CVE-2023-42118

HIGH Year: 2023
CVSS v3 Score
7.5
High
Weakness Type
CWE-191
View all →

Vulnerability Description

Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.

Related Vulnerabilities

CVE-2004-0816

HIGH
CVSS:7.5(High)

Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote attackers to cause a denial of service (application crash) via a malformed IP packet.

CWE-1912004

CVE-2004-1002

HIGH
CVSS:7.5(High)

Integer underflow in pppd in cbcp.c for ppp 2.4.1 allows remote attackers to cause a denial of service (daemon crash) via a CBCP packet with an invalid length value that causes pppd to access an incor...

CWE-1912004

CVE-2005-1891

HIGH
CVSS:7.5(High)

The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (crash) via a malformed buddy icon that causes an integer underf...

CWE-1912005

CVE-2011-1770

HIGH
CVSS:7.5(High)

Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows remote attackers to cause a denial of service via a Datagram Congestion Control Pr...

CWE-1912011

CVE-2017-14496

HIGH
CVSS:7.5(High)

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service v...

CWE-1912017

CVE-2018-12230

HIGH
CVSS:7.5(High)

An wrong logical check identified in the transferFrom function of a smart contract implementation for RemiCoin (RMC), an Ethereum ERC20 token, allows the attacker to steal tokens or conduct resultant ...

CWE-1912018