CVE-2022-37452
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host...
9.8 CriticalFix available
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
3.77%Up 2.7 points since Aug 8, 2022
What each source reports
NVD Score used
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- Record
CVE-2022-37452- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- Record
CVE-2022-37452- Updated
- 2026-11-02
EUVDEUVD-2022-40078 No score
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- Record
EUVD-2022-40078- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2xwx-3gmg-f9vj
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host...
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- Record
GHSA-2xwx-3gmg-f9vj- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-37452
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- Record
DEBIAN-CVE-2022-37452- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-37452
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- Record
UBUNTU-CVE-2022-37452- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVCLSA-2022-1660759272 No score
Fixed CVEs in exim: CVE-2022-37451, CVE-2022-37452
- CVE-2022-37452: fix heap-based buffer overflow for the alias list in host_name_lookup()
- CVE-2022-37451: fix invalid free in pam_converse()
- Record
CLSA-2022-1660759272- Updated
- 2026-11-02
OSVCLSA-2022-1660761670 No score
Fixed CVEs in exim: CVE-2022-37451, CVE-2022-37452
- CVE-2022-37452: fix heap-based buffer overflow for the alias list in host_name_lookup()
- CVE-2022-37451: fix invalid free in pam_converse()
- Record
CLSA-2022-1660761670- Updated
- 2026-11-02
OSVCLSA-2022-1661173443 No score
Fix CVE(s): CVE-2022-37452, CVE-2022-37451
- SECURITY UPDATE: exim heap overflow in host_name_lookup()
- debian/patches/CVE-2022-37452.patch: fix host_name_lookup
- CVE-2022-37452
- SECURITY UPDATE: invalid free in pam_converse in auths/call_pam.c
- debian/patches/CVE-2022-37451.patch: fix PAM auth
- CVE-2022-37451
- Record
CLSA-2022-1661173443- Updated
- 2026-11-02
OSVCLSA-2023-1689259028 No score
Fix CVE(s): CVE-2022-37452, CVE-2022-32546, CVE-2023-34151
- SECURITY UPDATE: undefined behaviors of casting double to size_t in
svg, mvg and other coders (recurring bugs of CVE-2022-32546)
- debian/patches/CVE-2023-34151.patch: properly cast double to size_t
- CVE-2022-37452
- Record
CLSA-2023-1689259028- Updated
- 2026-11-02
OSV No score
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- Record
CVE-2022-37452- Updated
- 2026-11-02
OSVUSN-5574-1 No score
exim4 vulnerability
It was discovered that Exim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
- Record
USN-5574-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
eximTuxCare:OracleLinux:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
exim-greylistTuxCare:OracleLinux:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
exim-monTuxCare:OracleLinux:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
exim-mysqlTuxCare:OracleLinux:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
exim-pgsqlTuxCare:OracleLinux:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
eximTuxCare:CentOS:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
exim-greylistTuxCare:CentOS:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
exim-monTuxCare:CentOS:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
exim-mysqlTuxCare:CentOS:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
exim-pgsqlTuxCare:CentOS:6 |
before 4.92.3-3.el6.tuxcare.els2 | 4.92.3-3.el6.tuxcare.els2 |
Show 47 moreShow less
| Package | Affected | Fixed |
|---|---|---|
exim4TuxCare:Ubuntu:16.04 |
before 4.86.2-2ubuntu2.6+tuxcare.els2 | 4.86.2-2ubuntu2.6+tuxcare.els2 |
exim4-baseTuxCare:Ubuntu:16.04 |
before 4.86.2-2ubuntu2.6+tuxcare.els2 | 4.86.2-2ubuntu2.6+tuxcare.els2 |
exim4-configTuxCare:Ubuntu:16.04 |
before 4.86.2-2ubuntu2.6+tuxcare.els2 | 4.86.2-2ubuntu2.6+tuxcare.els2 |
exim4-daemon-heavyTuxCare:Ubuntu:16.04 |
before 4.86.2-2ubuntu2.6+tuxcare.els2 | 4.86.2-2ubuntu2.6+tuxcare.els2 |
exim4-daemon-lightTuxCare:Ubuntu:16.04 |
before 4.86.2-2ubuntu2.6+tuxcare.els2 | 4.86.2-2ubuntu2.6+tuxcare.els2 |
exim4-devTuxCare:Ubuntu:16.04 |
before 4.86.2-2ubuntu2.6+tuxcare.els2 | 4.86.2-2ubuntu2.6+tuxcare.els2 |
eximon4TuxCare:Ubuntu:16.04 |
before 4.86.2-2ubuntu2.6+tuxcare.els2 | 4.86.2-2ubuntu2.6+tuxcare.els2 |
imagemagickTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
imagemagick-6-commonTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
