2019-07-25 22:15:11 2019-09-07 04:15:10

Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).

Vector

NETWORK

Complexity

LOW

Authentication

NONE

Confidentiality

COMPLETE

Integrity

COMPLETE

Availability

COMPLETE
Exim Exim 4.91 Rc4 (not an official CPE) Exim Exim 4.91 Rc3 (not an official CPE) Exim Exim 4.91 Rc2 (not an official CPE) Exim Exim 4.91 Rc1 (not an official CPE) Exim Exim 4.91 - (not an official CPE) Exim Exim 4.91 (not an official CPE) Exim Exim 4.90.1 (not an official CPE) Exim Exim 4.90.0.27 (not an official CPE) Exim Exim 4.90.0.22 (not an official CPE) Exim Exim 4.90 Rc4 (not an official CPE) Exim Exim 4.90 Rc3 (not an official CPE) Exim Exim 4.90 Rc2 (not an official CPE) Exim Exim 4.90 Rc1 (not an official CPE) Exim Exim 4.90 - (not an official CPE) Exim Exim 4.89.1 (not an official CPE) Exim Exim 4.89 Rc7 (not an official CPE) Exim Exim 4.89 Rc6 (not an official CPE) Exim Exim 4.89 Rc5 (not an official CPE) Exim Exim 4.89 Rc4 (not an official CPE) Exim Exim 4.89 Rc3 (not an official CPE) Exim Exim 4.89 Rc2 (not an official CPE) Exim Exim 4.89 Rc1 (not an official CPE) Exim Exim 4.89 - (not an official CPE) Exim Exim 4.88 Rc6 (not an official CPE) Exim Exim 4.88 Rc5 (not an official CPE) Exim Exim 4.88 Rc4 (not an official CPE) Exim Exim 4.88 Rc3 (not an official CPE) Exim Exim 4.88 Rc2 (not an official CPE) Exim Exim 4.88 Rc1 (not an official CPE) Exim Exim 4.88 - (not an official CPE) Exim Exim 4.87.1 (not an official CPE) Exim Exim 4.87 Rc7 (not an official CPE) Exim Exim 4.87 Rc6 (not an official CPE) Exim Exim 4.87 Rc5 (not an official CPE) Exim Exim 4.87 Rc4 (not an official CPE) Exim Exim 4.87 Rc3 (not an official CPE) Exim Exim 4.87 Rc2 (not an official CPE) Exim Exim 4.87 Rc1 (not an official CPE) Exim Exim 4.87 (not an official CPE) Exim Exim 4.86.1 (not an official CPE) Exim Exim 4.86 Rc5 (not an official CPE) Exim Exim 4.86 Rc4 (not an official CPE) Exim Exim 4.86 Rc3 (not an official CPE) Exim Exim 4.86 Rc2 (not an official CPE) Exim Exim 4.86 Rc1 (not an official CPE) Exim Exim 4.86 - (not an official CPE) Exim Exim 4.85.2 (not an official CPE) Exim Exim 4.85.1 (not an official CPE) Exim Exim 4.85 (not an official CPE) Exim Exim 4.92 - (not an official CPE) Exim Exim 4.92 Rc1 (not an official CPE) Exim Exim 4.92 Rc2 (not an official CPE) Exim Exim 4.92 Rc3 (not an official CPE) Exim Exim 4.92 Rc4 (not an official CPE) Exim Exim 4.92 Rc5 (not an official CPE) Exim Exim 4.92 Rc6 (not an official CPE)