High
Security advisory
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-12783
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:30 UTC · Revision 1
Source evidence
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
osv:CVE-2020-12783
Complete source record
{
"id": "ee6f3fc4cd4b40ba930ff460cabf181b3eed4bfca54f461872876d6d83a032b5",
"url": "https://osv.dev/vulnerability/CVE-2020-12783",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-12783",
"summary": "Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.",
"evidence": "osv:CVE-2020-12783",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-12783",
"aliases": [
"CVE-2020-12783"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/exim/exim",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "885bb037cb791e057de2105bb3790c6135914c62"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.93"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"exim-4.93",
"exim-4.93-RC7",
"exim-4.93-RC6",
"exim-4.93-RC5",
"exim-4.93-RC4",
"exim-4.93-RC3",
"exim-4.93-RC2",
"exim-4.93-RC1",
"exim-4.93-RC0",
"exim-4.92-jgh",
"exim-4.92-RC6",
"exim-4.92",
"exim-4.92-RC5",
"exim-4.92-RC4",
"exim-4.92-RC3",
"exim-4.92-RC2",
"exim-4.92-RC1",
"exim-4_91",
"exim-4_91_RC4",
"exim-4_91_RC3",
"exim-4_91_RC2",
"exim-4_91_RC1",
"exim-4_90_RC4",
"exim-4_90",
"exim-4_90_RC3",
"exim-4_90_RC2",
"exim-4_90_RC1",
"exim-4.90devstart",
"exim-4_89_RC3",
"exim-4_89_RC1",
"exim-4_88",
"exim-4_87",
"exim-4_88_RC6",
"exim-4_88_RC5",
"exim-4_88_RC4",
"exim-4_88_RC3",
"exim-4_88_RC2",
"exim-4_88_RC1",
"exim-4_87_RC7",
"exim-4_87_RC6",
"exim-4_87_RC5",
"exim-4_87_RC4",
"exim-4_84",
"exim-4_86",
"exim-4_85",
"exim-4_87_RC3",
"exim-4_87_RC2",
"exim-4_87_RC1",
"exim-4_86_RC5",
"exim-4_86_RC4",
"exim-4_86_RC3",
"exim-4_86_RC2",
"exim-4_86_RC1",
"exim-4_85_RC4",
"exim-4_85_RC3",
"exim-4_85_RC2",
"exim-4_85_RC1",
"exim-4_84_RC2",
"exim-4_84_RC1",
"exim-4_83",
"exim-4_83_RC3",
"exim-4_83_RC2",
"exim-4_83_RC1",
"exim-4_82",
"exim-4_82_RC5",
"exim-4_82_RC4",
"exim-4_82_RC3",
"exim-4_82_RC2",
"exim-4_82_RC1",
"exim-4_80",
"exim-4_80_RC7",
"exim-4_80_RC6",
"exim-4_80_RC5",
"exim-4_80_RC4",
"exim-4_80_RC3",
"exim-4_80_RC2",
"exim-4_80_RC1",
"exim-4_77",
"exim-4_77_RC4",
"exim-4_77_RC3",
"exim-4_77_RC2",
"exim-4_77_RC1",
"exim-4_76",
"exim-4_76_RC2",
"exim-4_76_RC1",
"exim-4_75",
"exim-4_75_RC3",
"exim-4_75_RC2",
"exim-4_75_RC1",
"exim-4_74",
"exim-4_74_RC1",
"exim-4_73",
"exim-4_73_RC1",
"exim-4_73_RC00",
"exim-4_72",
"exim-4_72_RC2",
"exim-4_72_RC1",
"exim-4_71",
"exim-4_70",
"exim-4_70_RC4",
"exim-4_70_RC3",
"DEVEL_PDKIM_START",
"exim-4_69",
"exim-4_68",
"exim-4_67",
"exim-4_66",
"exim-4_65",
"exim-4_64",
"exim-4_63",
"exim-4_62",
"exim-4_61",
"exim-4_54",
"exim-4_53",
"exim-4_52",
"exim-4_51",
"exim-4_50"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12783.json"
}
}
],
"modified": "2026-10-24T10:30:40.504351470Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6IQQ2SERFUD4WMRSX6XYDNK7Q4GPT7Y/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7Z5UG6ZIG32V7M4PP3BCC65C27EWK7G/",
"https://bugs.exim.org/show_bug.cgi?id=2571",
"https://lists.debian.org/debian-lts-announce/2020/05/msg00017.html",
"https://usn.ubuntu.com/4366-1/",
"https://www.debian.org/security/2020/dsa-4687",
"https://git.exim.org/exim.git/commit/57aa14b216432be381b6295c312065b2fd034f86",
"https://git.exim.org/exim.git/commit/a04174dc2a84ae1008c23b6a7109e7fa3fb7b8b0"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "19.10"
},
{
"last_affected": "19.10"
},
{
"introduced": "20.04"
},
{
"last_affected": "20.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "31"
},
{
"last_affected": "31"
},
{
"introduced": "32"
},
{
"last_affected": "32"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-12783",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 434937,
"published_at": "2020-05-11T14:15:11.917+00:00"
}