CVE-2023-42118 Exim libspf2 Integer Underflow Remote Code Execution Vulnerability
Network-adjacent attackers can execute arbitrary code on Exim mail servers via an integer underflow in libspf2 SPF macro parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-42118?
CVE-2023-42118 is a high-severity vulnerability in Exim libspf2, published on 3 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
Weakness: CWE-191
Which versions are affected by CVE-2023-42118?
It affects 1 product.
Products include Libspf2 Project Libspf2.
How do I fix CVE-2023-42118?
Apply the vendor's patch.
Is CVE-2023-42118 being exploited?
There is no known exploitation of CVE-2023-42118 in the wild and no public exploit code.
Other vulnerabilities in Exim libspf2
Sources
Also known as ALPINE-CVE-2023-42118, DEBIAN-CVE-2023-42118, GHSA-2vq7-8vvf-w66v, OESA-2024-2584, OESA-2024-2585, OESA-2024-2586 and 2 more.