{
  "fix": "exim4 4.90.1-1ubuntu1.8",
  "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-exim4-4.90.1-1ubuntu1.8",
  "summary": "exim4 4.90.1-1ubuntu1.8, released May 4, 2021, fixes 20 CVEs in exim4. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.",
  "platform": "linux",
  "type": "package",
  "title": "exim4 4.90.1-1ubuntu1.8 for Ubuntu 18.04.6 LTS (bionic)",
  "released": "2021-05-04T06:30:00Z",
  "priority": "Routine",
  "priorityTier": 4,
  "priorityReason": "Closes 20 CVEs, none high severity",
  "supported": false,
  "cveCount": 20,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.61664,
  "appliesTo": [
    {
      "product": "exim4",
      "productUrl": "https://patchblox.com/security/product/linux/exim4",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "4.90.1-1ubuntu1.8",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2020-28019",
      "url": "https://patchblox.com/security/cve/CVE-2020-28019",
      "title": "exim4: Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other conseque...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.61664,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28018",
      "url": "https://patchblox.com/security/cve/CVE-2020-28018",
      "title": "exim4: Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with Ope...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.56475,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28017",
      "url": "https://patchblox.com/security/cve/CVE-2020-28017",
      "title": "exim4: Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with f...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.36649,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28026",
      "url": "https://patchblox.com/security/cve/CVE-2020-28026",
      "title": "exim4: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enab...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.09326,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28020",
      "url": "https://patchblox.com/security/cve/CVE-2020-28020",
      "title": "exim4: Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execut...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.07944,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28024",
      "url": "https://patchblox.com/security/cve/CVE-2020-28024",
      "title": "exim4: Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.04153,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28021",
      "url": "https://patchblox.com/security/cve/CVE-2020-28021",
      "title": "exim4: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.04139,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28022",
      "url": "https://patchblox.com/security/cve/CVE-2020-28022",
      "title": "exim4: Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03017,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28025",
      "url": "https://patchblox.com/security/cve/CVE-2020-28025",
      "title": "exim4: Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship betwe...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02764,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28023",
      "url": "https://patchblox.com/security/cve/CVE-2020-28023",
      "title": "exim4: Exim 4 before 4.94.2 allows Out-of-bounds Read",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02606,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2021-27216",
      "url": "https://patchblox.com/security/cve/CVE-2021-27216",
      "title": "exim4: Exim 4 before 4.94.2 has Execution with Unnecessary Privileges",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00976,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28014",
      "url": "https://patchblox.com/security/cve/CVE-2020-28014",
      "title": "exim4: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0094,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28007",
      "url": "https://patchblox.com/security/cve/CVE-2020-28007",
      "title": "exim4: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0053,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28009",
      "url": "https://patchblox.com/security/cve/CVE-2020-28009",
      "title": "exim4: Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00468,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28010",
      "url": "https://patchblox.com/security/cve/CVE-2020-28010",
      "title": "exim4: Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current work...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00417,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28008",
      "url": "https://patchblox.com/security/cve/CVE-2020-28008",
      "title": "exim4-daemon-heavy: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00407,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28012",
      "url": "https://patchblox.com/security/cve/CVE-2020-28012",
      "title": "exim4-config: Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a pri...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00395,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28011",
      "url": "https://patchblox.com/security/cve/CVE-2020-28011",
      "title": "exim4: Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00393,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28013",
      "url": "https://patchblox.com/security/cve/CVE-2020-28013",
      "title": "exim4: Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles \u0022-F \u0027.(\u0027\u0022 on the command line, and thus...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00393,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2020-28015",
      "url": "https://patchblox.com/security/cve/CVE-2020-28015",
      "title": "exim4: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00376,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-11T19:49:26Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}