CVE-2019-15846 - Vulnerability Details

Vendors	Products
Debian	Debian Linux
Exim	Exim

Link	Providers
http://exim.org/static/doc/security/CVE-2019-15846.txt
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html
http://www.openwall.com/lists/oss-security/2019/09/06/2
http://www.openwall.com/lists/oss-security/2019/09/06/4
http://www.openwall.com/lists/oss-security/2019/09/06/5
http://www.openwall.com/lists/oss-security/2019/09/06/6
http://www.openwall.com/lists/oss-security/2019/09/06/8
http://www.openwall.com/lists/oss-security/2019/09/07/1
http://www.openwall.com/lists/oss-security/2019/09/07/2
http://www.openwall.com/lists/oss-security/2019/09/08/1
http://www.openwall.com/lists/oss-security/2019/09/09/1
https://exim.org/static/doc/security/CVE-2019-15846.txt
https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/
https://nvd.nist.gov/vuln/detail/CVE-2019-15846
https://seclists.org/bugtraq/2019/Sep/13
https://security.gentoo.org/glsa/201909-06
https://usn.ubuntu.com/4124-1/
https://usn.ubuntu.com/4124-2/
https://www.cve.org/CVERecord?id=CVE-2019-15846
https://www.debian.org/security/2019/dsa-4517
https://www.kb.cert.org/vuls/id/672565
https://www.openwall.com/lists/oss-security/2019/09/06/1

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-09-26T19:30:05", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://exim.org/static/doc/security/CVE-2019-15846.txt"}, {"tags": ["x_refsource_MISC"], "url": "https://www.openwall.com/lists/oss-security/2019/09/06/1"}, {"name": "[debian-lts-announce] 20190906 [SECURITY] [DLA 1911-1] exim4 security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html"}, {"name": "20190906 [SECURITY] [DSA 4517-1] exim4 security update", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "https://seclists.org/bugtraq/2019/Sep/13"}, {"name": "[oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/2"}, {"name": "DSA-4517", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2019/dsa-4517"}, {"name": "USN-4124-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4124-1/"}, {"name": "VU#672565", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "https://www.kb.cert.org/vuls/id/672565"}, {"name": "[oss-security] 20190906 Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/6"}, {"name": "[oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/4"}, {"name": "[oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/5"}, {"name": "GLSA-201909-06", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201909-06"}, {"name": "[oss-security] 20190906 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/8"}, {"name": "[oss-security] 20190907 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/09/07/1"}, {"name": "[oss-security] 20190906 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/09/07/2"}, {"name": "FEDORA-2019-ae361e20c2", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/"}, {"name": "FEDORA-2019-467fcbb10a", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/"}, {"name": "[oss-security] 20190908 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/09/08/1"}, {"name": "[oss-security] 20190909 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/09/09/1"}, {"name": "openSUSE-SU-2019:2093", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html"}, {"name": "FEDORA-2019-1ed7bbb09c", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/"}, {"name": "USN-4124-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4124-2/"}, {"tags": ["x_refsource_MISC"], "url": "https://exim.org/static/doc/security/CVE-2019-15846.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-15846", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://exim.org/static/doc/security/CVE-2019-15846.txt", "refsource": "MISC", "url": "http://exim.org/static/doc/security/CVE-2019-15846.txt"}, {"name": "https://www.openwall.com/lists/oss-security/2019/09/06/1", "refsource": "MISC", "url": "https://www.openwall.com/lists/oss-security/2019/09/06/1"}, {"name": "[debian-lts-announce] 20190906 [SECURITY] [DLA 1911-1] exim4 security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html"}, {"name": "20190906 [SECURITY] [DSA 4517-1] exim4 security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Sep/13"}, {"name": "[oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/2"}, {"name": "DSA-4517", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4517"}, {"name": "USN-4124-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4124-1/"}, {"name": "VU#672565", "refsource": "CERT-VN", "url": "https://www.kb.cert.org/vuls/id/672565"}, {"name": "[oss-security] 20190906 Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/6"}, {"name": "[oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/4"}, {"name": "[oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/5"}, {"name": "GLSA-201909-06", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201909-06"}, {"name": "[oss-security] 20190906 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/8"}, {"name": "[oss-security] 20190907 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/09/07/1"}, {"name": "[oss-security] 20190906 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/09/07/2"}, {"name": "FEDORA-2019-ae361e20c2", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/"}, {"name": "FEDORA-2019-467fcbb10a", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/"}, {"name": "[oss-security] 20190908 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/09/08/1"}, {"name": "[oss-security] 20190909 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/09/09/1"}, {"name": "openSUSE-SU-2019:2093", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html"}, {"name": "FEDORA-2019-1ed7bbb09c", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/"}, {"name": "USN-4124-2", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4124-2/"}, {"name": "https://exim.org/static/doc/security/CVE-2019-15846.txt", "refsource": "MISC", "url": "https://exim.org/static/doc/security/CVE-2019-15846.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:03:32.314Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://exim.org/static/doc/security/CVE-2019-15846.txt"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.openwall.com/lists/oss-security/2019/09/06/1"}, {"name": "[debian-lts-announce] 20190906 [SECURITY] [DLA 1911-1] exim4 security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html"}, {"name": "20190906 [SECURITY] [DSA 4517-1] exim4 security update", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "https://seclists.org/bugtraq/2019/Sep/13"}, {"name": "[oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/2"}, {"name": "DSA-4517", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2019/dsa-4517"}, {"name": "USN-4124-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4124-1/"}, {"name": "VU#672565", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "https://www.kb.cert.org/vuls/id/672565"}, {"name": "[oss-security] 20190906 Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/6"}, {"name": "[oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/4"}, {"name": "[oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/5"}, {"name": "GLSA-201909-06", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201909-06"}, {"name": "[oss-security] 20190906 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/09/06/8"}, {"name": "[oss-security] 20190907 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/09/07/1"}, {"name": "[oss-security] 20190906 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/09/07/2"}, {"name": "FEDORA-2019-ae361e20c2", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/"}, {"name": "FEDORA-2019-467fcbb10a", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/"}, {"name": "[oss-security] 20190908 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/09/08/1"}, {"name": "[oss-security] 20190909 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/09/09/1"}, {"name": "openSUSE-SU-2019:2093", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html"}, {"name": "FEDORA-2019-1ed7bbb09c", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/"}, {"name": "USN-4124-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4124-2/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://exim.org/static/doc/security/CVE-2019-15846.txt"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-15846", "datePublished": "2019-09-06T10:15:43", "dateReserved": "2019-09-02T00:00:00", "dateUpdated": "2024-08-05T01:03:32.314Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : n/a (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2019-09-26T19:30:05 (string)

