Description
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| exim | exim | 4.92 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | exim4 | 4.92~RC3-1 | — |
| Debian 13 | exim4 | 4.92~RC3-1 | — |
| Debian 12 | exim4 | 4.92~RC3-1 | — |
| Debian 9 | exim4 | 4.89-2+deb9u4 | DSA-4456-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | exim4 | 4.90.1-1ubuntu1.2 | USN-4010-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | exim | 4.94.2-bp151.2.4.1 | openSUSE-SU-2021:0753-1 |
| SUSE Package Hub 15 SP1 | libspf2 | 1.2.10-bp151.4.1 | openSUSE-SU-2021:0753-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | exim | 4.94.2-4.2 | openSUSE-SU-2024:10746-1 |
| openSUSE Leap 15.1 | exim | 4.88-lp151.4.3.1 | openSUSE-SU-2019:1524-1 |
| openSUSE Leap 15.0 | exim | 4.88-lp151.4.3.1 | openSUSE-SU-2019:1524-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | exim | 4.92-r0 | — |
| Alpine v3.23 | exim | 4.92-r0 | — |
| Alpine v3.22 | exim | 4.92-r0 | — |
| Alpine v3.21 | exim | 4.92-r0 | — |
| Alpine v3.20 | exim | 4.92-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | exim | 4.92-r0 | — |
| Alpine v3.18 | exim | 4.92-r0 | — |
| Alpine v3.17 | exim | 4.92-r0 | — |
| Alpine v3.16 | exim | 4.92-r0 | — |
| Alpine v3.15 | exim | 4.92-r0 | — |
| Alpine v3.14 | exim | 4.92-r0 | — |
| Alpine v3.13 | exim | 4.92-r0 | — |
| Alpine v3.12 | exim | 4.92-r0 | — |
| Alpine v3.11 | exim | 4.92-r0 | — |
| Alpine v3.10 | exim | 4.92-r0 | — |
| Alpine v3.9 | exim | 4.92-r0 | — |
| Alpine v3.8 | exim | 4.91-r2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Exim 4.87 - 4.91 Local Privilege Escalation
exploit/linux/local/exim4_deliver_message_priv_esc
Exploit-DB 3
- Exim 4.87 / 4.91 - Local Privilege Escalation (Metasploit) EDB-47307 · local · Aug 26, 2019 · verified
- Exim 4.87 - 4.91 - Local Privilege Escalation EDB-46996 · local · Jun 17, 2019 · verified
- Exim 4.87 < 4.91 - (Local / Remote) Command Execution EDB-46974 · remote · Jun 5, 2019
GitHub 19 repositories · most starred shown
-
bananaphones/exim-rce-quickfix ★ 22 · Jun 10, 2019
quick fix for CVE-2019-10149, works on Debian\Ubuntu\Centos
-
Diefunction/CVE-2019-10149 ★ 20 · Oct 27, 2019
CVE-2019-10149 : A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execut…
-
MNEMO-CERT/PoC--CVE-2019-10149_Exim ★ 14 · Jun 13, 2019
PoC for CVE-2019-10149, this vulnerability could be xploited betwen 4-87 to 4.91 version of Exim server.
-
cowbe0x004/eximrce-CVE-2019-10149 ★ 14 · Jun 12, 2019
simple python socket connection to test if exim is vulnerable to CVE-2019-10149. The payload simply touch a file in /tmp/eximrce.
-
AzizMea/CVE-2019-10149-privilege-escalation ★ 9 · Jun 27, 2019
CVE-2019-10149 privilege escalation
-
darsigovrustam/CVE-2019-10149 ★ 5 · Oct 21, 2019
Instructions for installing a vulnerable version of Exim and its expluatation
-
Chris-dev1/exim.exp ★ 4 · Sep 5, 2019
CVE-2019-10149
-
Brets0150/StickyExim ★ 3 · Jul 25, 2019
Exim Honey Pot for CVE-2019-10149 exploit attempts.
-
cloudflare/exim-cve-2019-10149-data ★ 2 · Jun 3, 2020
Data Collection Related to Exim CVE-2019-10149
-
aishee/CVE-2019-10149-quick ★ 1 · Jun 14, 2019
Simple Bash shell quick fix CVE-2019-10149
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- USN-4010-1 exim4 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4456-1 exim4 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2019:1524-1 Security update exim SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10746-1 exim-4.94.2-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0753-1 Security update for exim SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit mailing-list
- USN-4010-1 vendor-advisory
- [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit mailing-list
- [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit mailing-list
- DSA-4456 vendor-advisory
- 20190605 [SECURITY] [DSA 4456-1] exim4 security update mailing-list
- GLSA-201906-01 vendor-advisory
- [oss-security] 20190606 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit mailing-list
- 108679 vdb-entry
- openSUSE-SU-2019:1524 vendor-advisory
- 20190611 The Return of the WIZard: RCE in Exim (CVE-2019-10149) mailing-list
- [oss-security] 20190725 Re: Statistics for distros lists updated for 2019Q2 mailing-list
- [oss-security] 20190725 Re: Statistics for distros lists updated for 2019Q2 mailing-list
- [oss-security] 20190726 Re: Statistics for distros lists updated for 2019Q2 mailing-list
- [oss-security] 20210504 21Nails: Multiple vulnerabilities in Exim mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149
- https://www.exim.org/static/doc/security/CVE-2019-10149.txt
- http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html