CVE-2022-37451

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

• CWE-763

• https://cwe.mitre.org/data/definitions/762.htmlThird Party Advisory
• https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42Patch, Third Party Advisory
• https://github.com/Exim/exim/compare/exim-4.95...exim-4.96Release Notes, Third Party Advisory
• https://github.com/Exim/exim/wiki/EximSecurityRelease Notes, Third Party Advisory
• https://github.com/ivd38/exim_invalid_freeExploit, Patch, Third Party Advisory
• https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.htmlMailing List, Release Notes, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/
• https://www.exim.org/static/doc/security/Vendor Advisory
• https://www.openwall.com/lists/oss-security/2022/08/06/1Mailing List, Third Party Advisory
• https://cwe.mitre.org/data/definitions/762.htmlThird Party Advisory
• https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42Patch, Third Party Advisory
• https://github.com/Exim/exim/compare/exim-4.95...exim-4.96Release Notes, Third Party Advisory
• https://github.com/Exim/exim/wiki/EximSecurityRelease Notes, Third Party Advisory
• https://github.com/ivd38/exim_invalid_freeExploit, Patch, Third Party Advisory
• https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.htmlMailing List, Release Notes, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/
• https://www.exim.org/static/doc/security/Vendor Advisory
• https://www.openwall.com/lists/oss-security/2022/08/06/1Mailing List, Third Party Advisory

Published

Aug 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37446Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-37447Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-37448Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-37449Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-3745A potential vulnerability was discovered in LCFC BIOS for so…4.4
• CVE-2022-37450Go Ethereum (aka geth) through 1.10.21 allows attackers to i…5.9
• CVE-2022-37452Exim before 4.95 has a heap-based buffer overflow for the al…9.8
• CVE-2022-37453An issue was discovered in Softing OPC UA C++ SDK before 6.1…7.5
• CVE-2022-37454The Keccak XKCP SHA-3 reference implementation before fdc6fe…9.8
• CVE-2022-37458Discourse through 2.8.7 allows admins to send invitations to…7.2
• CVE-2022-37459Ampere Altra devices before 1.08g and Ampere Altra Max devic…7.8
• CVE-2022-3746A potential vulnerability was discovered in LCFC BIOS for so…6.7