CVE-2023-42119 Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability

What is CVE-2023-42119?

CVE-2023-42119 is a low-severity vulnerability in Exim Exim, published on 3 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. . Was ZDI-CAN-17643.

Weakness: CWE-125

Which versions are affected by CVE-2023-42119?

It affects 1 product.

Products include Exim Exim.

How do I fix CVE-2023-42119?

Apply the vendor's patch.

Is CVE-2023-42119 being exploited?

There is no known exploitation of CVE-2023-42119 in the wild and no public exploit code.

Other vulnerabilities in Exim Exim

• CVE-2026-45185 Use after free in Exim Critical 9.8
• CVE-2023-42115 Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability Critical 9.8
• CVE-2020-28017 Integer overflow in n/a Critical 9.8
• CVE-2020-28018 Use after free in n/a Critical 9.8
• CVE-2020-28020 Integer overflow in n/a Critical 9.8

All Exim Exim vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2025-DX69052, CLSA-2023-1699468134, DEBIAN-CVE-2023-42119, GHSA-hpcw-47wp-rc8h, UBUNTU-CVE-2023-42119.