CVE-2011-1764

Published: 10 May 2011

Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.

Priority

Status

Package	Release	Status
exim4 Launchpad, Ubuntu, Debian	dapper	Not vulnerable (dkim code not present)
	hardy	Not vulnerable (dkim code not present)
	lucid	Released (4.71-3ubuntu1.2)
	maverick	Released (4.72-1ubuntu1.2)
	natty	Released (4.74-1ubuntu1.1)
	upstream	Released (4.76)

References

https://ubuntu.com/security/notices/USN-1130-1
https://www.cve.org/CVERecord?id=CVE-2011-1764
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.