CVE catalog

CVE-2022-3620

exim4: CVE-2022-3620

Severity: Low
Published: Oct 20, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.98% · Oct 25, 2026

A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	exim4	sid	`4.100.1-4`	fixed
Debian	exim4	forky	`4.100.1-4`	fixed
Debian	exim4	trixie	`4.98.2-1+deb13u4`	fixed
Debian	exim4	trixie-security	`4.98.2-1+deb13u5`	fixed
Debian	exim4	bookworm	`4.96-15+deb12u10`	fixed
Debian	exim4	bookworm-security	`4.96-15+deb12u10`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	exim4	source	sid	`4.96-7`	unimportant	Not reported	[1022556]
Debian	exim4	source	forky	`4.96-7`	unimportant	Not reported	[1022556]
Debian	exim4	source	trixie	`4.96-7`	unimportant	Not reported	[1022556]
Debian	exim4	source	bookworm	`4.96-7`	unimportant	Not reported	[1022556]

[Debian bug #1022556]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[exim4]Unknown
Details (6)
- 4.96-15+deb12u10 · all · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · all · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · all · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · all · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
[exim4-base]Unknown
Source package: [exim4]
Details (6)
- 4.96-15+deb12u10 · amd64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · amd64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
[exim4-config]Unknown
Source package: [exim4]
Details (6)
- 4.96-15+deb12u10 · all · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · all · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · all · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · all · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
[exim4-daemon-heavy]Unknown
Source package: [exim4]
Details (6)
- 4.96-15+deb12u10 · amd64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · amd64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
[exim4-daemon-light]Unknown
Source package: [exim4]
Details (6)
- 4.96-15+deb12u10 · amd64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · amd64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
[exim4-dev]Unknown
Source package: [exim4]
Details (6)
- 4.96-15+deb12u10 · amd64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · amd64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
[eximon4]Unknown
Source package: [exim4]
Details (6)
- 4.96-15+deb12u10 · amd64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.98.2-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · amd64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm
- 4.96-15+deb12u10 · arm64 · bookworm-security
  Fixed · Fixed: 4.96-7
  dsa · exim4 · debian · bookworm

Observed: Oct 23, 2026, 6:28:31 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]