Exim · Exim Internet Mailer
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
Exploited in attacks
Critical 9.8 Attack chance: 42%
What it is
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CISA: Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 17, 2022
- Added to the CISA list
- March 3, 2022
- Published
- September 27, 2019
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 42% in the top 1.3% of all known vulnerabilities
- Weakness
- CWE-787
- More details
- NVD · CVE.org · CISA
All references (14)
- https://www.debian.org/security/2019/dsa-4536
- https://usn.ubuntu.com/4141-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3TJW4HPYH3O…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UY6HPRW7MR3K…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EED7HM3MFIBA…
- https://security.gentoo.org/glsa/202003-47
- https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html
- https://bugs.exim.org/show_bug.cgi?id=2449
- https://git.exim.org/exim.git/commit/478effbfd9c3cc5a627fc671d4bf94d13670d65f
- http://www.openwall.com/lists/oss-security/2019/09/28/1
- http://www.openwall.com/lists/oss-security/2019/09/28/2
- http://www.openwall.com/lists/oss-security/2019/09/28/3
- http://www.openwall.com/lists/oss-security/2019/09/28/4
- https://seclists.org/bugtraq/2019/Sep/60
More exploited flaws from Exim
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 25, 2022 | Heap-Based Buffer Overflow | Exim | Critical 9.8 | 72% |
| Mar 25, 2022 | Privilege Escalation | Exim | High 7.8 | 18% |
| Jan 10, 2022 | Improper Input Validation | Mail Transfer Agent (MTA) | Critical 9.0 | >99.9% |
| Nov 3, 2021 | Buffer Overflow | Exim | Critical 9.8 | 82% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.