VIR Vulnerability Intelligence Relay

CVE-2014-2957

medium
Published 2014-09-04 · Modified 2026-05-06
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8

Description

The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-2957

vendor Authored 2026-05-27

Vendor advisory: cret@cert.org — https://lists.exim.org/lurker/message/20140528.122536.a31d60a4.en.html

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed4.82.1-1
debian debianbullseyefixed4.82.1-1
debian debianforkyfixed4.82.1-1
debian debiansidfixed4.82.1-1
debian debiantrixiefixed4.82.1-1

Application impact
VendorProductVersionsFixed
eximexim4.23
eximexim{"endIncluding":"4.82"}
eximexim4.00
eximexim4.01
eximexim4.02
eximexim4.03
eximexim4.04
eximexim4.05
eximexim4.10
eximexim4.11
eximexim4.12
eximexim4.14
eximexim4.20
eximexim4.21
eximexim4.22
eximexim4.24
eximexim4.30
eximexim4.31
eximexim4.32
eximexim4.33
eximexim4.34
eximexim4.40
eximexim4.41
eximexim4.42
eximexim4.43
eximexim4.44
eximexim4.50
eximexim4.51
eximexim4.52
eximexim4.53
eximexim4.54
eximexim4.60
eximexim4.61
eximexim4.62
eximexim4.63
eximexim4.64
eximexim4.65
eximexim4.66
eximexim4.67
eximexim4.68
eximexim4.69
eximexim4.70
eximexim4.71
eximexim4.72
eximexim4.73
eximexim4.74
eximexim4.75
eximexim4.76
eximexim4.77
eximexim4.80
eximexim4.80.1

References

CWEs

CWE-20

Verify integrity in audit chain (admin only). AS-IS.