QID 354032

exim 4 before 4.94.2 allows execution with unnecessary privileges.
Because exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem. (
( CVE-2020-28007) exim 4 before 4.94.2 allows execution with unnecessary privileges.
Because exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution. (
( CVE-2020-28008) exim 4 before 4.94.2 allows integer overflow to buffer overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable.
Note: exploitation may be impractical because of the execution time needed to overflow (multiple days). (
( CVE-2020-28009) exim 4 before 4.94.2 allows out-of-bounds write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms). (
( CVE-2020-28010) exim 4 before 4.94.2 allows heap-based buffer overflow in queue_run via two sender options: -r and -s. this may cause privilege escalation from exim to root. (
( CVE-2020-28011) exim 4 before 4.94.2 allows exposure of file descriptor to unintended control sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag. (
( CVE-2020-28012) exim 4 before 4.94.2 allows heap-based buffer overflow because it mishandles "-f .("
On the command line, and thus may allow privilege escalation from any user to root.
This occurs because of the interpretation of negative sizes in strncpy. (

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.