Critical
Security advisory
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-15846
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:20 UTC · Revision 1
Source evidence
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
osv:CVE-2019-15846
Complete source record
{
"id": "be36a5dfe2785901aa5064a9dbfe5c5426257196e28869954998f1b739e32676",
"url": "https://osv.dev/vulnerability/CVE-2019-15846",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-15846",
"summary": "Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.",
"evidence": "osv:CVE-2019-15846",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-15846",
"aliases": [
"CVE-2019-15846"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/exim/exim",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "2600301ba6dbac5c9d640c87007a07ee6dcea1f4"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.92.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"exim-4.92.1-RC2",
"exim-4.92.1",
"exim-4.92-jgh",
"exim-4.92-RC6",
"exim-4.92",
"exim-4.92-RC5",
"exim-4.92-RC4",
"exim-4.92-RC3",
"exim-4.92-RC2",
"exim-4.92-RC1",
"exim-4_91",
"exim-4_91_RC4",
"exim-4_91_RC3",
"exim-4_91_RC2",
"exim-4_91_RC1",
"exim-4_90_RC4",
"exim-4_90",
"exim-4_90_RC3",
"exim-4_90_RC2",
"exim-4_90_RC1",
"exim-4.90devstart",
"exim-4_89_RC3",
"exim-4_89_RC1",
"exim-4_88",
"exim-4_87",
"exim-4_88_RC6",
"exim-4_88_RC5",
"exim-4_88_RC4",
"exim-4_88_RC3",
"exim-4_88_RC2",
"exim-4_88_RC1",
"exim-4_87_RC7",
"exim-4_87_RC6",
"exim-4_87_RC5",
"exim-4_87_RC4",
"exim-4_84",
"exim-4_86",
"exim-4_85",
"exim-4_87_RC3",
"exim-4_87_RC2",
"exim-4_87_RC1",
"exim-4_86_RC5",
"exim-4_86_RC4",
"exim-4_86_RC3",
"exim-4_86_RC2",
"exim-4_86_RC1",
"exim-4_85_RC4",
"exim-4_85_RC3",
"exim-4_85_RC2",
"exim-4_85_RC1",
"exim-4_84_RC2",
"exim-4_84_RC1",
"exim-4_83",
"exim-4_83_RC3",
"exim-4_83_RC2",
"exim-4_83_RC1",
"exim-4_82",
"exim-4_82_RC5",
"exim-4_82_RC4",
"exim-4_82_RC3",
"exim-4_82_RC2",
"exim-4_82_RC1",
"exim-4_80",
"exim-4_80_RC7",
"exim-4_80_RC6",
"exim-4_80_RC5",
"exim-4_80_RC4",
"exim-4_80_RC3",
"exim-4_80_RC2",
"exim-4_80_RC1",
"exim-4_77",
"exim-4_77_RC4",
"exim-4_77_RC3",
"exim-4_77_RC2",
"exim-4_77_RC1",
"exim-4_76",
"exim-4_76_RC2",
"exim-4_76_RC1",
"exim-4_75",
"exim-4_75_RC3",
"exim-4_75_RC2",
"exim-4_75_RC1",
"exim-4_74",
"exim-4_74_RC1",
"exim-4_73",
"exim-4_73_RC1",
"exim-4_73_RC00",
"exim-4_72",
"exim-4_72_RC2",
"exim-4_72_RC1",
"exim-4_71",
"exim-4_70",
"exim-4_70_RC4",
"exim-4_70_RC3",
"DEVEL_PDKIM_START",
"exim-4_69",
"exim-4_68",
"exim-4_67",
"exim-4_66",
"exim-4_65",
"exim-4_64",
"exim-4_63",
"exim-4_62",
"exim-4_61",
"exim-4_54",
"exim-4_53",
"exim-4_52",
"exim-4_51",
"exim-4_50"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15846.json",
"vanir_signatures": [
{
"id": "CVE-2019-15846-6e37a886",
"digest": {
"length": 984,
"function_hash": "256980183646066541984069527665417741673"
},
"source": "https://github.com/exim/exim/commit/2600301ba6dbac5c9d640c87007a07ee6dcea1f4",
"target": {
"file": "src/src/string.c",
"function": "string_interpret_escape"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15846-e3b79d9f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34360093518404896471744733215184192610",
"8719926595473108489439290494720702532",
"296632350261770040420288428843821730810",
"265836692107644544242406332720074567239",
"94320246887392360165331925281492160580",
"204743667807900283044696579217917538959",
"259783621426062242108025744201689104232",
"152000936690205865675864793129865771482",
"226017580920755955615003370344980451181",
"12739408565750634307987649623934564665"
]
},
"source": "https://github.com/exim/exim/commit/2600301ba6dbac5c9d640c87007a07ee6dcea1f4",
"target": {
"file": "src/src/string.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:13:07Z"
}
}
],
"modified": "2026-10-24T14:13:07.731308341Z",
"provider": "osv",
"references": [
"https://exim.org/static/doc/security/CVE-2019-15846.txt",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/",
"https://usn.ubuntu.com/4124-1/",
"https://usn.ubuntu.com/4124-2/",
"https://www.kb.cert.org/vuls/id/672565",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html",
"https://seclists.org/bugtraq/2019/Sep/13",
"https://security.gentoo.org/glsa/201909-06",
"https://www.debian.org/security/2019/dsa-4517",
"https://www.openwall.com/lists/oss-security/2019/09/06/1"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-15846",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443417,
"published_at": "2019-09-06T11:15:11.62+00:00"
}