CVE-2017-16943

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

• CWE-416

• http://openwall.com/lists/oss-security/2017/11/25/1Mailing List
• http://openwall.com/lists/oss-security/2017/11/25/2Mailing List
• http://openwall.com/lists/oss-security/2017/11/25/3Mailing List
• http://www.openwall.com/lists/oss-security/2021/05/04/7
• http://www.securitytracker.com/id/1039872Third Party Advisory, VDB Entry
• https://bugs.exim.org/show_bug.cgi?id=2199Exploit, Issue Tracking
• https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bdePatch
• https://git.exim.org/exim.git/commitdiff/4e6ae6235c68de243b1c2419027472d7659aa2b4Patch
• https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944Exploit
• https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.htmlMailing List
• https://www.debian.org/security/2017/dsa-4053Third Party Advisory
• http://openwall.com/lists/oss-security/2017/11/25/1Mailing List
• http://openwall.com/lists/oss-security/2017/11/25/2Mailing List
• http://openwall.com/lists/oss-security/2017/11/25/3Mailing List
• http://www.openwall.com/lists/oss-security/2021/05/04/7
• http://www.securitytracker.com/id/1039872Third Party Advisory, VDB Entry
• https://bugs.exim.org/show_bug.cgi?id=2199Exploit, Issue Tracking
• https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bdePatch
• https://git.exim.org/exim.git/commitdiff/4e6ae6235c68de243b1c2419027472d7659aa2b4Patch
• https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944Exploit
• https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.htmlMailing List
• https://www.debian.org/security/2017/dsa-4053Third Party Advisory

Published

Nov 25, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16936Directory Traversal vulnerability in app_data_center on Shen…
• CVE-2017-16938A global buffer overflow in OptiPNG 0.7.6 allows remote atta…
• CVE-2017-16939The XFRM dump policy implementation in net/xfrm/xfrm_user.c …7.8
• CVE-2017-1694IBM Integration Bus 9.0 and 10.0 transmits user credentials …
• CVE-2017-16941October CMS through 1.0.428 does not prevent use of .htacces…
• CVE-2017-16942In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero err…
• CVE-2017-16944The receive_msg function in receive.c in the SMTP daemon in …
• CVE-2017-16945The standardrestorer binary in Arq 5.10 and earlier for Mac …
• CVE-2017-16946The admin_edit function in app/Controller/UsersController.ph…
• CVE-2017-16948TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to ca…
• CVE-2017-16949An issue was discovered in the AccessKeys AccessPress Anonym…
• CVE-2017-1695IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected crypto…5.9