Live › vulnerability › CVE-2010-4345
Go to dashboardExim, the mail transfer agent, lets a local user who already has the exim account specify an alternate configuration file containing arbitrary commands. An attacker who gets local access can run commands as the exim user and escalate privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Exim Exim | vendor | – | – |
Unknown from the sources.
Apply the vendor update per Exim's instructions; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
This page as .md · .json · in your agent: get_signal("CVE-2010-4345")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.