CVE-2019-16928

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.

References

Affected packages

Git / github.com/exim/exim

Affected ranges

Type

GIT

Repo

https://github.com/exim/exim

Events

Introduced

ae63862ba6f6ee0c17ec865cc6cf0eebb3ca2389

Last affected

2600301ba6dbac5c9d640c87007a07ee6dcea1f4

Database specific

{
    "versions": [
        {
            "introduced": "4.92"
        },
        {
            "last_affected": "4.92.2"
        }
    ]
}

Affected versions

exim-4.*

exim-4.92

exim-4.92-RC6

exim-4.92-jgh

exim-4.92.1

exim-4.92.1-RC2

exim-4.92.2

exim-4.92.2-RC1

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "19.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "29"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "30"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-16928.json"