CVE catalog

CVE-2022-3559

exim4: CVE-2022-3559

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.01% · Oct 25, 2026

A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation leads to use after free. The name of the patch is 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is recommended to apply a patch to fix this issue. The identifier VDB-211073 was assigned to this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianexim4sid4.100.1-4fixed
Debianexim4forky4.100.1-4fixed
Debianexim4trixie4.98.2-1+deb13u4fixed
Debianexim4trixie-security4.98.2-1+deb13u5fixed
Debianexim4bookworm4.96-15+deb12u10fixed
Debianexim4bookworm-security4.96-15+deb12u10fixed
Ubuntuexim418.044.89-5ubuntu1vulnerable
Ubuntuexim418.044.89-9ubuntu1vulnerable
Ubuntuexim418.044.89-9ubuntu2vulnerable
Ubuntuexim418.044.89-9ubuntu3vulnerable
Ubuntuexim418.044.89-9ubuntu4vulnerable
Ubuntuexim418.044.90.1-1ubuntu1vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.1vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.2vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.3vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.4vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.5vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.8vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.9vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.10fixed
Ubuntuexim420.044.92.1-1ubuntu3vulnerable
Ubuntuexim420.044.92.1-1ubuntu4vulnerable
Ubuntuexim420.044.93~RC2-1ubuntu1vulnerable
Ubuntuexim420.044.93-9ubuntu1vulnerable
Ubuntuexim420.044.93-11ubuntu1vulnerable
Ubuntuexim420.044.93-12ubuntu1vulnerable
Ubuntuexim420.044.93-13ubuntu1vulnerable
Ubuntuexim420.044.93-13ubuntu1.1vulnerable
Ubuntuexim420.044.93-13ubuntu1.5vulnerable
Ubuntuexim420.044.93-13ubuntu1.6vulnerable
Ubuntuexim420.044.93-13ubuntu1.7fixed
Ubuntuexim422.044.94.2-7ubuntu2vulnerable
Ubuntuexim422.044.95-2ubuntu2vulnerable
Ubuntuexim422.044.95-4ubuntu1vulnerable
Ubuntuexim422.044.95-4ubuntu2vulnerable
Ubuntuexim422.044.95-4ubuntu2.1vulnerable
Ubuntuexim422.044.95-4ubuntu2.2fixed
Ubuntuexim418.044.89-5ubuntu1vulnerable
Ubuntuexim418.044.89-9ubuntu1vulnerable
Ubuntuexim418.044.89-9ubuntu2vulnerable
Ubuntuexim418.044.89-9ubuntu3vulnerable
Ubuntuexim418.044.89-9ubuntu4vulnerable
Ubuntuexim418.044.90.1-1ubuntu1vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.1vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.2vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.3vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.4vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.5vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.8vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.9vulnerable
Ubuntuexim418.044.90.1-1ubuntu1.10fixed
Ubuntuexim420.044.92.1-1ubuntu3vulnerable
Ubuntuexim420.044.92.1-1ubuntu4vulnerable
Ubuntuexim420.044.93~RC2-1ubuntu1vulnerable
Ubuntuexim420.044.93-9ubuntu1vulnerable
Ubuntuexim420.044.93-11ubuntu1vulnerable
Ubuntuexim420.044.93-12ubuntu1vulnerable
Ubuntuexim420.044.93-13ubuntu1vulnerable
Ubuntuexim420.044.93-13ubuntu1.1vulnerable
Ubuntuexim420.044.93-13ubuntu1.5vulnerable
Ubuntuexim420.044.93-13ubuntu1.6vulnerable
Ubuntuexim420.044.93-13ubuntu1.7fixed
Ubuntuexim422.044.94.2-7ubuntu2vulnerable
Ubuntuexim422.044.95-2ubuntu2vulnerable
Ubuntuexim422.044.95-4ubuntu1vulnerable
Ubuntuexim422.044.95-4ubuntu2vulnerable
Ubuntuexim422.044.95-4ubuntu2.1vulnerable
Ubuntuexim422.044.95-4ubuntu2.2fixed
Opensuseeximtumbleweed4.96-3.1fixed
Suseeximpackage hub 15 sp44.94.2-bp154.2.3.1fixed
Opensuseeximleap 15.44.94.2-bp154.2.3.1fixed
Suseeximpackage hub 15 sp34.94.2-bp153.5.1fixed
Opensuseeximleap 15.34.94.2-bp153.5.1fixed
Suseeximpackage hub 15 sp54.97.1-bp155.5.9.1fixed
Opensuseeximleap 15.54.97.1-bp155.5.9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianexim4sourcesid4.96-4not yet assignedNot reportedNot reported
Debianexim4sourceforky4.96-4not yet assignedNot reportedNot reported
Debianexim4sourcetrixie4.96-4not yet assignedNot reportedNot reported
Debianexim4sourcebookworm4.96-4not yet assignedNot reportedNot reported
Ubuntuexim4deb18.044.90.1-1ubuntu1.10Not reportedUBUNTU-CVE-2022-3559Not reported
Ubuntuexim4deb20.044.93-13ubuntu1.7Not reportedUBUNTU-CVE-2022-3559Not reported
Ubuntuexim4deb22.044.95-4ubuntu2.2Not reportedUBUNTU-CVE-2022-3559Not reported
Ubuntuexim4deb18.044.90.1-1ubuntu1.10Not reportedUSN-5741-1Not reported
Ubuntuexim4deb20.044.93-13ubuntu1.7Not reportedUSN-5741-1Not reported
Ubuntuexim4deb22.044.95-4ubuntu2.2Not reportedUSN-5741-1Not reported
Opensuseeximrpmtumbleweed4.96-3.1Not reportedOPENSUSE-SU-2024:12422-1Not reported
Suseeximrpmpackage hub 15 sp44.94.2-bp154.2.3.1Not reportedOPENSUSE-SU-2022:10168-1Not reported
Opensuseeximrpmleap 15.44.94.2-bp154.2.3.1Not reportedOPENSUSE-SU-2022:10168-1Not reported
Suseeximrpmpackage hub 15 sp34.94.2-bp153.5.1Not reportedOPENSUSE-SU-2022:10191-1Not reported
Opensuseeximrpmleap 15.34.94.2-bp153.5.1Not reportedOPENSUSE-SU-2022:10191-1Not reported
Suseeximrpmpackage hub 15 sp54.97.1-bp155.5.9.1Not reportedOPENSUSE-SU-2024:0007-1Not reported
Opensuseeximrpmleap 15.54.97.1-bp155.5.9.1Not reportedOPENSUSE-SU-2024:0007-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [exim4]Unknown
    Details (6)

