{"id":"CVE-2020-12783","details":"Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.","modified":"2026-07-08T05:55:41.425944226Z","published":"2020-05-11T14:15:11.917Z","related":["openSUSE-SU-2021:0677-1","openSUSE-SU-2021:0753-1","openSUSE-SU-2021:0754-1","openSUSE-SU-2024:10746-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"14.04"},{"last_affected":"14.04"},{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"19.10"},{"last_affected":"19.10"},{"introduced":"20.04"},{"last_affected":"20.04"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux","cpes":["cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"]},{"cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"10.0"},{"last_affected":"10.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"31"},{"last_affected":"31"},{"introduced":"32"},{"last_affected":"32"}],"source":"CPE_STRING"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6IQQ2SERFUD4WMRSX6XYDNK7Q4GPT7Y/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7Z5UG6ZIG32V7M4PP3BCC65C27EWK7G/"},{"type":"ADVISORY","url":"https://bugs.exim.org/show_bug.cgi?id=2571"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00017.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4366-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2020/dsa-4687"},{"type":"FIX","url":"https://git.exim.org/exim.git/commit/57aa14b216432be381b6295c312065b2fd034f86"},{"type":"FIX","url":"https://git.exim.org/exim.git/commit/a04174dc2a84ae1008c23b6a7109e7fa3fb7b8b0"},{"type":"EVIDENCE","url":"http://www.openwall.com/lists/oss-security/2021/05/04/7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/exim/exim","events":[{"introduced":"0"},{"last_affected":"885bb037cb791e057de2105bb3790c6135914c62"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"4.93"}]}}],"versions":["exim-4.93","exim-4.93-RC7","exim-4.93-RC6","exim-4.93-RC5","exim-4.93-RC4","exim-4.93-RC3","exim-4.93-RC2","exim-4.93-RC1","exim-4.93-RC0","exim-4.92-jgh","exim-4.92-RC6","exim-4.92","exim-4.92-RC5","exim-4.92-RC4","exim-4.92-RC3","exim-4.92-RC2","exim-4.92-RC1","exim-4_91","exim-4_91_RC4","exim-4_91_RC3","exim-4_91_RC2","exim-4_91_RC1","exim-4_90_RC4","exim-4_90","exim-4_90_RC3","exim-4_90_RC2","exim-4_90_RC1","exim-4.90devstart","exim-4_89_RC3","exim-4_89_RC1","exim-4_88","exim-4_87","exim-4_88_RC6","exim-4_88_RC5","exim-4_88_RC4","exim-4_88_RC3","exim-4_88_RC2","exim-4_88_RC1","exim-4_87_RC7","exim-4_87_RC6","exim-4_87_RC5","exim-4_87_RC4","exim-4_84","exim-4_86","exim-4_85","exim-4_87_RC3","exim-4_87_RC2","exim-4_87_RC1","exim-4_86_RC5","exim-4_86_RC4","exim-4_86_RC3","exim-4_86_RC2","exim-4_86_RC1","exim-4_85_RC4","exim-4_85_RC3","exim-4_85_RC2","exim-4_85_RC1","exim-4_84_RC2","exim-4_84_RC1","exim-4_83","exim-4_83_RC3","exim-4_83_RC2","exim-4_83_RC1","exim-4_82","exim-4_82_RC5","exim-4_82_RC4","exim-4_82_RC3","exim-4_82_RC2","exim-4_82_RC1","exim-4_80","exim-4_80_RC7","exim-4_80_RC6","exim-4_80_RC5","exim-4_80_RC4","exim-4_80_RC3","exim-4_80_RC2","exim-4_80_RC1","exim-4_77","exim-4_77_RC4","exim-4_77_RC3","exim-4_77_RC2","exim-4_77_RC1","exim-4_76","exim-4_76_RC2","exim-4_76_RC1","exim-4_75","exim-4_75_RC3","exim-4_75_RC2","exim-4_75_RC1","exim-4_74","exim-4_74_RC1","exim-4_73","exim-4_73_RC1","exim-4_73_RC00","exim-4_72","exim-4_72_RC2","exim-4_72_RC1","exim-4_71","exim-4_70","exim-4_70_RC4","exim-4_70_RC3","DEVEL_PDKIM_START","exim-4_69","exim-4_68","exim-4_67","exim-4_66","exim-4_65","exim-4_64","exim-4_63","exim-4_62","exim-4_61","exim-4_54","exim-4_53","exim-4_52","exim-4_51","exim-4_50"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12783.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}