CVE-2020-28011: 
Exim vulnerability analysis and mitigation

Exim 4 before 4.94.2 contains a heap-based buffer overflow vulnerability in queue_run function that can be triggered via two sender options: -R and -S. This vulnerability was assigned CVE-2020-28011 and could potentially allow privilege escalation from exim user to root (Exim Advisory, NVD).

The vulnerability exists in the queuerun() function where the heap-based bigbuffer can be overflowed through the -R deliverselectstring and -S deliverselectstring_sender options. The overflow occurs at lines 419 and 423 of the affected code when sprintf() is used without proper bounds checking (Exim Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability could allow an attacker who has already obtained exim user privileges to escalate to root privileges. This represents a significant security risk as it could provide an attacker with complete system control (Exim Advisory).

The vulnerability was fixed in Exim version 4.94.2. Users should upgrade to this version or later to protect against this vulnerability. No other workarounds are documented (NVD).