Every CVESearch/Get API key

CVE-2011-1407

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to...

7.5 HighFix available

CVE-2011-1407 is a high vulnerability (CVSS 7.5) in Exim, published May 12, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.80%, the 90th percentile. Fixed in exim4 4.76-1.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
3.80%EPSS, 90th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.76-1exim4 +4 more

Description

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.

Exploit likelihood

3.80%Down 2.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
exim4
Debian:12
before 4.76-1
4.76-1
exim4
Debian:13
before 4.76-1
4.76-1
exim4
Debian:14
before 4.76-1
4.76-1
exim4
Debian:6.0
before 4.72-6+squeeze2, plus listed versions
4.72-64.72-6+squeeze14.72-6+squeeze1~bpo50+14.72-6+squeeze2~bpo50+1
4.72-6+squeeze2
exim
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
before 4.86.2-2.2
4.86.2-2.2

What each source reports

NVD Score used7.5

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.

Record
CVE-2011-1407
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.

Record
CVE-2011-1407
Updated
2026-11-02
EUVDEUVD-2011-1414No score

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.

Record
EUVD-2011-1414
Updated
2026-11-03
GitHub AdvisoriesGHSA-pq5j-h89p-xfxjNo score

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to...

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.

Record
GHSA-pq5j-h89p-xfxj
Weakness
CWE-20
Updated
2026-11-02
OSVNo score

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.

Record
CVE-2011-1407
Updated
2026-11-02
OSVDEBIAN-CVE-2011-1407No score

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.

Record
DEBIAN-CVE-2011-1407
Updated
2026-11-02
OSVopenSUSE-SU-2024:10017-1No score

exim-4.86.2-2.2 on GA media

These are all security issues fixed in the exim-4.86.2-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10017-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 13 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open