In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of skipping.
Weakness
The code does not function according to its published specifications, potentially leading to incorrect usage.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Exim | Exim | * | 4.99.2 (excluding) |
| Exim4 | Ubuntu | devel | * |
| Exim4 | Ubuntu | esm-infra-legacy/trusty | * |
| Exim4 | Ubuntu | esm-infra-legacy/xenial | * |
| Exim4 | Ubuntu | esm-infra/bionic | * |
| Exim4 | Ubuntu | esm-infra/focal | * |
| Exim4 | Ubuntu | esm-infra/xenial | * |
| Exim4 | Ubuntu | jammy | * |
| Exim4 | Ubuntu | noble | * |
| Exim4 | Ubuntu | questing | * |
| Exim4 | Ubuntu | resolute | * |
| Exim4 | Ubuntu | upstream | * |