Home / mailings

PDF

[USN-9086-1] SA-Exim vulnerability

Posted on 13 November 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-9086-1
November 12, 2026

sa-exim vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS

Summary:

SA-Exim could be made to run programs if it loaded specially crafted
SpamAssassin rules.

Software Description:
- sa-exim: Use SpamAssassin at SMTP time with the Exim v4 MTA

Details:

It was discovered that SA-Exim unsafely evaluated the parameters of its
greylisting SpamAssassin rule. An attacker able to write SpamAssassin
configuration files or rules could possibly use this issue to execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
sa-exim 4.2.1-16ubuntu0.1~esm1
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-9086-1
CVE-2019-19920

--===============5581736854107248980==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP