CVE-2016-9963

NameCVE-2016-9963
DescriptionExim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-762-1, DSA-3747-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
exim4 (PTS)buster4.92-8+deb10u6fixed
buster (security)4.92-8+deb10u9fixed
bullseye (security), bullseye4.94.2-7+deb11u2fixed
bookworm, bookworm (security)4.96-15+deb12u4fixed
sid, trixie4.97-8fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
exim4sourcewheezy4.80-7+deb7u4DLA-762-1
exim4sourcejessie4.84.2-2+deb8u2DSA-3747-1
exim4source(unstable)4.88~RC6-2

Notes

https://bugs.exim.org/show_bug.cgi?id=1996
https://www.openwall.com/lists/oss-security/2016/12/16/1
https://exim.org/static/doc/CVE-2016-9963.txt

Search for package or bug name: Reporting problems