9.8

CVE-2019-16928

Warnung
Exploit
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exim ≫ Exim Version >= 4.92 <= 4.92.2
Canonical ≫ Ubuntu Linux Version19.04
Debian ≫ Debian Linux Version10.0
Fedoraproject ≫ Fedora Version29
Fedoraproject ≫ Fedora Version30
Fedoraproject ≫ Fedora Version31

03.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Exim Out-of-bounds Write Vulnerability

Schwachstelle

Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 41.59% 0.985
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://www.openwall.com/lists/oss-security/2019/09/28/1
Third Party Advisory
Exploit
Mailing List
Mitigation
http://www.openwall.com/lists/oss-security/2019/09/28/2
Third Party Advisory
Exploit
Mailing List
http://www.openwall.com/lists/oss-security/2019/09/28/3
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2019/09/28/4
Third Party Advisory
Mailing List
https://bugs.exim.org/show_bug.cgi?id=2449
Patch
Vendor Advisory
Issue Tracking
https://git.exim.org/exim.git/commit/478effbfd9c3cc5a627fc671d4bf94d13670d65f
Patch
https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EED7HM3MFIBAP5OIMJAFJ35JAJABTVSC/
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3TJW4HPYH3O5HZCWGD6NSHTEBTTAPDC/
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UY6HPRW7MR3KBQ5JFHH6OXM7YCZBJCOB/
Release Notes
https://seclists.org/bugtraq/2019/Sep/60
Third Party Advisory
Mailing List
https://security.gentoo.org/glsa/202003-47
Third Party Advisory
https://usn.ubuntu.com/4141-1/
Third Party Advisory
https://www.debian.org/security/2019/dsa-4536
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16928
US Government Resource