CVE-2017-1000369

Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.

• CWE-404

• http://www.debian.org/security/2017/dsa-3888Third Party Advisory
• http://www.securityfocus.com/bid/99252Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038779Third Party Advisory, VDB Entry
• https://access.redhat.com/security/cve/CVE-2017-1000369Vendor Advisory
• https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21Mitigation, Third Party Advisory
• https://security.gentoo.org/glsa/201709-19Third Party Advisory
• https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtThird Party Advisory
• http://www.debian.org/security/2017/dsa-3888Third Party Advisory
• http://www.securityfocus.com/bid/99252Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038779Third Party Advisory, VDB Entry
• https://access.redhat.com/security/cve/CVE-2017-1000369Vendor Advisory
• https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21Mitigation, Third Party Advisory
• https://security.gentoo.org/glsa/201709-19Third Party Advisory
• https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtThird Party Advisory

Published

Jun 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000363Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missin…7.8
• CVE-2017-1000364An issue was discovered in the size of the stack guard page …
• CVE-2017-1000365The Linux Kernel imposes a size restriction on the arguments…7.8
• CVE-2017-1000366glibc contains a vulnerability that allows specially crafted…
• CVE-2017-1000367Todd Miller's sudo version 1.8.20 and earlier is vulnerable …
• CVE-2017-1000368Todd Miller's sudo version 1.8.20p1 and earlier is vulnerabl…
• CVE-2017-1000370The offset2lib patch as used in the Linux Kernel contains a …7.8
• CVE-2017-1000371The offset2lib patch as used by the Linux Kernel contains a …7.8
• CVE-2017-1000372A flaw exists in OpenBSD's implementation of the stack guard…
• CVE-2017-1000373The OpenBSD qsort() function is recursive, and not randomize…
• CVE-2017-1000374A flaw exists in NetBSD's implementation of the stack guard …
• CVE-2017-1000375NetBSD maps the run-time link-editor ld.so directly below th…