Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Exim | Exim | 4.85 (including) | 4.92 (including) |
| Exim4 | Ubuntu | bionic | * |
| Exim4 | Ubuntu | devel | * |
| Exim4 | Ubuntu | disco | * |
| Exim4 | Ubuntu | trusty | * |
| Exim4 | Ubuntu | xenial | * |