Every CVE Search/ Get API key

CVE-2010-2024

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to...

4.4 MediumFix available

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

Exploit likelihood

0.28%Down 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.4

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

Record
CVE-2010-2024
CVSS 2.0
4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-362
Updated
2026-11-02
CVE List No score

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

Record
CVE-2010-2024
Updated
2026-11-02
EUVDEUVD-2010-2044 No score

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

Record
EUVD-2010-2044
Updated
2026-11-03
GitHub AdvisoriesGHSA-rwch-4jch-mjx7 No score

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to...

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

Record
GHSA-rwch-4jch-mjx7
Weakness
CWE-362
Updated
2026-11-02
OSV No score

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

Record
CVE-2010-2024
Updated
2026-11-02
OSVDEBIAN-CVE-2010-2024 No score

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

Record
DEBIAN-CVE-2010-2024
Updated
2026-11-02
OSVopenSUSE-SU-2024:10017-1 No score

exim-4.86.2-2.2 on GA media

These are all security issues fixed in the exim-4.86.2-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10017-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
exim4
Debian:12
before 4.72-1
4.72-1
exim4
Debian:13
before 4.72-1
4.72-1
exim4
Debian:14
before 4.72-1
4.72-1
exim
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
before 4.86.2-2.2
4.86.2-2.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-2024 is a medium vulnerability (CVSS 4.4) in Exim, published June 7, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in exim4 4.72-1.

References

Show 26 moreShow less
MoveEnter Open