# CVE-2019-10149: exim4: A flaw was found in Exim versions 4.87 to 4.91 (inclusive)

CVE-2019-10149 is fixed in 6 products on 1 platform, first by exim4 4.90.1-1ubuntu1.2, released June 3, 2019. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on January 10, 2022. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/cve/CVE-2019-10149
- Priority: Patch now
- CVSS: n/a (Medium)
- EPSS: 0.9996
- CISA KEV: listed Jan 10, 2022, federal due date Jul 10, 2022
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 3, 2019

## Description

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | exim4 Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | [exim4 4.90.1-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-4.90.1-1ubuntu1.2.md) | Jun 3, 2019 |
| Linux | exim4-base Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | [exim4-base 4.90.1-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-base-4.90.1-1ubuntu1.2.md) | Jun 3, 2019 |
| Linux | exim4-config Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | [exim4-config 4.90.1-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-config-4.90.1-1ubuntu1.2.md) | Jun 3, 2019 |
| Linux | exim4-daemon-heavy Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | [exim4-daemon-heavy 4.90.1-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-daemon-heavy-4.90.1-1ubuntu1.2.md) | Jun 3, 2019 |
| Linux | exim4-daemon-light Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | [exim4-daemon-light 4.90.1-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-exim4-daemon-light-4.90.1-1ubuntu1.2.md) | Jun 3, 2019 |
| Linux | eximon4 Ubuntu 18.04.6 LTS (bionic) | 4.90.1-1ubuntu1.2 | [eximon4 4.90.1-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-eximon4-4.90.1-1ubuntu1.2.md) | Jun 3, 2019 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo