CVE-2020-12783

NameCVE-2020-12783
DescriptionExim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2213-1, DSA-4687-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
exim4 (PTS)buster4.92-8+deb10u6fixed
buster (security)4.92-8+deb10u9fixed
bullseye (security), bullseye4.94.2-7+deb11u2fixed
bookworm, bookworm (security)4.96-15+deb12u4fixed
trixie4.97-5fixed
sid4.97-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
exim4sourcejessie4.84.2-2+deb8u7DLA-2213-1
exim4sourcestretch4.89-2+deb9u7DSA-4687-1
exim4sourcebuster4.92-8+deb10u4DSA-4687-1
exim4source(unstable)4.93-16

Notes

https://bugs.exim.org/show_bug.cgi?id=2571
https://git.exim.org/exim.git/commitdiff/57aa14b216432be381b6295c312065b2fd034f86
https://git.exim.org/exim.git/commitdiff/a04174dc2a84ae1008c23b6a7109e7fa3fb7b8b0

Search for package or bug name: Reporting problems