CVE-2019-13917

Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).

• CWE-19

• http://exim.org/static/doc/security/CVE-2019-13917.txtPatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/07/26/5Third Party Advisory
• https://seclists.org/bugtraq/2019/Jul/51Third Party Advisory
• https://security.gentoo.org/glsa/201909-06
• https://www.debian.org/security/2019/dsa-4488Third Party Advisory
• http://exim.org/static/doc/security/CVE-2019-13917.txtPatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/07/26/5Third Party Advisory
• https://seclists.org/bugtraq/2019/Jul/51Third Party Advisory
• https://security.gentoo.org/glsa/201909-06
• https://www.debian.org/security/2019/dsa-4488Third Party Advisory

Published

Jul 25, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1388An elevation of privilege vulnerability exists in the Window…7.8
• CVE-2019-1389A remote code execution vulnerability exists when Windows Hy…8.4
• CVE-2019-1390A remote code execution vulnerability exists in the way that…7.5
• CVE-2019-1391A denial of service vulnerability exists when Windows improp…5.5
• CVE-2019-13915b3log Wide before 1.6.0 allows three types of attacks to acc…
• CVE-2019-13916An issue was discovered in Cypress (formerly Broadcom) WICED…8.8
• CVE-2019-13918A vulnerability has been identified in SINEMA Remote Connect…9.8
• CVE-2019-13919A vulnerability has been identified in SINEMA Remote Connect…4.3
• CVE-2019-1392An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2019-13920A vulnerability has been identified in SINEMA Remote Connect…4.3
• CVE-2019-13921A vulnerability has been identified in SIMATIC WinAC RTX (F)…7.5
• CVE-2019-13922A vulnerability has been identified in SINEMA Remote Connect…2.7