CVE-2019-10149

Published: 4 June 2019

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

Priority

CVSS 3 base score: 9.8

Status

Package	Release	Status
exim4 Launchpad, Ubuntu, Debian	bionic	Released (4.90.1-1ubuntu1.2)
	cosmic	Released (4.91-6ubuntu1.1)
	disco	Not vulnerable (4.92-4ubuntu1)
	precise	Does not exist
	trusty	Not vulnerable (4.82-3ubuntu2.4)
	upstream	Needs triage
	xenial	Not vulnerable (4.86.2-2ubuntu2.3)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10149
http://www.exim.org/static/doc/security/CVE-2019-10149.txt
https://ubuntu.com/security/notices/USN-4010-1
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›