Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
2011-10-05T02:56:24.707
2025-04-11T00:51:21.963
Deferred
CVSSv2: 7.5 (HIGH)
AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | exim | exim | ≤ 4.75 | Yes |
| Application | exim | exim | 2.10 | Yes |
| Application | exim | exim | 2.11 | Yes |
| Application | exim | exim | 2.12 | Yes |
| Application | exim | exim | 3.00 | Yes |
| Application | exim | exim | 3.01 | Yes |
| Application | exim | exim | 3.02 | Yes |
| Application | exim | exim | 3.03 | Yes |
| Application | exim | exim | 3.10 | Yes |
| Application | exim | exim | 3.11 | Yes |
| Application | exim | exim | 3.12 | Yes |
| Application | exim | exim | 3.13 | Yes |
| Application | exim | exim | 3.14 | Yes |
| Application | exim | exim | 3.15 | Yes |
| Application | exim | exim | 3.16 | Yes |
| Application | exim | exim | 3.20 | Yes |
| Application | exim | exim | 3.21 | Yes |
| Application | exim | exim | 3.22 | Yes |
| Application | exim | exim | 3.30 | Yes |
| Application | exim | exim | 3.31 | Yes |
| Application | exim | exim | 3.32 | Yes |
| Application | exim | exim | 3.33 | Yes |
| Application | exim | exim | 3.34 | Yes |
| Application | exim | exim | 3.35 | Yes |
| Application | exim | exim | 3.36 | Yes |
| Application | exim | exim | 4.00 | Yes |
| Application | exim | exim | 4.01 | Yes |
| Application | exim | exim | 4.02 | Yes |
| Application | exim | exim | 4.03 | Yes |
| Application | exim | exim | 4.04 | Yes |
| Application | exim | exim | 4.05 | Yes |
| Application | exim | exim | 4.10 | Yes |
| Application | exim | exim | 4.11 | Yes |
| Application | exim | exim | 4.12 | Yes |
| Application | exim | exim | 4.14 | Yes |
| Application | exim | exim | 4.20 | Yes |
| Application | exim | exim | 4.21 | Yes |
| Application | exim | exim | 4.22 | Yes |
| Application | exim | exim | 4.23 | Yes |
| Application | exim | exim | 4.24 | Yes |
| Application | exim | exim | 4.30 | Yes |
| Application | exim | exim | 4.31 | Yes |
| Application | exim | exim | 4.32 | Yes |
| Application | exim | exim | 4.33 | Yes |
| Application | exim | exim | 4.34 | Yes |
| Application | exim | exim | 4.40 | Yes |
| Application | exim | exim | 4.41 | Yes |
| Application | exim | exim | 4.42 | Yes |
| Application | exim | exim | 4.43 | Yes |
| Application | exim | exim | 4.44 | Yes |
| Application | exim | exim | 4.50 | Yes |
| Application | exim | exim | 4.51 | Yes |
| Application | exim | exim | 4.52 | Yes |
| Application | exim | exim | 4.53 | Yes |
| Application | exim | exim | 4.54 | Yes |
| Application | exim | exim | 4.60 | Yes |
| Application | exim | exim | 4.61 | Yes |
| Application | exim | exim | 4.62 | Yes |
| Application | exim | exim | 4.63 | Yes |
| Application | exim | exim | 4.64 | Yes |
| Application | exim | exim | 4.65 | Yes |
| Application | exim | exim | 4.66 | Yes |
| Application | exim | exim | 4.67 | Yes |
| Application | exim | exim | 4.68 | Yes |
| Application | exim | exim | 4.69 | Yes |
| Application | exim | exim | 4.70 | Yes |
| Application | exim | exim | 4.71 | Yes |
| Application | exim | exim | 4.72 | Yes |
| Application | exim | exim | 4.73 | Yes |
| Application | exim | exim | 4.74 | Yes |