CVE-2019-19920

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.debian.org/946829#24Mailing List, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00006.htmlMailing List, Third Party Advisory
https://marc.info/?l=spamassassin-users&m=157668107325768&w=2Mailing List, Third Party Advisory
https://marc.info/?l=spamassassin-users&m=157668305026635&w=2Mailing List, Third Party Advisory
https://usn.ubuntu.com/4520-1/Third Party Advisory
https://bugs.debian.org/946829#24Mailing List, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00006.htmlMailing List, Third Party Advisory
https://marc.info/?l=spamassassin-users&m=157668107325768&w=2Mailing List, Third Party Advisory
https://marc.info/?l=spamassassin-users&m=157668305026635&w=2Mailing List, Third Party Advisory
https://usn.ubuntu.com/4520-1/Third Party Advisory

Timeline

Published: Dec 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-199217.0runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit CVE-2019-199225.5kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a den CVE-2019-199237.5flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side i CVE-2019-199245.3SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3Windo CVE-2019-199257.5zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.CVE-2019-199267.5multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() cal CVE-2019-199276.0In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and perfor CVE-2019-199297.8An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner before 8.0.1 could cause arbitrary code execution with SYSTEM privileges w CVE-2019-19937.8In register_app of btif_hd.cc, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of priv CVE-2019-199306.5In libIEC61850 1.4.0, MmsValue_newOctetString in mms/iso_mms/common/mms_value.c has an integer signedness error that can lead to an attempte CVE-2019-199318.8In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.CVE-2019-199356.1Froala Editor before 3.2.3 allows XSS.