CVE-2017-16944: debian debian_linux Infinite Loop
Vulnerability summary
CVE-2017-16944 is a high (CVSS 7.5) Infinite Loop vulnerability in debian debian_linux. EPSS estimates a 63.36% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 25-11-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
63.36%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
+0.04 pp
From 63.32% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (bugs.exim.org)
Maturity: unknown
Exim 4.89 - 'BDAT' Denial of Service
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- exim4< 4.89-13
- debian_linuxEOL9.0
Exim1 product
- eximEOL4.88 | 4.89
Ubuntu1 product
- exim4< 4.82-3ubuntu2.3 | < 4.86.2-2ubuntu2.2
3 vendors · 4 products