imagemagick-6-docTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
imagemagick-6.q16TuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
imagemagick-6.q16hdriTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
imagemagick-commonTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
imagemagick-docTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libimage-magick-perlTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libimage-magick-q16-perlTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libimage-magick-q16hdri-perlTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagick++-6-headersTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagick++-6.q16-7TuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagick++-6.q16-devTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagick++-6.q16hdri-7TuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagick++-6.q16hdri-devTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagick++-devTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickcore-6-arch-configTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickcore-6-headersTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickcore-6.q16-3TuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickcore-6.q16-3-extraTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickcore-6.q16-devTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickcore-6.q16hdri-3TuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickcore-6.q16hdri-3-extraTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickcore-6.q16hdri-devTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickcore-devTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickwand-6-headersTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickwand-6.q16-3TuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickwand-6.q16-devTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickwand-6.q16hdri-3TuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickwand-6.q16hdri-devTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
libmagickwand-devTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
perlmagickTuxCare:Ubuntu:18.04 |
before 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 | 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els1 |
exim4Debian:12 |
before 4.94.2-5 | 4.94.2-5 |
exim4Debian:13 |
before 4.94.2-5 | 4.94.2-5 |
exim4Debian:14 |
before 4.94.2-5 | 4.94.2-5 |
exim4Debian:10 |
before 4.92-8+deb10u7, plus listed versions 4.92-84.92-8+deb10u14.92-8+deb10u1~bpo9+14.92-8+deb10u24.92-8+deb10u2~bpo9+1 Show 5 moreShow less4.92-8+deb10u34.92-8+deb10u3~bpo9+14.92-8+deb10u44.92-8+deb10u54.92-8+deb10u6 |
4.92-8+deb10u7 |
exim4Ubuntu:Pro:14.04:LTS |
before 4.82-3ubuntu2.4+esm4, plus listed versions 4.80-7ubuntu34.80-7ubuntu44.80-9ubuntu14.80-9ubuntu24.82-3ubuntu1 Show 8 moreShow less4.82-3ubuntu24.82-3ubuntu2.14.82-3ubuntu2.24.82-3ubuntu2.34.82-3ubuntu2.44.82-3ubuntu2.4+esm14.82-3ubuntu2.4+esm24.82-3ubuntu2.4+esm3 |
4.82-3ubuntu2.4+esm4 |
exim4Ubuntu:Pro:16.04:LTS |
before 4.86.2-2ubuntu2.6+esm2, plus listed versions 4.86-3ubuntu14.86-7ubuntu14.86-7ubuntu24.86-7ubuntu34.86.2-2ubuntu1 Show 8 moreShow less4.86.2-2ubuntu24.86.2-2ubuntu2.14.86.2-2ubuntu2.24.86.2-2ubuntu2.34.86.2-2ubuntu2.44.86.2-2ubuntu2.54.86.2-2ubuntu2.64.86.2-2ubuntu2.6+esm1 |
4.86.2-2ubuntu2.6+esm2 |
exim4Ubuntu:18.04:LTS |
before 4.90.1-1ubuntu1.9, plus listed versions 4.89-5ubuntu14.89-9ubuntu14.89-9ubuntu24.89-9ubuntu34.89-9ubuntu4 Show 7 moreShow less4.90.1-1ubuntu14.90.1-1ubuntu1.14.90.1-1ubuntu1.24.90.1-1ubuntu1.34.90.1-1ubuntu1.44.90.1-1ubuntu1.54.90.1-1ubuntu1.8 |
4.90.1-1ubuntu1.9 |
exim4Ubuntu:20.04:LTS |
before 4.93-13ubuntu1.6, plus listed versions 4.92.1-1ubuntu34.92.1-1ubuntu44.93~RC2-1ubuntu14.93-9ubuntu14.93-11ubuntu1 Show 4 moreShow less4.93-12ubuntu14.93-13ubuntu14.93-13ubuntu1.14.93-13ubuntu1.5 |
4.93-13ubuntu1.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-37452 is a critical vulnerability (CVSS 9.8) in Exim, published August 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.77%, the 89th percentile. Fixed in exim 4.92.3-3.el6.tuxcare.els2.
References
github.com/Exim/exim/wiki/EximSecurity
exim.org/static/doc/security
openwall.com/lists/oss-security/2022/08/06/8
Show 12 moreShow less
lists.debian.org/debian-lts-announce/2022/08/msg00014.html
nvd.nist.gov/vuln/detail/CVE-2022-37452
errata.cloudlinux.com/ol6/CLSA-2022-1660759272.html
security-tracker.debian.org/tracker/CVE-2022-37452
ubuntu.com/security/CVE-2022-37452
cve.org/CVERecord?id=CVE-2022-37452