CVE-2010-2023 | Vulnetix

CVE-2010-2023 PUBLISHED CVSS 4.400000095367432 MEDIUM

transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the st_nlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's file.

EPSS 0.28% · 20.0th percentile

Risk Scores

CVSS 2.0

4.400000095367432

EPSS Score

0.28%

20.0th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a
exim	exim	0, 4.10, 4.21

Timeline

Jun 7, 2010 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 21, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Oct 27, 2022 EPSS Score
Dec 19, 2022 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 3, 2023 EPSS Score
May 26, 2023 EPSS Score

References

40123 third-party-advisory
20100603 Multiple vulnerabilities in Exim mailing-list
40019 third-party-advisory
http://vcs.exim.org/viewvc/exim/exim-doc/doc-txt/ChangeLog?view=markup&pathrev=exim-4_72_RC2 url
USN-1060-1 vendor-advisory
FEDORA-2010-9506 vendor-advisory
http://bugs.exim.org/show_bug.cgi?id=988 technical
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042613.html technical
http://www.securityfocus.com/archive/1/511653/100/0/threaded technical
http://www.securityfocus.com/bid/40451 technical
http://www.vupen.com/english/advisories/2010/1402 technical
http://lists.exim.org/lurker/message/20100524.175925.9a69f755.en.html technical
http://secunia.com/advisories/43243 technical
https://bugzilla.redhat.com/show_bug.cgi?id=600093 technical
https://nvd.nist.gov/vuln/detail/CVE-2010-2023 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/59043 url
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html url
http://vcs.exim.org/viewvc/exim/exim-src/src/transports/appendfile.c?r1=1.24&r2=1.25 url
http://www.vupen.com/english/advisories/2011/0364 url

Open in Interactive Console →