CVEvulnerability
CVE-2016-1531
7.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-04-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.0 HIGH — CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
Affected configurations
• exim exim (<= 4.86)
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00026.html lists.opensuse.org
- http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html Exploit
- http://www.debian.org/security/2016/dsa-3517 www.debian.org
- http://www.exim.org/static/doc/CVE-2016-1531.txt Third Party Advisory, US Government Resource
- http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup www.rapid7.com
- http://www.securitytracker.com/id/1035512 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2933-1 www.ubuntu.com
- https://www.exploit-db.com/exploits/39535/ Exploit
- https://www.exploit-db.com/exploits/39549/ www.exploit-db.com
- https://www.exploit-db.com/exploits/39702/ www.exploit-db.com
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00026.html lists.opensuse.org
- http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html Exploit
- http://www.debian.org/security/2016/dsa-3517 www.debian.org
- http://www.exim.org/static/doc/CVE-2016-1531.txt Third Party Advisory, US Government Resource
- http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup www.rapid7.com
- http://www.securitytracker.com/id/1035512 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2933-1 www.ubuntu.com
- https://www.exploit-db.com/exploits/39535/ Exploit
- https://www.exploit-db.com/exploits/39549/ www.exploit-db.com
- https://www.exploit-db.com/exploits/39702/ www.exploit-db.com