Exim 4 prior to 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character.
The Qualys Research Labs reported several vulnerabilities in Exim, a
mail transport agent, which could result in local privilege escalation
and remote code execution
Details can be found in the Qualys advisory at
wwwqualyscom/2021/05/04/21nails/21nailstxt
For the stable distribution (buster), these problems have been fixed in
version 4 ...
Prior versions of Exim 4 have Improper Neutralization of Line Delimiters Local users can alter the behavior of root processes because a recipient address can have a newline character (<a href="nvdnistgov/vuln/detail/CVE%2D2020-28015">CVE-2020-28015</a>)
Prior versions of Exim 4 allowed Integer Overflow to Buffer Overflow in ...
Vulmon