CVE-2019-15846

critical

Description

Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.

References

http://exim.org/static/doc/security/CVE-2019-15846.txt

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html

http://www.openwall.com/lists/oss-security/2019/09/06/2

http://www.openwall.com/lists/oss-security/2019/09/06/4

http://www.openwall.com/lists/oss-security/2019/09/06/5

http://www.openwall.com/lists/oss-security/2019/09/06/6

http://www.openwall.com/lists/oss-security/2019/09/06/8

http://www.openwall.com/lists/oss-security/2019/09/07/1

http://www.openwall.com/lists/oss-security/2019/09/07/2

http://www.openwall.com/lists/oss-security/2019/09/08/1

http://www.openwall.com/lists/oss-security/2019/09/09/1

https://exim.org/static/doc/security/CVE-2019-15846.txt

https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/

https://lists.fedoraproject.org/archives/list/[email protected]/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/

https://lists.fedoraproject.org/archives/list/[email protected]/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/

https://seclists.org/bugtraq/2019/Sep/13

https://security.gentoo.org/glsa/201909-06

https://usn.ubuntu.com/4124-1/

https://usn.ubuntu.com/4124-2/

https://www.debian.org/security/2019/dsa-4517

https://www.kb.cert.org/vuls/id/672565

https://www.openwall.com/lists/oss-security/2019/09/06/1

Details

Source: MITRE

Published: 2019-09-06

Updated: 2020-08-24

Risk Information

CVSS v2

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL