Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Exim mail server can let attackers run code as root

CVE-2019-13917 · published 7 years ago
Summary

Versions 4.85 through 4.92 of the Exim mail server on Debian can be tricked into running attacker‑controlled commands as the system’s administrator when a special sorting feature is used in the configuration. This only happens in uncommon setups, but it gives an attacker full control of the server. Upgrade to version 4.92.1 or later and review the configuration to remove any use of the ${sort} expansion.

What to do
  • Update debian exim4 to version 4.92-10.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian exim4 < 4.92-10
Fix: upgrade to 4.92-10
Debian:13 debian exim4 < 4.92-10
Fix: upgrade to 4.92-10
Debian:14 debian exim4 < 4.92-10
Fix: upgrade to 4.92-10
– exim exim >= 4.85, <= 4.92
cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
– debian debian_linux 9.0
10.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Original advisory text
Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $...
Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).
References
Severity
9.8 Critical
Exploitation
9% chance of attack within 30 days
Type
CWE-19Data Processing Errors
Timeline
Published25 Jul 2019
Updated19 Oct 2026
First seen21 Sep 2026
Sources
DEBIAN-CVE-2019-13917 · OSV
CVE-2019-13917 · NVD
Track software like this
Free during beta