Every CVE Search/ Get API key

CVE-2022-37451

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is...

7.5 HighFix available

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.29%Up 2.2 points since Aug 7, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

Record
CVE-2022-37451
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-763
Updated
2026-11-02
CVE List No score

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

Record
CVE-2022-37451
Updated
2026-11-02
EUVDEUVD-2022-40077 No score

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

Record
EUVD-2022-40077
Updated
2026-11-03
GitHub AdvisoriesGHSA-968g-c3p8-6hvf 7.5

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is...

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

Record
GHSA-968g-c3p8-6hvf
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-763
Updated
2026-11-02
OSVDEBIAN-CVE-2022-37451 7.5

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

Record
DEBIAN-CVE-2022-37451
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2022-37451 7.5

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

Record
UBUNTU-CVE-2022-37451
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVCLSA-2022-1660759272 No score

Fixed CVEs in exim: CVE-2022-37451, CVE-2022-37452

  • CVE-2022-37452: fix heap-based buffer overflow for the alias list in host_name_lookup()
  • CVE-2022-37451: fix invalid free in pam_converse()
Record
CLSA-2022-1660759272
Updated
2026-11-02
OSVCLSA-2022-1660761670 No score

Fixed CVEs in exim: CVE-2022-37451, CVE-2022-37452

  • CVE-2022-37452: fix heap-based buffer overflow for the alias list in host_name_lookup()
  • CVE-2022-37451: fix invalid free in pam_converse()
Record
CLSA-2022-1660761670
Updated
2026-11-02
OSVCLSA-2022-1661173443 No score

Fix CVE(s): CVE-2022-37452, CVE-2022-37451

  • SECURITY UPDATE: exim heap overflow in host_name_lookup()
    • debian/patches/CVE-2022-37452.patch: fix host_name_lookup
    • CVE-2022-37452
  • SECURITY UPDATE: invalid free in pam_converse in auths/call_pam.c
    • debian/patches/CVE-2022-37451.patch: fix PAM auth
    • CVE-2022-37451
Record
CLSA-2022-1661173443
Updated
2026-11-02
OSVCLSA-2022-1661445415 No score

Fixed CVE-2022-37451 in exim

  • CVE-2022-37451: fix invalid free in pam_converse()
Record
CLSA-2022-1661445415
Updated
2026-11-02
OSVCLSA-2022-1661445629 No score

Fixed CVE-2022-37451 in exim

  • CVE-2022-37451: fix invalid free in pam_converse()
Record
CLSA-2022-1661445629
Updated
2026-11-02
OSV No score

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.

Record
CVE-2022-37451
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
exim
TuxCare:OracleLinux:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
exim-greylist
TuxCare:OracleLinux:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
exim-mon
TuxCare:OracleLinux:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
exim-mysql
TuxCare:OracleLinux:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
exim-pgsql
TuxCare:OracleLinux:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
exim
TuxCare:CentOS:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
exim-greylist
TuxCare:CentOS:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
exim-mon
TuxCare:CentOS:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
exim-mysql
TuxCare:CentOS:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
exim-pgsql
TuxCare:CentOS:6
 before 4.92.3-3.el6.tuxcare.els2
4.92.3-3.el6.tuxcare.els2
Show 20 moreShow less
Affected packages
PackageAffectedFixed
exim4
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els2
4.86.2-2ubuntu2.6+tuxcare.els2
exim4-base
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els2
4.86.2-2ubuntu2.6+tuxcare.els2
exim4-config
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els2
4.86.2-2ubuntu2.6+tuxcare.els2
exim4-daemon-heavy
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els2
4.86.2-2ubuntu2.6+tuxcare.els2
exim4-daemon-light
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els2
4.86.2-2ubuntu2.6+tuxcare.els2
exim4-dev
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els2
4.86.2-2ubuntu2.6+tuxcare.els2
eximon4
TuxCare:Ubuntu:16.04
 before 4.86.2-2ubuntu2.6+tuxcare.els2
4.86.2-2ubuntu2.6+tuxcare.els2
exim
TuxCare:CentOS:8.5
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim-greylist
TuxCare:CentOS:8.5
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim-mon
TuxCare:CentOS:8.5
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim-mysql
TuxCare:CentOS:8.5
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim-pgsql
TuxCare:CentOS:8.5
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim
TuxCare:CentOS:8.4
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim-greylist
TuxCare:CentOS:8.4
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim-mon
TuxCare:CentOS:8.4
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim-mysql
TuxCare:CentOS:8.4
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim-pgsql
TuxCare:CentOS:8.4
 before 4.95-1.el8.tuxcare.els1
4.95-1.el8.tuxcare.els1
exim4
Debian:12
 before 4.95-4
4.95-4
exim4
Debian:13
 before 4.95-4
4.95-4
exim4
Debian:14
 before 4.95-4
4.95-4

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-37451 is a high vulnerability (CVSS 7.5) in Exim, published August 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.29%, the 88th percentile. Fixed in exim 4.92.3-3.el6.tuxcare.els2.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open