CVE-2017-16944

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.

• CWE-835

• http://openwall.com/lists/oss-security/2017/11/25/1Mailing List
• http://openwall.com/lists/oss-security/2017/11/25/2Mailing List
• http://openwall.com/lists/oss-security/2017/11/25/3Mailing List
• http://www.openwall.com/lists/oss-security/2021/05/04/7
• http://www.securitytracker.com/id/1039873Third Party Advisory, VDB Entry
• https://bugs.exim.org/show_bug.cgi?id=2201Exploit, Issue Tracking
• https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.htmlMailing List
• https://www.debian.org/security/2017/dsa-4053Third Party Advisory
• https://www.exploit-db.com/exploits/43184/Third Party Advisory, VDB Entry
• http://openwall.com/lists/oss-security/2017/11/25/1Mailing List
• http://openwall.com/lists/oss-security/2017/11/25/2Mailing List
• http://openwall.com/lists/oss-security/2017/11/25/3Mailing List
• http://www.openwall.com/lists/oss-security/2021/05/04/7
• http://www.securitytracker.com/id/1039873Third Party Advisory, VDB Entry
• https://bugs.exim.org/show_bug.cgi?id=2201Exploit, Issue Tracking
• https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.htmlMailing List
• https://www.debian.org/security/2017/dsa-4053Third Party Advisory
• https://www.exploit-db.com/exploits/43184/Third Party Advisory, VDB Entry

Published

Nov 25, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16938A global buffer overflow in OptiPNG 0.7.6 allows remote atta…
• CVE-2017-16939The XFRM dump policy implementation in net/xfrm/xfrm_user.c …7.8
• CVE-2017-1694IBM Integration Bus 9.0 and 10.0 transmits user credentials …
• CVE-2017-16941October CMS through 1.0.428 does not prevent use of .htacces…
• CVE-2017-16942In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero err…
• CVE-2017-16943The receive_msg function in receive.c in the SMTP daemon in …
• CVE-2017-16945The standardrestorer binary in Arq 5.10 and earlier for Mac …
• CVE-2017-16946The admin_edit function in app/Controller/UsersController.ph…
• CVE-2017-16948TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to ca…
• CVE-2017-16949An issue was discovered in the AccessKeys AccessPress Anonym…
• CVE-2017-1695IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected crypto…5.9
• CVE-2017-16950Cross - site scripting (XSS) vulnerability in UrBackup Serve…