Re: [exim] CVE-2022-37452

2022-08-24 Thread Ken Olum via Exim-users
I found out about CVE-2022-37452 when I got this notice from Ubuntu security: https://ubuntu.com/security/notices/USN-5574-1 . It says "Exim could be made to execute arbitrary code", though in the details it says "possibly". Naturally this worried me, and I was alarmed that I hadn't heard of it b

Re: [exim] CVE-2022-37452

2022-08-24 Thread Andrew C Aitchison via Exim-users
On Wed, 24 Aug 2022, Cyborg via Exim-users wrote: Am 24.08.22 um 18:14 schrieb Jeremy Harris via Exim-users: On 24/08/2022 16:45, Ken Olum via Exim-users wrote: How serious is CVE-2022-37452: buffer overflow for the alias list in host_name_lookup? The associated bug, 2747, reported it as a

Re: [exim] CVE-2022-37452

2022-08-24 Thread Jeremy Harris via Exim-users
On 24/08/2022 16:45, Ken Olum via Exim-users wrote: How serious is CVE-2022-37452: buffer overflow for the alias list in host_name_lookup? The associated bug, 2747, reported it as a segfault in the receive process. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listi

Re: [exim] CVE-2022-37452

2022-08-24 Thread Cyborg via Exim-users
Am 24.08.22 um 18:14 schrieb Jeremy Harris via Exim-users: On 24/08/2022 16:45, Ken Olum via Exim-users wrote: How serious is CVE-2022-37452: buffer overflow for the alias list in host_name_lookup? The associated bug, 2747, reported it as a segfault in the receive process. Besides the real