CVE-2019-10149
Fixed in a distro release ExploitedEPSS 100%CVSS 9.0
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Products: exim
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | exim4 | 4.92~RC3-1 |
| Debian 13 | exim4 | 4.92~RC3-1 |
| Debian 14 | exim4 | 4.92~RC3-1 |
| Debian 9 | exim4 | 4.89-2+deb9u4 |
| SUSE Package Hub 15 SP1 | exim | 4.94.2-bp151.2.4.1 |
| SUSE Package Hub 15 SP1 | libspf2 | 1.2.10-bp151.4.1 |
| Ubuntu 18.04 LTS | exim4 | 4.90.1-1ubuntu1.2 |
| openSUSE Leap 15.0 | exim | 4.88-lp151.4.3.1 |
| openSUSE Leap 15.1 | exim | 4.88-lp151.4.3.1 |
| openSUSE Tumbleweed | exim | 4.94.2-4.2 |