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : http://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://www.openwall.com/lists/oss-security/2019/09/06/1 (string)

}

2 : { »

name : [debian-lts-announce] 20190906 [SECURITY] [DLA 1911-1] exim4 security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html (string)

}

3 : { »

name : 20190906 [SECURITY] [DSA 4517-1] exim4 security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_BUGTRAQ (string)

]

url : https://seclists.org/bugtraq/2019/Sep/13 (string)

}

4 : { »

name : [oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/2 (string)

}

5 : { »

name : DSA-4517 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_DEBIAN (string)

]

url : https://www.debian.org/security/2019/dsa-4517 (string)

}

6 : { »

name : USN-4124-1 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_UBUNTU (string)

]

url : https://usn.ubuntu.com/4124-1/ (string)

}

7 : { »

name : VU#672565 (string)

tags : [ »

0 : third-party-advisory (string)

1 : x_refsource_CERT-VN (string)

]

url : https://www.kb.cert.org/vuls/id/672565 (string)

}

8 : { »

name : [oss-security] 20190906 Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/6 (string)

}

9 : { »

name : [oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/4 (string)

}

10 : { »

name : [oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/5 (string)

}

11 : { »

name : GLSA-201909-06 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_GENTOO (string)

]

url : https://security.gentoo.org/glsa/201909-06 (string)

}

12 : { »

name : [oss-security] 20190906 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/8 (string)

}

13 : { »

name : [oss-security] 20190907 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/07/1 (string)

