CVE-2022-37451

Name

CVE-2022-37451

Description

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

Exploits

Forges

GitHub (code, issues), Aports (code, issues)

References

Type	URI
MISC	https://www.exim.org/static/doc/security/
MISC	https://github.com/ivd38/exim_invalid_free
MISC	https://github.com/Exim/exim/compare/exim-4.95...exim-4.96
MISC	https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html
MISC	https://www.openwall.com/lists/oss-security/2022/08/06/1
MISC	https://github.com/Exim/exim/wiki/EximSecurity
MISC	https://cwe.mitre.org/data/definitions/762.html
MISC	https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42
Mailing List	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/
Mailing List	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:exim:exim::::::::`	exim	>= None	< 4.96

Source package	Branch	Version	Maintainer	Status
exim	3.16-community	4.95-r0	Jesse Young <jlyo@jlyo.org>	possibly vulnerable