    • 4.96-15+deb12u10 · all · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · all · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · all · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · all · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

  • [exim4-base]Unknown

    Source package: [exim4]

    Details (6)

    • 4.96-15+deb12u10 · amd64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · amd64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

  • [exim4-config]Unknown

    Source package: [exim4]

    Details (6)

    • 4.96-15+deb12u10 · all · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · all · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · all · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · all · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

  • [exim4-daemon-heavy]Unknown

    Source package: [exim4]

    Details (6)

    • 4.96-15+deb12u10 · amd64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · amd64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

  • [exim4-daemon-light]Unknown

    Source package: [exim4]

    Details (6)

    • 4.96-15+deb12u10 · amd64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · amd64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

  • [exim4-dev]Unknown

    Source package: [exim4]

    Details (6)

    • 4.96-15+deb12u10 · amd64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · amd64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

  • [eximon4]Unknown

    Source package: [exim4]

    Details (6)

    • 4.96-15+deb12u10 · amd64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.98.2-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · amd64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

    • 4.96-15+deb12u10 · arm64 · bookworm-security

      Fixed · Fixed: 4.96-4

      dsa · exim4 · debian · bookworm

[openSUSE Tumbleweed]

  • [exim]Unknown

    Source package: [exim]

    Details (1)

    • 4.98.2-4.6 · x86_64 · tumbleweed

      Fixed · Fixed: 4.96-3.1

      dsa · exim · opensuse · tumbleweed

  • [eximon]Unknown

    Source package: [exim]

    Details (1)

    • 4.98.2-4.6 · x86_64 · tumbleweed

      Unknown · Fixed: 4.96-3.1

      Version impact unknown

      dsa · exim · opensuse · tumbleweed

  • [eximstats-html]Unknown

    Source package: [exim]

    Details (1)

    • 4.98.2-4.6 · x86_64 · tumbleweed

      Unknown · Fixed: 4.96-3.1

      Version impact unknown

      dsa · exim · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]