}

14 : { »

name : [oss-security] 20190906 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/07/2 (string)

}

15 : { »

name : FEDORA-2019-ae361e20c2 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_FEDORA (string)

]

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/ (string)

}

16 : { »

name : FEDORA-2019-467fcbb10a (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_FEDORA (string)

]

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/ (string)

}

17 : { »

name : [oss-security] 20190908 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/08/1 (string)

}

18 : { »

name : [oss-security] 20190909 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/09/1 (string)

}

19 : { »

name : openSUSE-SU-2019:2093 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_SUSE (string)

]

url : http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html (string)

}

20 : { »

name : FEDORA-2019-1ed7bbb09c (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_FEDORA (string)

]

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/ (string)

}

21 : { »

name : USN-4124-2 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_UBUNTU (string)

]

url : https://usn.ubuntu.com/4124-2/ (string)

}

22 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cve@mitre.org (string)

ID : CVE-2019-15846 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : n/a (string)

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : http://exim.org/static/doc/security/CVE-2019-15846.txt (string)

refsource : MISC (string)

url : http://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

1 : { »

name : https://www.openwall.com/lists/oss-security/2019/09/06/1 (string)

refsource : MISC (string)

url : https://www.openwall.com/lists/oss-security/2019/09/06/1 (string)

}

2 : { »

name : [debian-lts-announce] 20190906 [SECURITY] [DLA 1911-1] exim4 security update (string)

refsource : MLIST (string)

url : https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html (string)

}

3 : { »

name : 20190906 [SECURITY] [DSA 4517-1] exim4 security update (string)

refsource : BUGTRAQ (string)

url : https://seclists.org/bugtraq/2019/Sep/13 (string)

}

4 : { »

name : [oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/2 (string)

}

5 : { »

name : DSA-4517 (string)

refsource : DEBIAN (string)

url : https://www.debian.org/security/2019/dsa-4517 (string)

}

6 : { »

name : USN-4124-1 (string)

refsource : UBUNTU (string)

url : https://usn.ubuntu.com/4124-1/ (string)

}

7 : { »

name : VU#672565 (string)

refsource : CERT-VN (string)

url : https://www.kb.cert.org/vuls/id/672565 (string)

}

8 : { »

name : [oss-security] 20190906 Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/6 (string)

}

9 : { »

name : [oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/4 (string)

}

10 : { »

name : [oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/5 (string)

}

11 : { »

name : GLSA-201909-06 (string)

refsource : GENTOO (string)

url : https://security.gentoo.org/glsa/201909-06 (string)

}

12 : { »

name : [oss-security] 20190906 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/8 (string)

}

13 : { »

name : [oss-security] 20190907 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2019/09/07/1 (string)

}

14 : { »

name : [oss-security] 20190906 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2019/09/07/2 (string)

}

15 : { »

name : FEDORA-2019-ae361e20c2 (string)

refsource : FEDORA (string)

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/ (string)

}

16 : { »

name : FEDORA-2019-467fcbb10a (string)

refsource : FEDORA (string)

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/ (string)

}

17 : { »

name : [oss-security] 20190908 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2019/09/08/1 (string)

}

18 : { »

name : [oss-security] 20190909 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2019/09/09/1 (string)

}

19 : { »

name : openSUSE-SU-2019:2093 (string)

refsource : SUSE (string)

url : http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html (string)

}

20 : { »

name : FEDORA-2019-1ed7bbb09c (string)

refsource : FEDORA (string)

url : https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/ (string)

}

21 : { »

name : USN-4124-2 (string)

refsource : UBUNTU (string)

url : https://usn.ubuntu.com/4124-2/ (string)

}

22 : { »

name : https://exim.org/static/doc/security/CVE-2019-15846.txt (string)

refsource : MISC (string)

url : https://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T01:03:32.314Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : http://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://www.openwall.com/lists/oss-security/2019/09/06/1 (string)

}

2 : { »

name : [debian-lts-announce] 20190906 [SECURITY] [DLA 1911-1] exim4 security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html (string)

