CVE-2011-1764

Name	CVE-2011-1764
Description	Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2232-1
Debian Bugs	624670

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
exim4 (PTS)	bullseye	4.94.2-7+deb11u3	fixed
	bullseye (security)	4.94.2-7+deb11u4	fixed
	bookworm, bookworm (security)	4.96-15+deb12u7	fixed
	trixie	4.98.2-1	fixed
	forky	4.99-4	fixed
	sid	4.99-6	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
exim4	source	lenny	(not affected)
exim4	source	squeeze	4.72-6+squeeze1		DSA-2232-1
exim4	source	(unstable)	4.75-3	high		624670

[lenny] - exim4 <not-affected> (vulnerable code not present)