CVE-2019-13917

Published: 25 July 2019

Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).

Notes

remote or local code execution as root with non-default configuration

Priority

Medium

CVSS 3 base score: 9.8

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13917
• https://www.exim.org/static/doc/security/CVE-2019-13917.txt
• https://ubuntu.com/security/notices/USN-4075-1
• NVD
• Launchpad
• Debian