}

3 : { »

name : 20190906 [SECURITY] [DSA 4517-1] exim4 security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_BUGTRAQ (string)

2 : x_transferred (string)

]

url : https://seclists.org/bugtraq/2019/Sep/13 (string)

}

4 : { »

name : [oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/2 (string)

}

5 : { »

name : DSA-4517 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_DEBIAN (string)

2 : x_transferred (string)

]

url : https://www.debian.org/security/2019/dsa-4517 (string)

}

6 : { »

name : USN-4124-1 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_UBUNTU (string)

2 : x_transferred (string)

]

url : https://usn.ubuntu.com/4124-1/ (string)

}

7 : { »

name : VU#672565 (string)

tags : [ »

0 : third-party-advisory (string)

1 : x_refsource_CERT-VN (string)

2 : x_transferred (string)

]

url : https://www.kb.cert.org/vuls/id/672565 (string)

}

8 : { »

name : [oss-security] 20190906 Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/6 (string)

}

9 : { »

name : [oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/4 (string)

}

10 : { »

name : [oss-security] 20190906 Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/5 (string)

}

11 : { »

name : GLSA-201909-06 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_GENTOO (string)

2 : x_transferred (string)

]

url : https://security.gentoo.org/glsa/201909-06 (string)

}

12 : { »

name : [oss-security] 20190906 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/06/8 (string)

}

13 : { »

name : [oss-security] 20190907 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/07/1 (string)

}

14 : { »

name : [oss-security] 20190906 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/07/2 (string)

}

15 : { »

name : FEDORA-2019-ae361e20c2 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_FEDORA (string)

2 : x_transferred (string)

]

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/ (string)

}

16 : { »

name : FEDORA-2019-467fcbb10a (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_FEDORA (string)

2 : x_transferred (string)

]

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/ (string)

}

17 : { »

name : [oss-security] 20190908 Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/08/1 (string)

}

18 : { »

name : [oss-security] 20190909 Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2019/09/09/1 (string)

}

19 : { »

name : openSUSE-SU-2019:2093 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_SUSE (string)

2 : x_transferred (string)

]

url : http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html (string)

}

20 : { »

name : FEDORA-2019-1ed7bbb09c (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_FEDORA (string)

2 : x_transferred (string)

]

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/ (string)

}

21 : { »

name : USN-4124-2 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_UBUNTU (string)

2 : x_transferred (string)

]

url : https://usn.ubuntu.com/4124-2/ (string)

}

22 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

cveId : CVE-2019-15846 (string)

datePublished : 2019-09-06T10:15:43 (string)

dateReserved : 2019-09-02T00:00:00 (string)

dateUpdated : 2024-08-05T01:03:32.314Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*", "matchCriteriaId": "317A4081-5E80-4ECE-945C-5AF6BD9D7E02", "versionEndExcluding": "4.92.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash."}, {"lang": "es", "value": "Exim versiones anteriores a 4.92.2, permite a atacantes remotos ejecutar c\u00f3digo arbitrario como root por medio de una barra invertida al final de una URL."}], "id": "CVE-2019-15846", "lastModified": "2024-11-21T04:29:36.007", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-09-06T11:15:11.620", "references": [{"source": "cve@mitre.org", "tags": ["Mitigation", "Vendor Advisory"], "url": "http://exim.org/static/doc/security/CVE-2019-15846.txt"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/2"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/4"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/5"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/6"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/8"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2019/09/07/1"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2019/09/07/2"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2019/09/08/1"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2019/09/09/1"}, {"source": "cve@mitre.org", "url": "https://exim.org/static/doc/security/CVE-2019-15846.txt"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/bugtraq/2019/Sep/13"}, {"source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/201909-06"}, {"source": "cve@mitre.org", "url": "https://usn.ubuntu.com/4124-1/"}, {"source": "cve@mitre.org", "url": "https://usn.ubuntu.com/4124-2/"}, {"source": "cve@mitre.org", "url": "https://www.debian.org/security/2019/dsa-4517"}, {"source": "cve@mitre.org", "url": "https://www.kb.cert.org/vuls/id/672565"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2019/09/06/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "http://exim.org/static/doc/security/CVE-2019-15846.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2019/09/06/8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2019/09/07/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2019/09/07/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2019/09/08/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2019/09/09/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exim.org/static/doc/security/CVE-2019-15846.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/bugtraq/2019/Sep/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201909-06"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/4124-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/4124-2/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.debian.org/security/2019/dsa-4517"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.kb.cert.org/vuls/id/672565"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2019/09/06/1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 317A4081-5E80-4ECE-945C-5AF6BD9D7E02 (string)

