BLOG
At a glance
- Ubuntu patched CVE-2019-19920 in SA-Exim on Ubuntu Bionic.
- The flaw could allow arbitrary code execution if an attacker can write SpamAssassin configuration or rule files.
- The fixed package is sa-exim 4.2.1-16ubuntu0.1~esm1 in the esm-apps pocket.
- Prioritize updates on Bionic systems matching the stated file-write condition.
Ubuntu Bionic patches arbitrary code execution flaw in SA-Exim
Ubuntu has patched CVE-2019-19920 in SA-Exim on Ubuntu Bionic. The flaw could allow arbitrary code execution when an attacker can write SpamAssassin configuration or rule files; the fixed package is available in the esm-apps pocket.
In this article
Ubuntu published an advisory for CVE-2019-19920 in SA-Exim on Ubuntu Bionic. The fix is available in the esm-apps pocket; administrators should check the package version and service status before updating. View Ubuntu advisory USN-9086-1.
Overview and technical details
SA-Exim integrates Exim with SpamAssassin to process spam. Ubuntu reports that SA-Exim does not safely evaluate parameters of SpamAssassin greylisting rules.
| Field | Details |
|---|---|
| Product | SA-Exim |
| Vulnerability | CVE-2019-19920 |
| Source | Ubuntu USN-9086-1 |
Affected systems
| Product | Affected version | Fixed version |
|---|---|---|
| Ubuntu Bionic, sa-exim package | Versions earlier than 4.2.1-16ubuntu0.1~esm1 | 4.2.1-16ubuntu0.1~esm1 in the esm-apps pocket |
Mechanism and impact
An attacker who can write SpamAssassin configuration or rule files could exploit unsafe handling of greylisting parameters to execute arbitrary code. The ability to write these files is a relevant condition when prioritizing updates.
System checks
Check the installed sa-exim version. The comparison command returns success if the installed version is earlier than the fixed version.
dpkg-query -W -f='${Version}\n' sa-exim dpkg --compare-versions "$(dpkg-query -W -f='${Version}' sa-exim)" lt 4.2.1-16ubuntu0.1~esm1Check Ubuntu Pro status to confirm access to the esm-apps pocket.
pro status
Remediation and mitigation
Perform a standard system update to apply the necessary changes. The fixed sa-exim version for Ubuntu Bionic is
4.2.1-16ubuntu0.1~esm1in theesm-appspocket.Prioritize updates on systems where untrusted users can write SpamAssassin configuration or rule files.
References
Related articles
Ubuntu Linux kernel for NVIDIA Tegra: check systems and apply security updates
Ubuntu USN-9091-1 warns of multiple vulnerabilities in the Linux kernel for NVIDIA Tegra. The supplied record gives no affected branches or fixed packages. Check installed kernels and packages, then consult the Ubuntu notice for the applicable update.
Linux Kernel CVE-2026-99284: Local Privilege Escalation to Root and the Required Fix
Zero Day Initiative warns of CVE-2026-99284 in Linux Kernel: a low-privileged user able to execute code locally could escalate to root. Identify running kernel versions and update to a Linux release containing the fix.
Linux Kernel: BPF Local Storage race condition may enable privilege escalation
ZDI-26-1007 describes a race condition in Linux Kernel BPF Local Storage. A local attacker needs high-privileged code execution; successful exploitation may enable privilege escalation and arbitrary code execution in the kernel context. Check the kernel version and apply the vendor update.
