CVE-2004-0399
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify...
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.
Exploit likelihood
What each source reports
NVD Score used
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.
- Record
CVE-2004-0399- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.
- Record
CVE-2004-0399- Updated
- 2026-11-02
EUVDEUVD-2004-0399 No score
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.
- Record
EUVD-2004-0399- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rf64-vpcw-m8c6 No score
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify...
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.
- Record
GHSA-rf64-vpcw-m8c6- Updated
- 2026-11-02
OSV No score
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.
- Record
CVE-2004-0399- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-0399 No score
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.
- Record
DEBIAN-CVE-2004-0399- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
exim4Debian:12 |
before 4.33-1 | 4.33-1 |
exim4Debian:13 |
before 4.33-1 | 4.33-1 |
exim4Debian:14 |
before 4.33-1 | 4.33-1 |
eximDebian:3.0 From an advisory covering 2 CVEs |
before 3.35-1woody3 | 3.35-1woody3 |
exim-tlsDebian:3.0 From an advisory covering 2 CVEs |
before 3.35-3woody2, plus listed versions 3.35-3woody1 |
3.35-3woody2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Exim Sender 3.35 - Verification Remote Stack Buffer Overrun | 2004-05-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0399 is a high vulnerability (CVSS 7.5) in University Of Cambridge Exim, published May 7, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 20.5%, the 97th percentile. Fixed in exim4 4.33-1.
References
debian.org/security/2004/dsa-502
lists.grok.org.uk/pipermail/full-disclosure/2004-May/021015.html
secunia.com/advisories/11558
exchange.xforce.ibmcloud.com/vulnerabilities/16079
guninski.com/exim1.html
nvd.nist.gov/vuln/detail/CVE-2004-0399
github.com/advisories/GHSA-rf64-vpcw-m8c6
security-tracker.debian.org/tracker/CVE-2004-0399