CVE-2019-10149

exim

Published 5 Jun 2019 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 10 Jan 2022, with a remediation deadline of 10 Jul 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

References

lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html · Mailing List, Third Party Advisory
packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html · Exploit, Third Party Advisory, VDB Entry
seclists.org/fulldisclosure/2019/Jun/16 · Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2019/06/05/2 · Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2019/06/05/3 · Mailing List, Patch, Third Party Advisory
www.openwall.com/lists/oss-security/2019/06/05/4 · Exploit, Mailing List
www.openwall.com/lists/oss-security/2019/06/06/1 · Exploit, Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2019/07/25/6 · Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2019/07/25/7 · Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2019/07/26/4 · Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2021/05/04/7 · Mailing List, Third Party Advisory
www.securityfocus.com/bid/108679 · Broken Link, Third Party Advisory, VDB Entry
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149 · Issue Tracking, Third Party Advisory
seclists.org/bugtraq/2019/Jun/5 · Mailing List, Third Party Advisory
security.gentoo.org/glsa/201906-01 · Third Party Advisory
usn.ubuntu.com/4010-1/ · Third Party Advisory
www.debian.org/security/2019/dsa-4456 · Third Party Advisory
www.exim.org/static/doc/security/CVE-2019-10149.txt · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10149 · US Government Resource