by Kastro
Paper/Archive/CVE-2019-10149

CVE-2019-10149

exim exim — Exim Mail Transfer Agent (MTA) Improper Input Validation

KEV · due 10 JulEPSS 100%public exploitSSVC actCVSS 9.0
critical.is priorityof 100
97
CVSS 9.0 (CNA)9.0 / 10 × 3027.0In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

Affected

ProductAffectedFixed inSource
exim4.92–CNA

Scores by source

redhat (CNA)9.0CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refopenwall.com/lists/oss-security/2019/06/05/2advisoryusn.ubuntu.com/4010-1refopenwall.com/lists/oss-security/2019/06/05/3refopenwall.com/lists/oss-security/2019/06/05/4advisorydebian.org/security/2019/dsa-4456refseclists.org/bugtraq/2019/Jun/5advisorysecurity.gentoo.org/glsa/201906-01refopenwall.com/lists/oss-security/2019/06/06/1refsecurityfocus.com/bid/108679advisorylists.opensuse.org/opensuse-security-announce/2019-06/msg00020.htmlrefseclists.org/fulldisclosure/2019/Jun/16refopenwall.com/lists/oss-security/2019/07/25/6refopenwall.com/lists/oss-security/2019/07/25/7refopenwall.com/lists/oss-security/2019/07/26/4refopenwall.com/lists/oss-security/2021/05/04/7refbugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149refexim.org/static/doc/security/CVE-2019-10149.txtrefpacketstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.htmlrefpacketstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.htmlrefpacketstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10149kevcisa.gov/known-exploited-vulnerabilities-catalog