versionEndExcluding : 4.92.2 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* (string)

matchCriteriaId : C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* (string)

matchCriteriaId : DEECE5FC-CACF-4496-A3E7-164736409252 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 07B237A9-69A3-4A9C-9DA0-4E06BD37AE73 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. (string)

}

1 : { »

lang : es (string)

value : Exim versiones anteriores a 4.92.2, permite a atacantes remotos ejecutar código arbitrario como root por medio de una barra invertida al final de una URL. (string)

}

]

id : CVE-2019-15846 (string)

lastModified : 2024-11-21T04:29:36.007 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : HIGH (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : COMPLETE (string)

baseScore : 10 (number)

confidentialityImpact : COMPLETE (string)

integrityImpact : COMPLETE (string)

vectorString : AV:N/AC:L/Au:N/C:C/I:C/A:C (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 10 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2019-09-06T11:15:11.620 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Mitigation (string)

1 : Vendor Advisory (string)

]

url : http://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

1 : { »

source : cve@mitre.org (string)

url : http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html (string)

}

2 : { »

source : cve@mitre.org (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/2 (string)

}

3 : { »

source : cve@mitre.org (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/4 (string)

}

4 : { »

source : cve@mitre.org (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/5 (string)

}

5 : { »

source : cve@mitre.org (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/6 (string)

}

6 : { »

source : cve@mitre.org (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/8 (string)

}

7 : { »

source : cve@mitre.org (string)

url : http://www.openwall.com/lists/oss-security/2019/09/07/1 (string)

}

8 : { »

source : cve@mitre.org (string)

url : http://www.openwall.com/lists/oss-security/2019/09/07/2 (string)

}

9 : { »

source : cve@mitre.org (string)

url : http://www.openwall.com/lists/oss-security/2019/09/08/1 (string)

}

10 : { »

source : cve@mitre.org (string)

url : http://www.openwall.com/lists/oss-security/2019/09/09/1 (string)

}

11 : { »

source : cve@mitre.org (string)

url : https://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

12 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html (string)

}

13 : { »

source : cve@mitre.org (string)

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/ (string)

}

14 : { »

source : cve@mitre.org (string)

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/ (string)

}

15 : { »

source : cve@mitre.org (string)

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/ (string)

}

16 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : https://seclists.org/bugtraq/2019/Sep/13 (string)

}

17 : { »

source : cve@mitre.org (string)

url : https://security.gentoo.org/glsa/201909-06 (string)

}

18 : { »

source : cve@mitre.org (string)

url : https://usn.ubuntu.com/4124-1/ (string)

}

19 : { »

source : cve@mitre.org (string)

url : https://usn.ubuntu.com/4124-2/ (string)

}

20 : { »

source : cve@mitre.org (string)

url : https://www.debian.org/security/2019/dsa-4517 (string)

}

21 : { »

source : cve@mitre.org (string)

url : https://www.kb.cert.org/vuls/id/672565 (string)

}

22 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : https://www.openwall.com/lists/oss-security/2019/09/06/1 (string)

}

23 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mitigation (string)

1 : Vendor Advisory (string)

]

url : http://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

24 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html (string)

}

25 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/2 (string)

}

26 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/4 (string)

}

27 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/5 (string)

}

28 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/6 (string)

}

29 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.openwall.com/lists/oss-security/2019/09/06/8 (string)

}

30 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.openwall.com/lists/oss-security/2019/09/07/1 (string)

}

31 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.openwall.com/lists/oss-security/2019/09/07/2 (string)

}

32 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.openwall.com/lists/oss-security/2019/09/08/1 (string)

}

33 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.openwall.com/lists/oss-security/2019/09/09/1 (string)

}

34 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://exim.org/static/doc/security/CVE-2019-15846.txt (string)

}

35 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html (string)

}

36 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/ (string)

}

37 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/ (string)

}

38 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/ (string)

}

39 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : https://seclists.org/bugtraq/2019/Sep/13 (string)

}

40 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://security.gentoo.org/glsa/201909-06 (string)

}

41 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://usn.ubuntu.com/4124-1/ (string)

}

42 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://usn.ubuntu.com/4124-2/ (string)

}

43 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://www.debian.org/security/2019/dsa-4517 (string)

}

44 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://www.kb.cert.org/vuls/id/672565 (string)

}

45 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : https://www.openwall.com/lists/oss-security/2019/09/06/1 (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"acknowledgement": "Red Hat would like to thank the Exim project for reporting this issue. Upstream acknowledges Qualys and Zerons as the original reporters.", "bugzilla": {"description": "exim: out-of-bounds access in string_interpret_escape() leading to buffer overflow in the SMTP delivery process", "id": "1748397", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1748397"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-119->CWE-787", "details": ["Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.", "An out-of-bounds write flaw was found in exim. The function fails to correctly handle situations when a backslash is the last character of the input string and incorrectly sets the pointer that is supposed to point to the last character of the escape sequence upon function exit. That leads to out-of-bounds read when the caller attempts to process the input string following the escape sequence. Additionally, this may lead to out-of-bounds write when unescaped string is written (to the same or different buffer)."], "name": "CVE-2019-15846", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "impact": "moderate", "package_name": "exim", "product_name": "Red Hat Enterprise Linux 5"}], "public_date": "2019-09-06T10:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-15846\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-15846\nhttps://exim.org/static/doc/security/CVE-2019-15846.txt"], "statement": "The flaw in the string_interpret_escape() function exists in the versions of Exim as shipped with Red Hat Enterprise Linux 5. However, it is not exposed to untrusted inputs and therefore it can not be exploited to achieve remote code execution. Refer to Red Hat Bugzilla bug 1748397 for further technical details: https://bugzilla.redhat.com/show_bug.cgi?id=1748397#c6\nExim mail server is not shipped with Red Hat Enterprise Linux 6, 7, and 8.", "threat_severity": "Critical"}

{

acknowledgement : Red Hat would like to thank the Exim project for reporting this issue. Upstream acknowledges Qualys and Zerons as the original reporters. (string)

bugzilla : { »

description : exim: out-of-bounds access in string_interpret_escape() leading to buffer overflow in the SMTP delivery process (string)

id : 1748397 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=1748397 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 9.8 (string)

cvss3_scoring_vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

status : draft (string)

}

cwe : CWE-119->CWE-787 (string)

details : [ »

0 : Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. (string)

1 : An out-of-bounds write flaw was found in exim. The function fails to correctly handle situations when a backslash is the last character of the input string and incorrectly sets the pointer that is supposed to point to the last character of the escape sequence upon function exit. That leads to out-of-bounds read when the caller attempts to process the input string following the escape sequence. Additionally, this may lead to out-of-bounds write when unescaped string is written (to the same or different buffer). (string)

]

name : CVE-2019-15846 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:5 (string)

fix_state : Will not fix (string)

impact : moderate (string)

package_name : exim (string)

product_name : Red Hat Enterprise Linux 5 (string)

}

]

public_date : 2019-09-06T10:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2019-15846 https://nvd.nist.gov/vuln/detail/CVE-2019-15846 https://exim.org/static/doc/security/CVE-2019-15846.txt (string)

]

statement : The flaw in the string_interpret_escape() function exists in the versions of Exim as shipped with Red Hat Enterprise Linux 5. However, it is not exposed to untrusted inputs and therefore it can not be exploited to achieve remote code execution. Refer to Red Hat Bugzilla bug 1748397 for further technical details: https://bugzilla.redhat.com/show_bug.cgi?id=1748397#c6 Exim mail server is not shipped with Red Hat Enterprise Linux 6, 7, and 8. (string)

threat_severity : Critical (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object