-rc5"},{"last_affected":"4.88-rc5"},{"introduced":"4.88-rc6"},{"last_affected":"4.88-rc6"},{"introduced":"4.89-NA"},{"last_affected":"4.89-NA"},{"introduced":"4.89-rc1"},{"last_affected":"4.89-rc1"},{"introduced":"4.89-rc2"},{"last_affected":"4.89-rc2"},{"introduced":"4.89-rc3"},{"last_affected":"4.89-rc3"},{"introduced":"4.89-rc4"},{"last_affected":"4.89-rc4"},{"introduced":"4.89-rc5"},{"last_affected":"4.89-rc5"},{"introduced":"4.89-rc6"},{"last_affected":"4.89-rc6"},{"introduced":"4.89-rc7"},{"last_affected":"4.89-rc7"}]}}],"versions":["4.88-NA","4.88-rc1","4.88-rc2","4.88-rc3","4.88-rc4","4.88-rc5","4.88-rc6","4.89-NA","4.89-rc1","4.89-rc2","4.89-rc3","4.89-rc4","4.89-rc5","4.89-rc6","4.89-rc7","exim-4_89_RC7","exim-4_89_RC6","exim-4_89_RC5","exim-4.90devstart","exim-4_89_RC4","exim-4_89_RC3","exim-4_89_RC1","exim-4_88","exim-4_87_1","exim-4_87","exim-4_87_RC7","exim-4_87_RC6","exim-4_87_RC5","exim-4_87_RC4","exim-4_84","exim-4_86","exim-4_85","exim-4_87_RC3","exim-4_87_RC2","exim-4_87_RC1","exim-4_86_RC5","exim-4_86_RC4","exim-4_86_RC3","exim-4_86_RC2","exim-4_86_RC1","exim-4_85_RC4","exim-4_85_RC3","exim-4_85_RC2","exim-4_85_RC1","exim-4_84_RC2","exim-4_84_RC1","exim-4_83","exim-4_83_RC3","exim-4_83_RC2","exim-4_83_RC1","exim-4_82","exim-4_82_RC5","exim-4_82_RC4","exim-4_82_RC3","exim-4_82_RC2","exim-4_82_RC1","exim-4_80","exim-4_80_RC7","exim-4_80_RC6","exim-4_80_RC5","exim-4_80_RC4","exim-4_80_RC3","exim-4_80_RC2","exim-4_80_RC1","exim-4_77","exim-4_77_RC4","exim-4_77_RC3","exim-4_77_RC2","exim-4_77_RC1","exim-4_76","exim-4_76_RC2","exim-4_76_RC1","exim-4_75","exim-4_75_RC3","exim-4_75_RC2","exim-4_75_RC1","exim-4_74","exim-4_74_RC1","exim-4_73","exim-4_73_RC1","exim-4_73_RC00","exim-4_72","exim-4_72_RC2","exim-4_72_RC1","exim-4_71","exim-4_70","exim-4_70_RC4","exim-4_70_RC3","DEVEL_PDKIM_START","exim-4_69","exim-4_68","exim-4_67","exim-4_66","exim-4_65","exim-4_64","exim-4_63","exim-4_62","exim-4_61","exim-4_54","exim-4_53","exim-4_52","exim-4_51","exim-4_50"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000369.json","vanir_signatures_modified":"2026-07-08T12:05:13Z","vanir_signatures":[{"id":"CVE-2017-1000369-2d4f42a9","signature_type":"Line","signature_version":"v1","source":"https://github.com/exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21","target":{"file":"src/src/exim.c"},"deprecated":false,"digest":{"line_hashes":["38488530320842470824616492725579972249","79606996488806108233328364524732095279","283894696414702954052563933938780906082","108584226054236280939790936839653366672","151384877497265530925305136925611819412","335622212625325209041321625245009772535","205292432811187591063234023478821436168","118920449216836268319752180160249136072"],"threshold":0.9}},{"target":{"file":"src/src/exim.c","function":"main"},"deprecated":false,"digest":{"function_hash":"211929463205635578468219543010107225043","length":67179},"id":"CVE-2017-1000369-923df71b","signature_type":"Function","signature_version":"v1","source":"https://github.com/exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}