Vulnerability-Lookup

ubuntu-cve-2016-1531

Vulnerability from osv_ubuntu

Published

2016-03-02 00:00

Modified

2026-04-22 07:37

Summary

Details

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Severity

7.0 (High)


                    
                      CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1531	REPORT
	https://lists.exim.org/lurker/message/20160302.19…	REPORT
	https://ubuntu.com/security/notices/USN-2933-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1531	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "exim4",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "exim4-base",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "exim4-config",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "exim4-daemon-heavy",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "exim4-daemon-light",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "eximon4",
            "binary_version": "4.82-3ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "exim4",
        "purl": "pkg:deb/ubuntu/exim4@4.82-3ubuntu2.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.82-3ubuntu2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.80-7ubuntu3",
        "4.80-7ubuntu4",
        "4.80-9ubuntu1",
        "4.80-9ubuntu2",
        "4.82-3ubuntu1",
        "4.82-3ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.",
  "id": "UBUNTU-CVE-2016-1531",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-03-02T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1531"
    },
    {
      "type": "REPORT",
      "url": "https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2933-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1531"
    }
  ],
  "related": [
    "USN-2933-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1531"
  ]
}

CVE-2016-1531 (GCVE-0-2016-1531)

Vulnerability from cvelistv5 – Published: 2016-04-07 23:00 – Updated: 2024-08-05 23:02

Summary

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Severity

No CVSS data available.

CWE

Assigner

certcc

References

10 references

URL	Tags
http://www.debian.org/security/2016/dsa-3517	vendor-advisoryx_refsource_DEBIAN
https://www.exploit-db.com/exploits/39535/	exploitx_refsource_EXPLOIT-DB
http://www.securitytracker.com/id/1035512	vdb-entryx_refsource_SECTRACK
http://packetstormsecurity.com/files/136124/Exim-…	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://www.exploit-db.com/exploits/39702/	exploitx_refsource_EXPLOIT-DB
http://www.ubuntu.com/usn/USN-2933-1	vendor-advisoryx_refsource_UBUNTU
http://www.exim.org/static/doc/CVE-2016-1531.txt	x_refsource_CONFIRM
http://www.rapid7.com/db/modules/exploit/unix/loc…	x_refsource_MISC
https://www.exploit-db.com/exploits/39549/	exploitx_refsource_EXPLOIT-DB

Date Public

2016-03-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:02:11.867Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3517",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3517"
          },
          {
            "name": "39535",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/39535/"
          },
          {
            "name": "1035512",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035512"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html"
          },
          {
            "name": "openSUSE-SU-2016:0721",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00026.html"
          },
          {
            "name": "39702",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/39702/"
          },
          {
            "name": "USN-2933-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2933-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.exim.org/static/doc/CVE-2016-1531.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup"
          },
          {
            "name": "39549",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/39549/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-03-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-07T09:57:01.000Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "name": "DSA-3517",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3517"
        },
        {
          "name": "39535",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/39535/"
        },
        {
          "name": "1035512",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1035512"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html"
        },
        {
          "name": "openSUSE-SU-2016:0721",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00026.html"
        },
        {
          "name": "39702",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/39702/"
        },
        {
          "name": "USN-2933-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2933-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.exim.org/static/doc/CVE-2016-1531.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup"
        },
        {
          "name": "39549",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/39549/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2016-1531",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-3517",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3517"
            },
            {
              "name": "39535",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/39535/"
            },
            {
              "name": "1035512",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1035512"
            },
            {
              "name": "http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html"
            },
            {
              "name": "openSUSE-SU-2016:0721",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00026.html"
            },
            {
              "name": "39702",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/39702/"
            },
            {
              "name": "USN-2933-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2933-1"
            },
            {
              "name": "http://www.exim.org/static/doc/CVE-2016-1531.txt",
              "refsource": "CONFIRM",
              "url": "http://www.exim.org/static/doc/CVE-2016-1531.txt"
            },
            {
              "name": "http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup",
              "refsource": "MISC",
              "url": "http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup"
            },
            {
              "name": "39549",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/39549/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2016-1531",
    "datePublished": "2016-04-07T23:00:00.000Z",
    "dateReserved": "2016-01-07T00:00:00.000Z",
    "dateUpdated": "2024-08-05T23:02:11.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-2933-1

Vulnerability from osv_ubuntu

Published

2016-03-15 12:28

Modified

2026-04-22 07:36

Summary

exim4 vulnerabilities

Details

It was discovered that Exim incorrectly filtered environment variables when used with the perl_startup configuration option. If the perl_startup option was enabled, a local attacker could use this issue to escalate their privileges to the root user. This issue has been fixed by having Exim clean the complete execution environment by default on startup, including any subprocesses such as transports that call other programs. This change in behaviour may break existing installations and can be adjusted by using two new configuration options, keep_environment and add_environment. (CVE-2016-1531)

Patrick William discovered that Exim incorrectly expanded mathematical comparisons twice. A local attacker could possibly use this issue to perform arbitrary file operations as the Exim user. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2972)

References

URL

Type

	https://ubuntu.com/security/notices/USN-2933-1	ADVISORY
	https://ubuntu.com/security/CVE-2014-2972	REPORT
	https://ubuntu.com/security/CVE-2016-1531	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2014-2972",
              "severity": [
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1531",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "exim4",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "exim4-base",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "exim4-config",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "exim4-daemon-heavy",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "exim4-daemon-light",
            "binary_version": "4.82-3ubuntu2.1"
          },
          {
            "binary_name": "eximon4",
            "binary_version": "4.82-3ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "exim4",
        "purl": "pkg:deb/ubuntu/exim4@4.82-3ubuntu2.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.82-3ubuntu2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.80-7ubuntu3",
        "4.80-7ubuntu4",
        "4.80-9ubuntu1",
        "4.80-9ubuntu2",
        "4.82-3ubuntu1",
        "4.82-3ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Exim incorrectly filtered environment variables when\nused with the perl_startup configuration option. If the perl_startup option\nwas enabled, a local attacker could use this issue to escalate their\nprivileges to the root user. This issue has been fixed by having Exim clean\nthe complete execution environment by default on startup, including any\nsubprocesses such as transports that call other programs. This change in\nbehaviour may break existing installations and can be adjusted by using two\nnew configuration options, keep_environment and add_environment.\n(CVE-2016-1531)\n\nPatrick William discovered that Exim incorrectly expanded mathematical\ncomparisons twice. A local attacker could possibly use this issue to\nperform arbitrary file operations as the Exim user. This issue only\naffected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2972)\n",
  "id": "USN-2933-1",
  "modified": "2026-04-22T07:36:33Z",
  "published": "2016-03-15T12:28:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2933-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-2972"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1531"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "exim4 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2014-2972",
    "UBUNTU-CVE-2016-1531"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2016-1531

Vulnerability from osv_ubuntu

CVE-2016-1531 (GCVE-0-2016-1531)

usn-2933-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature