CVE-2014-2957
CVE-2014-2957 is a medium-severity vulnerability in Exim with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.
Key facts
- Severity: Medium (CVSS 2.0 base score 6.8)
- EPSS exploit prediction: 5% (92nd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-20
- Affected product: Exim
- Published:
- Last modified:
Description
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
Frequently asked questions
- What is CVE-2014-2957?
- The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
- How severe is CVE-2014-2957?
- CVE-2014-2957 has a CVSS 2.0 base score of 6.8, rated medium severity.
- Is CVE-2014-2957 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-2957?
- CVE-2014-2957 primarily affects Exim. In total, 51 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2014-2957?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2014-2957 published?
- CVE-2014-2957 was published on 2014-09-04 and last updated on 2026-06-17.
References
- http://git.exim.org/exim.git/commitdiff/5b7a7c051c9ab9ee7c924a611f90ef2be03e0ad0
- http://www.openwall.com/lists/oss-security/2021/05/04/7
- https://lists.exim.org/lurker/message/20140528.122536.a31d60a4.en.html
Affected products (51)
- cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.00:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.01:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.02:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.03:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.04:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.05:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.10:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.11:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.12:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.14:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.20:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.21:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.22:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.23:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.24:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.30:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.31:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.32:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.33:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.34:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.40:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.41:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.42:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.43:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.44:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.50:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.51:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.52:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.53:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.54:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.60:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.61:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.62:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.63:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.64:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.65:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.66:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.67:*:*:*:*:*:*:*
- cpe:2.3:a:exim:exim:4.68:*:*:*:*:*:*:*
More vulnerabilities in Exim
- CVE-2026-45185 — Critical (CVSS 9.8): Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing…
- CVE-2023-42117 — Critical (CVSS 9.8): Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote…
- CVE-2023-42116 — Critical (CVSS 9.8): Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote…
- CVE-2023-42115 — Critical (CVSS 9.8): Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
- CVE-2022-37452 — Critical (CVSS 9.8): Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when…
- CVE-2020-28026 — Critical (CVSS 9.8): Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable…
Other CWE-20 (Improper Input Validation) vulnerabilities
- CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
- CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
- CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…
Browse all CWE-20 (Improper Input Validation) vulnerabilities →