CVE-2022-37451

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cwe.mitre.org/data/definitions/762.html	Third Party Advisory
https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42	Patch Third Party Advisory
https://github.com/Exim/exim/compare/exim-4.95...exim-4.96	Release Notes Third Party Advisory
https://github.com/Exim/exim/wiki/EximSecurity	Release Notes Third Party Advisory
https://github.com/ivd38/exim_invalid_free	Exploit Patch Third Party Advisory
https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html	Mailing List Release Notes Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/
https://www.exim.org/static/doc/security/	Vendor Advisory
https://www.openwall.com/lists/oss-security/2022/08/06/1	Mailing List Third Party Advisory
https://cwe.mitre.org/data/definitions/762.html	Third Party Advisory
https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42	Patch Third Party Advisory
https://github.com/Exim/exim/compare/exim-4.95...exim-4.96	Release Notes Third Party Advisory
https://github.com/Exim/exim/wiki/EximSecurity	Release Notes Third Party Advisory
https://github.com/ivd38/exim_invalid_free	Exploit Patch Third Party Advisory
https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html	Mailing List Release Notes Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/
https://www.exim.org/static/doc/security/	Vendor Advisory
https://www.openwall.com/lists/oss-security/2022/08/06/1	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:35:::::::*
	cpe:2.3:o:fedoraproject:fedora:36:::::::*

History

21 Nov 2024, 07:15

Type	Values Removed	Values Added
References	~~() https://cwe.mitre.org/data/definitions/762.html - Third Party Advisory~~	() https://cwe.mitre.org/data/definitions/762.html - Third Party Advisory
References	~~() https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42 - Patch, Third Party Advisory~~	() https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42 - Patch, Third Party Advisory
References	~~() https://github.com/Exim/exim/compare/exim-4.95...exim-4.96 - Release Notes, Third Party Advisory~~	() https://github.com/Exim/exim/compare/exim-4.95...exim-4.96 - Release Notes, Third Party Advisory
References	~~() https://github.com/Exim/exim/wiki/EximSecurity - Release Notes, Third Party Advisory~~	() https://github.com/Exim/exim/wiki/EximSecurity - Release Notes, Third Party Advisory
References	~~() https://github.com/ivd38/exim_invalid_free - Exploit, Patch, Third Party Advisory~~	() https://github.com/ivd38/exim_invalid_free - Exploit, Patch, Third Party Advisory
References	~~() https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html - Mailing List, Release Notes, Vendor Advisory~~	() https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html - Mailing List, Release Notes, Vendor Advisory
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/ -
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/ -
References	~~() https://www.exim.org/static/doc/security/ - Vendor Advisory~~	() https://www.exim.org/static/doc/security/ - Vendor Advisory
References	~~() https://www.openwall.com/lists/oss-security/2022/08/06/1 - Mailing List, Third Party Advisory~~	() https://www.openwall.com/lists/oss-security/2022/08/06/1 - Mailing List, Third Party Advisory

07 Nov 2023, 03:49

Type	Values Removed	Values Added
References	{'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/', 'name': 'FEDORA-2022-1ca1d22165', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/', 'name': 'FEDORA-2022-f9a8388e62', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/ -

Information

Published : 2022-08-06 18:15

Updated : 2024-11-21 07:15

NVD link : CVE-2022-37451

Mitre link : CVE-2022-37451

CVE.ORG link : CVE-2022-37451

JSON object : View

Products Affected

exim

exim

fedoraproject

fedora

CWE

CWE-763

Release of Invalid Pointer or Reference

7.5 /10