CVE-2019-10149
- State
- Published
- Severity
- 9.0 Critical
- Published
- Jun 5, 2019
- Updated
- Oct 21, 2025
- Reserved
- Mar 27, 2019
Description
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.0 Critical | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
eximexim |
|
References
- [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploitmailing-list
- USN-4010-1vendor-advisory
- [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploitmailing-list
- [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploitmailing-list
- DSA-4456vendor-advisory
- 20190605 [SECURITY] [DSA 4456-1] exim4 security updatemailing-list
- GLSA-201906-01vendor-advisory
- [oss-security] 20190606 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploitmailing-list
- 108679vdb-entry
- openSUSE-SU-2019:1524vendor-advisory
- 20190611 The Return of the WIZard: RCE in Exim (CVE-2019-10149)mailing-list
- [oss-security] 20190725 Re: Statistics for distros lists updated for 2019Q2mailing-list
- [oss-security] 20190725 Re: Statistics for distros lists updated for 2019Q2mailing-list
- [oss-security] 20190726 Re: Statistics for distros lists updated for 2019Q2mailing-list
- [oss-security] 20210504 21Nails: Multiple vulnerabilities in Eximmailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149
- https://www.exim.org/static/doc/security/CVE-2019-10149.txt
- http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10149government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.