CVE-2010-2023: transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does...

Security readout for executives and security teams

This Exim issue affects local mail delivery when a world-writable sticky-bit mail directory is used. A local user could abuse hard links so Exim mishandles another user’s mailbox file, causing denial of service or possibly privilege escalation. It is mainly a risk on shared Unix-like systems running Exim before 4.72. Exposure is most likely on legacy systems running Exim before 4.72 with local users and world-writable sticky-bit mail directories used for mailbox delivery. Modern vendor-maintained packages are less likely to remain exposed, but old appliances, shared hosting, and unmanaged mail servers should be checked. Prioritize remediation for shared systems, hosting platforms, and servers with local users. For single-purpose mail gateways without local users and with current vendor packages, urgency is lower. Because the issue can cross local user boundaries, legacy Exim estates should still be cleaned up deliberately. Mitigation focus: Upgrade Exim to 4.72 or a vendor-supported fixed package.; Review vendor advisories from your distribution for backported fixes.; Avoid vulnerable world-writable sticky-bit mailbox directory configurations where possible..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.