CVE-2010-2024
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to...
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
Exploit likelihood
What each source reports
NVD Score used
4.4
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
- Record
CVE-2010-2024- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
- Record
CVE-2010-2024- Updated
- 2026-11-02
EUVDEUVD-2010-2044 No score
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
- Record
EUVD-2010-2044- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rwch-4jch-mjx7 No score
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to...
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
- Record
GHSA-rwch-4jch-mjx7- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV No score
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
- Record
CVE-2010-2024- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2024 No score
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
- Record
DEBIAN-CVE-2010-2024- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10017-1 No score
exim-4.86.2-2.2 on GA media
These are all security issues fixed in the exim-4.86.2-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10017-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2024 is a medium vulnerability (CVSS 4.4) in Exim, published June 7, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in exim4 4.72-1.
References
archives.neohapsis.com/archives/fulldisclosure/2010-06/0079.html
bugzilla.redhat.com/show_bug.cgi?id=600097
vupen.com/english/advisories/2010/1402
securityfocus.com/bid/40454
vupen.com/english/advisories/2011/0364
secunia.com/advisories/43243
Show 26 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/59042
vcs.exim.org/viewvc/exim/exim-src/src/transports/appendfile.c?r1=1.25&r2=1.26
secunia.com/advisories/40019
lists.exim.org/lurker/message/20100524.175925.9a69f755.en.html
vcs.exim.org/viewvc/exim/exim-doc/doc-txt/ChangeLog?view=markup&pathrev=exim-4_72_RC2
secunia.com/advisories/40123
securityfocus.com/archive/1/511653/100/0/threaded
lists.fedoraproject.org/pipermail/package-announce/2010-June/042613.html
lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
ubuntu.com/usn/USN-1060-1
bugs.exim.org/show_bug.cgi?id=989
lists.fedoraproject.org/pipermail/package-announce/2010-June/042587.html
nvd.nist.gov/vuln/detail/CVE-2010-2024
github.com/advisories/GHSA-rwch-4jch-mjx7
security-tracker.debian.org/tracker/CVE-2010-2024
suse.com/security/cve/CVE-2010-2023
suse.com/security/cve/CVE-2010-2024
suse.com/security/cve/CVE-2010-4344
suse.com/security/cve/CVE-2010-4345
suse.com/security/cve/CVE-2011-0017
suse.com/security/cve/CVE-2011-1407
suse.com/security/cve/CVE-2011-1764
suse.com/security/cve/CVE-2012-5671
suse.com/security/cve/CVE-2014-2957
suse.com/security/cve/CVE-2014-2972
suse.com/security/cve/CVE-2016-1531