9.8

CVE-2019-16928

Warnung
Exploit

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exim ≫ Exim Version >= 4.92 <= 4.92.2
Canonical ≫ Ubuntu Linux Version19.04
Debian ≫ Debian Linux Version10.0
Fedoraproject ≫ Fedora Version29
Fedoraproject ≫ Fedora Version30
Fedoraproject ≫ Fedora Version31

03.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Exim Out-of-bounds Write Vulnerability

Schwachstelle

Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 90.59% 0.996
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://www.openwall.com/lists/oss-security/2019/09/28/1
Third Party Advisory
Exploit
Mailing List
Mitigation
http://www.openwall.com/lists/oss-security/2019/09/28/2
Third Party Advisory
Exploit
Mailing List
https://bugs.exim.org/show_bug.cgi?id=2449
Patch
Vendor Advisory
Issue Tracking
https://seclists.org/bugtraq/2019/Sep/60
Third Party Advisory
Mailing List
https://usn.ubuntu.com/4141-1/
Third Party Advisory