Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 4 Jun 2019 15:25:34 +0200
From: Solar Designer <>
Subject: Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit

On Mon, Jun 03, 2019 at 10:19:23PM +0200, Heiko Schlittermann wrote:
> CVE-2019-10149 Exim 4.87 to 4.91
> ================================
> We received a report of a possible remote exploit.  Currently there is no
> evidenice of an active use of this exploit.
> A patch exists already, is being tested, and backported to all
> versions we released since (and including) 4.87.
> The severity depends on your configuration.  It depends on how close to
> the standard configuration your Exim runtime configuration is. The
> closer the better.
> Exim 4.92 is not vulnerable.

I guess I wasn't the only one wondering how revealing this is, so:

$ diff -urwx doc exim-4.91 exim-4.92 | diffstat -s
 131 files changed, 6898 insertions(+), 4395 deletions(-)
$ diff -urwx doc exim-4.91 exim-4.92 | wc
  27635  114347  935620

exim-4.92/doc/ChangeLog lists tens of changes.

Exim 4.92 appears to have been released in February, when the security
issue referred to here was not yet known as such, so this wasn't a
deliberate decision to release the fix publicly yet keep it unmentioned.

Keeping the issue in this semi-public state for 7 days feels weird to
me, but given the above it doesn't look too unrealistic that the issue
won't be rediscovered during this time period.  (The risk of leaks is
probably higher.)  It'd be curious if someone ends up discovering a
different and yet unknown security issue by reading that diff. ;-)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.