CVE-2024-39929
Fixed in a distro release EPSS 41%CVSS 5.4
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.
Products: exim
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | exim4 | 4.94.2-7+deb11u3 |
| Debian 12 | exim4 | 4.96-15+deb12u5 |
| Debian 13 | exim4 | 4.98~RC3-2 |
| Debian 14 | exim4 | 4.98~RC3-2 |
| SUSE Package Hub 15 SP5 | exim | 4.97.1-bp155.5.12.1 |
| Ubuntu 20.04 LTS | exim4 | 4.93-13ubuntu1.12 |
| Ubuntu 22.04 LTS | exim4 | 4.95-4ubuntu2.6 |
| Ubuntu 24.04 LTS | exim4 | 4.97-4ubuntu4.1 |
| Ubuntu Pro 16.04 LTS | exim4 | 4.86.2-2ubuntu2.6+esm8 |
| Ubuntu Pro 18.04 LTS | exim4 | 4.90.1-1ubuntu1.10+esm5 |
| openSUSE Leap 15.5 | exim | 4.97.1-bp155.5.12.1 |
| openSUSE Tumbleweed | exim | 4.98-1.1 |