# CVE-2020-28014: exim4: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges

CVE-2020-28014 is fixed in 6 products on 1 platform, first by exim4 4.90.1-1ubuntu1.8, released May 4, 2021. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2020-28014
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0094
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 4, 2021

## Description

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | exim4 Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.8 | [exim4 4.90.1-1ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-4.90.1-1ubuntu1.8.md) | May 4, 2021 |
| Linux | exim4 Ubuntu 20.04 LTS (focal) | 4.93-13ubuntu1.5 | [exim4 4.93-13ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-exim4-4.93-13ubuntu1.5.md) | May 4, 2021 |
| Linux | exim4-base Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.8 | [exim4-base 4.90.1-1ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-base-4.90.1-1ubuntu1.8.md) | May 4, 2021 |
| Linux | exim4-base Ubuntu 20.04 LTS (focal) | 4.93-13ubuntu1.5 | [exim4-base 4.93-13ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-exim4-base-4.93-13ubuntu1.5.md) | May 4, 2021 |
| Linux | exim4-config Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.8 | [exim4-config 4.90.1-1ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-config-4.90.1-1ubuntu1.8.md) | May 4, 2021 |
| Linux | exim4-config Ubuntu 20.04 LTS (focal) | 4.93-13ubuntu1.5 | [exim4-config 4.93-13ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-exim4-config-4.93-13ubuntu1.5.md) | May 4, 2021 |
| Linux | exim4-daemon-heavy Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.8 | [exim4-daemon-heavy 4.90.1-1ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-daemon-heavy-4.90.1-1ubuntu1.8.md) | May 4, 2021 |
| Linux | exim4-daemon-heavy Ubuntu 20.04 LTS (focal) | 4.93-13ubuntu1.5 | [exim4-daemon-heavy 4.93-13ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-exim4-daemon-heavy-4.93-13ubuntu1.5.md) | May 4, 2021 |
| Linux | exim4-daemon-light Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.8 | [exim4-daemon-light 4.90.1-1ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-daemon-light-4.90.1-1ubuntu1.8.md) | May 4, 2021 |
| Linux | exim4-daemon-light Ubuntu 20.04 LTS (focal) | 4.93-13ubuntu1.5 | [exim4-daemon-light 4.93-13ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-exim4-daemon-light-4.93-13ubuntu1.5.md) | May 4, 2021 |
| Linux | eximon4 Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.8 | [eximon4 4.90.1-1ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-eximon4-4.90.1-1ubuntu1.8.md) | May 4, 2021 |
| Linux | eximon4 Ubuntu 20.04 LTS (focal) | 4.93-13ubuntu1.5 | [eximon4 4.93-13ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-eximon4-4.93-13ubuntu1.5.md) | May 4, 2021 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo