{"id":"CVE-2024-39929","aliases":["ALPINE-CVE-2024-39929","CLSA-2024-1725550629","DEBIAN-CVE-2024-39929","DSA-5728-1","EUVD-2024-38307","GHSA-7m4v-cwm7-4f2m","OESA-2024-2105","OESA-2024-2129","OESA-2026-1382","UBUNTU-CVE-2024-39929","USN-6939-1","openSUSE-SU-2024:0218-1","openSUSE-SU-2024:14196-1"],"status":"published","title":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can...","description":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.41491,"percentile":0.98698,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-116"],"published":"2024-07-04T00:00:00Z","modified":"2026-11-03T06:32:45Z","exploits":[{"source":"pocgithub","id":"rxerium/CVE-2024-39929","title":"rxerium/CVE-2024-39929","date":"2024-07-12","url":"https://github.com/rxerium/CVE-2024-39929"},{"source":"pocgithub","id":"michael-david-fry/CVE-2024-39929","title":"michael-david-fry/CVE-2024-39929","date":"2024-07-29","url":"https://github.com/michael-david-fry/CVE-2024-39929"}],"fixes":[{"ecosystem":"Alpine:v3.20","package":"exim","fixed_in":["4.98-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"exim","fixed_in":["4.98-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"exim","fixed_in":["4.98-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"exim","fixed_in":["4.98-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"exim","fixed_in":["4.98-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim","fixed_in":["4.97.1-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-greylist","fixed_in":["4.97.1-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-mon","fixed_in":["4.97.1-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-mysql","fixed_in":["4.97.1-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-pgsql","fixed_in":["4.97.1-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"exim-sysvinit","fixed_in":["4.97.1-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"exim4","fixed_in":["4.96-15+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exim4","fixed_in":["4.98~RC3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exim4","fixed_in":["4.98~RC3-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"exim4","fixed_in":["4.94.2-7+deb11u3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"exim","fixed_in":["4.96-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"exim","fixed_in":["4.96-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"exim","fixed_in":["4.97.1-3.oe2403"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","fixed_in":["4.86.2-2ubuntu2.6+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","fixed_in":["4.90.1-1ubuntu1.10+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"exim4","fixed_in":["4.93-13ubuntu1.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exim4","fixed_in":["4.95-4ubuntu2.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exim4","fixed_in":["4.97-4ubuntu4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"exim","fixed_in":["4.97.1-bp155.5.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"exim","fixed_in":["4.97.1-bp155.5.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"exim","fixed_in":["4.98-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-greylist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"exim-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u5"}]}],"versions":["4.96-15","4.96-15+deb12u1","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98~RC3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98~RC3-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.94.2-7+deb11u3"}]}],"versions":["4.94.2-7","4.94.2-7+deb11u1","4.94.2-7+deb11u2"]},{"source":"osv","ecosystem":"Debian:12","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-15+deb12u5"}]}],"versions":["4.96-15","4.96-15+deb12u1","4.96-15+deb12u2","4.96-15+deb12u3","4.96-15+deb12u4"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.96-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-3.oe2403"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+esm8"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+esm5"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.6"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.1"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.86.2-2ubuntu2.6+esm8"}]}],"versions":["4.86-3ubuntu1","4.86-7ubuntu1","4.86-7ubuntu2","4.86-7ubuntu3","4.86.2-2ubuntu1","4.86.2-2ubuntu2","4.86.2-2ubuntu2.1","4.86.2-2ubuntu2.2","4.86.2-2ubuntu2.3","4.86.2-2ubuntu2.4","4.86.2-2ubuntu2.5","4.86.2-2ubuntu2.6","4.86.2-2ubuntu2.6+esm1","4.86.2-2ubuntu2.6+esm2","4.86.2-2ubuntu2.6+esm4","4.86.2-2ubuntu2.6+esm5","4.86.2-2ubuntu2.6+esm6","4.86.2-2ubuntu2.6+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.90.1-1ubuntu1.10+esm5"}]}],"versions":["4.89-5ubuntu1","4.89-9ubuntu1","4.89-9ubuntu2","4.89-9ubuntu3","4.89-9ubuntu4","4.90.1-1ubuntu1","4.90.1-1ubuntu1.1","4.90.1-1ubuntu1.2","4.90.1-1ubuntu1.3","4.90.1-1ubuntu1.4","4.90.1-1ubuntu1.5","4.90.1-1ubuntu1.8","4.90.1-1ubuntu1.9","4.90.1-1ubuntu1.10","4.90.1-1ubuntu1.10+esm1","4.90.1-1ubuntu1.10+esm2","4.90.1-1ubuntu1.10+esm3","4.90.1-1ubuntu1.10+esm4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12"}]}],"versions":["4.92.1-1ubuntu3","4.92.1-1ubuntu4","4.93~RC2-1ubuntu1","4.93-9ubuntu1","4.93-11ubuntu1","4.93-12ubuntu1","4.93-13ubuntu1","4.93-13ubuntu1.1","4.93-13ubuntu1.5","4.93-13ubuntu1.6","4.93-13ubuntu1.7","4.93-13ubuntu1.8","4.93-13ubuntu1.9","4.93-13ubuntu1.10","4.93-13ubuntu1.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.95-4ubuntu2.6"}]}],"versions":["4.94.2-7ubuntu2","4.95-2ubuntu2","4.95-4ubuntu1","4.95-4ubuntu2","4.95-4ubuntu2.1","4.95-4ubuntu2.2","4.95-4ubuntu2.3","4.95-4ubuntu2.4","4.95-4ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exim4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97-4ubuntu4.1"}]}],"versions":["4.96-17ubuntu2","4.96-17ubuntu2.1","4.97-3ubuntu1","4.97-4ubuntu1","4.97-4ubuntu3","4.97-4ubuntu4"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-bp155.5.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.97.1-bp155.5.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"exim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.98-1.1"}]}]}],"products":[{"vendor":"exim","product":"exim"}],"references":[{"url":"https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357","tags":["x_transferred","Patch","web"]},{"url":"https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b","tags":["x_transferred","Patch","web"]},{"url":"https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://www.rfc-editor.org/rfc/rfc2231.txt","tags":["x_transferred","Not Applicable","web","report"]},{"url":"https://bugs.exim.org/show_bug.cgi?id=3099#c4","tags":["x_transferred","Exploit","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39929","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7m4v-cwm7-4f2m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-39929","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1725550629.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39929.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-39929","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2105","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2129","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1382","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-39929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39929","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6939-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3XAMVZ4QHUCDCCXUDIQEZCTUQTZA2P46/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227423","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39929","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-39929","description":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.","status":"published","published":"2024-07-04T00:00:00Z","modified":"2025-03-18T15:37:58.804Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2024-38307","description":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.","status":"published","published":"2024-07-04T00:00:00Z","modified":"2025-03-18T15:37:58Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:00.464245Z"}],"ghsa":[{"id":"GHSA-7m4v-cwm7-4f2m","title":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can...","description":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.","status":"published","published":"2024-07-04T15:30:40Z","modified":"2025-03-18T18:31:46Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:00:20.689988Z"}],"nvd":[{"id":"CVE-2024-39929","description":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.","status":"published","published":"2024-07-04T15:15:10.323Z","modified":"2026-06-17T07:43:02.99Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:10:10.545705Z"}],"osv":[{"id":"ALPINE-CVE-2024-39929","description":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.","status":"published","published":"2024-07-04T15:15:10.323Z","modified":"2026-11-03T06:32:45.467428477Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2024-39929","description":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.","status":"published","published":"2024-07-04T00:00:00Z","modified":"2026-10-28T02:30:51.845110506Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"DEBIAN-CVE-2024-39929","description":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.","status":"published","published":"2024-07-04T15:15:10.323Z","modified":"2026-11-02T12:02:37.878712893Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"OESA-2024-2105","title":"exim security update","description":"Exim is a message transfer agent (MTA) developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal of flexibility in the way mail can be routed, and there are extensive facilities for checking incoming mail. Exim can be installed in place of sendmail, although the configuration of exim is quite different to that of sendmail.\r\n\r\nSecurity Fix(es):\r\n\r\nExim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.(CVE-2024-39929)","status":"published","published":"2024-09-06T11:07:34Z","modified":"2026-08-18T01:17:32.128000301Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2129","title":"exim security update","description":"Exim is a message transfer agent (MTA) developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal of flexibility in the way mail can be routed, and there are extensive facilities for checking incoming mail. Exim can be installed in place of sendmail, although the configuration of exim is quite different to that of sendmail.\r\n\r\nSecurity Fix(es):\r\n\r\nExim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.(CVE-2024-39929)","status":"published","published":"2024-09-14T11:07:36Z","modified":"2026-08-18T01:18:36.940732393Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2026-1382","title":"exim security update","description":"Exim is a message transfer agent (MTA) developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal of flexibility in the way mail can be routed, and there are extensive facilities for checking incoming mail. Exim can be installed in place of sendmail, although the configuration of exim is quite different to that of sendmail.\r\n\r\nSecurity Fix(es):\n\nExim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.(CVE-2024-39929)","status":"published","published":"2026-02-13T11:10:24Z","modified":"2026-08-18T01:19:33.441162684Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"UBUNTU-CVE-2024-39929","description":"Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.","status":"published","published":"2024-07-04T15:15:00Z","modified":"2026-04-22T14:58:32.660383Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"CLSA-2024-1725550629","title":"exim: Fix of CVE-2024-39929","description":"- CVE-2024-39929: fix incorrectly parsing MIME parses filenames that are specified\n  using multiple parameters","status":"published","published":"2024-09-05T15:37:13Z","modified":"2026-06-01T00:33:17.98704813Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"DSA-5728-1","title":"exim4 - security update","status":"published","published":"2024-07-10T00:00:00Z","modified":"2026-03-09T02:09:49.09831Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:0218-1","title":"Security update for exim","description":"This update for exim fixes the following issues:\n\n- CVE-2024-39929: Fixed incorrect parsing of multiline rfc2231 header filename (boo#1227423).\n","status":"published","published":"2024-07-25T09:24:46Z","modified":"2026-02-04T03:20:34.711873Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14196-1","title":"exim-4.98-1.1 on GA media","description":"These are all security issues fixed in the exim-4.98-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-16T00:00:00Z","modified":"2026-02-04T04:06:10.792407Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"USN-6939-1","title":"exim4 vulnerability","description":"Phillip Szelat discovered that Exim misparses multiline MIME header\nfilenames. A remote attacker could use this issue to bypass a MIME filename\nextension-blocking protection mechanism and possibly deliver executable\nattachments to the mailboxes of end users.\n","status":"published","published":"2024-07-31T18:40:26Z","modified":"2026-06-25T13:32:28.791526929Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}