CVE-2017-16943: debian debian_linux Use After Free

CVSS: 9.8v3.0CriticalModified

AliasesUBUNTU-CVE-2017-16943DEBIAN-CVE-2017-16943

Published 25-11-2017Last modified 05-08-2024

Vulnerability summary

CVE-2017-16943 is a critical (CVSS 9.8) Use After Free vulnerability in debian debian_linux. EPSS estimates a 47.15% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

47.15%

0%100%

High · +0.44 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 4

DSA-4053-1 OPENSUSE-SU-2021:0677-1 OPENSUSE-SU-2021:0753-1 OPENSUSE-SU-2021:0754-1 OPENSUSE-SU-2024:10746-1

Timeline

25-11-2017
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

47.15%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+0.44 pp

From 46.71% on 19-09-2026

19-09-202619-10-2026

EPSS score

47.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

githubUnverified
Poc Exploit Mirror
Maturity: poc
referenceUnverified
Exploit Reference (bugs.exim.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Debian2 products

exim4< 4.89-12
debian_linuxEOL9.0

Exim1 product

eximEOL4.88 | 4.89

Ubuntu1 product

exim4< 4.82-3ubuntu2.3 | < 4.86.2-2ubuntu2.2

3 vendors · 4 products

References

15 links

www.securitytracker.com/id/1039872VDB EntryX Refsource SECTRACKThird Party Advisory
lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.htmlX Refsource MISCMailing ListREPORT
git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bdeX Refsource MISCPatch
openwall.com/lists/oss-security/2017/11/25/3X Refsource MISCMailing List
github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944X Refsource MISCExploit
openwall.com/lists/oss-security/2017/11/25/1X Refsource MISCMailing List
git.exim.org/exim.git/commitdiff/4e6ae6235c68de243b1c2419027472d7659aa2b4X Refsource MISCPatch
openwall.com/lists/oss-security/2017/11/25/2X Refsource MISCMailing List
www.debian.org/security/2017/dsa-4053Vendor AdvisoryX Refsource DEBIANThird Party Advisory
bugs.exim.org/show_bug.cgi?id=2199X Refsource MISCExploitIssue Tracking

Show all 15 references

www.openwall.com/lists/oss-security/2021/05/04/7Mailing ListX Refsource MLIST
ubuntu.com/security/CVE-2017-16943REPORT
ubuntu.com/security/notices/USN-3493-1Advisory
www.cve.org/CVERecord?id=CVE-2017-16943REPORT
security-tracker.debian.org/tracker/CVE-2017-16943Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities