CVE-2017-16944

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack…

published November 25, 2017

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.2th percentile for exploit probability.

CVSS
—
EPSS
63%
Percentile
99.2
In the wild
Unconfirmed
What it is

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.63358 · 99.2th percentile
Published
2017-11-25T17:00Z
EPSS history
Timeline
  • 22 SEP 03:14Z
    EPSS moved 63% → 42%
    epss
  • 06 SEP 03:10Z
    EPSS moved 63% → 42%
    epss
  • 30 AUG 15:40Z
    EPSS moved 42% → 63%
    epss
  • 29 AUG 04:21Z
    EPSS moved 63% → 42%
    epss
  • 25 NOV 17:00Z
    The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack…
    cvelistv5