CVE-2019-16928criticalunder attackCWE-787

CVE-2019-16928

Published · Updated

Follow this CVE+ Monitor Exim Internet Mailer+ Monitor exim4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 42%
from disclosure to weapon
Published on NVDSep 27
CISA KEV+888d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2022-03-17

Apply updates per vendor instructions.

In short

Exim email server versions 4.92 to 4.92.2 have a critical flaw where a specially crafted EHLO command can crash the server or let attackers run harmful code remotely. This happens because the server doesn't properly check the size of incoming data.

Technical detail

A heap-based buffer overflow exists in the string_vformat function within string.c when processing overly long EHLO commands during SMTP protocol negotiation. An unauthenticated remote attacker can trigger memory corruption without requiring prior authentication, resulting in arbitrary code execution with the privileges of the Exim process.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a