CVE-2004-0400
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is...
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
Exploit likelihood
What each source reports
NVD Score used
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
- Record
CVE-2004-0400- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
- Record
CVE-2004-0400- Updated
- 2026-11-02
EUVDEUVD-2004-0400 No score
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
- Record
EUVD-2004-0400- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qx32-c2q2-cgcr No score
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is...
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
- Record
GHSA-qx32-c2q2-cgcr- Updated
- 2026-11-02
OSV No score
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
- Record
CVE-2004-0400- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-0400 No score
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
- Record
DEBIAN-CVE-2004-0400- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
exim4Debian:12 |
before 4.33-1 | 4.33-1 |
exim4Debian:13 |
before 4.33-1 | 4.33-1 |
exim4Debian:14 |
before 4.33-1 | 4.33-1 |
eximDebian:3.0 From an advisory covering 2 CVEs |
before 3.35-1woody3 | 3.35-1woody3 |
exim-tlsDebian:3.0 From an advisory covering 2 CVEs |
before 3.35-3woody2, plus listed versions 3.35-3woody1 |
3.35-3woody2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0400 is a high vulnerability (CVSS 7.5) in University Of Cambridge Exim, published May 7, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.97%, the 94th percentile. Fixed in exim4 4.33-1.
References
debian.org/security/2004/dsa-502
lists.grok.org.uk/pipermail/full-disclosure/2004-May/021015.html
guninski.com/exim1.html
exchange.xforce.ibmcloud.com/vulnerabilities/16077
nvd.nist.gov/vuln/detail/CVE-2004-0400
github.com/advisories/GHSA-qx32-c2q2-cgcr
security-tracker.debian.org/tracker/CVE-2004-0400