Exim 4.65
Exim 4.65
The Exim 4.65 reached end of service life on Jan 8, 2007 — Exim no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Exim 4.65 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- exim
- release
- 4.65
- product Label
- Exim
- release Label
- 4.65
- codename
- lts
- latest Version
- 4.65
- release Date
- 2007-01-02
- maintained
- source Url
- https://endoflife.date/exim
Lifecycle Dates
- End of Service Life
- Jan 8, 2007
- Last OEM Support
- Jan 8, 2007
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Exim 4.65 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Exim 4.65?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Exim 4.65 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Exim 4.65 Support: Frequently Asked Questions
Is the Exim 4.65 still supported?
Exim ended support for the Exim 4.65 on Jan 8, 2007 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Exim 4.65 end of service life (EOSL) date?
Exim lists the end of service life for the Exim 4.65 as Jan 8, 2007.
Can I keep using the Exim 4.65 after its EOSL date?
Yes. EOSL means Exim stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Exim 4.65 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Exim 4.65
52 published CVEs affect the Exim 4.65, including 34 rated critical or high severity. Exim no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-42117 | CRITICAL | 9.8 | May 3, 2024 | Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this |
| CVE-2023-42116 | CRITICAL | 9.8 | May 3, 2024 | Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage thi |
| CVE-2023-42115 | CRITICAL | 9.8 | May 3, 2024 | Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability |
| CVE-2022-37452 | CRITICAL | 9.8 | Aug 7, 2022 | Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set. |
| CVE-2020-28026 | CRITICAL | 9.8 | May 6, 2021 | Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root. |
| CVE-2020-28024 | CRITICAL | 9.8 | May 6, 2021 | Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can actually push back non-character error codes such as EOF. |
| CVE-2020-28022 | CRITICAL | 9.8 | May 6, 2021 | Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands. |
| CVE-2020-28020 | CRITICAL | 9.8 | May 6, 2021 | Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction. |
| CVE-2020-28017 | CRITICAL | 9.8 | May 6, 2021 | Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption. |
| CVE-2019-15846 | CRITICAL | 9.8 | Sep 6, 2019 | Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. |
| CVE-2018-6789 | CRITICAL | 9.8 | Feb 8, 2018 | An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely. |
| CVE-2010-4344 | CRITICAL | 9.8 | Dec 14, 2010 | Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging. |
| CVE-2020-28021 | HIGH | 8.8 | May 6, 2021 | Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which indirectly leads to remote code execution as root) via AUTH= in a MAIL FROM command. |
| CVE-2026-66140 | HIGH | 8.4 | Jul 24, 2026 | Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled. |
| CVE-2020-8015 | HIGH | 8.4 | Apr 2, 2020 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1. |
| CVE-2020-28016 | HIGH | 7.8 | May 6, 2021 | Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase. |
| CVE-2020-28015 | HIGH | 7.8 | May 6, 2021 | Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character. |
| CVE-2020-28013 | HIGH | 7.8 | May 6, 2021 | Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy. |
| CVE-2020-28012 | HIGH | 7.8 | May 6, 2021 | Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag. |
| CVE-2020-28011 | HIGH | 7.8 | May 6, 2021 | Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root. |
Showing the 20 most severe of 52 known CVEs.
Get Third Party Support