{"id":"UBUNTU-CVE-2019-18862","details":"maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.","modified":"2026-05-20T16:03:46.707223704Z","published":"2019-11-11T16:15:00Z","upstream":["CVE-2019-18862"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-18862"},{"type":"REPORT","url":"https://git.savannah.gnu.org/cgit/mailutils.git/tree/NEWS"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2019-18862"}],"affected":[{"package":{"name":"mailutils","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/mailutils?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.99.98-1","1:2.99.98-1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libmailutils4","binary_version":"1:2.99.98-1.1"},{"binary_name":"mailutils","binary_version":"1:2.99.98-1.1"},{"binary_name":"mailutils-common","binary_version":"1:2.99.98-1.1"},{"binary_name":"mailutils-comsatd","binary_version":"1:2.99.98-1.1"},{"binary_name":"mailutils-guile","binary_version":"1:2.99.98-1.1"},{"binary_name":"mailutils-imap4d","binary_version":"1:2.99.98-1.1"},{"binary_name":"mailutils-mh","binary_version":"1:2.99.98-1.1"},{"binary_name":"mailutils-pop3d","binary_version":"1:2.99.98-1.1"},{"binary_name":"python-mailutils","binary_version":"1:2.99.98-1.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-18862.json"}},{"package":{"name":"mailutils","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/mailutils?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.99.98-2build2","1:2.99.99-1ubuntu1","1:2.99.99-1ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"libmailutils4","binary_version":"1:2.99.99-1ubuntu2"},{"binary_name":"mailutils","binary_version":"1:2.99.99-1ubuntu2"},{"binary_version":"1:2.99.99-1ubuntu2","binary_name":"mailutils-common"},{"binary_version":"1:2.99.99-1ubuntu2","binary_name":"mailutils-comsatd"},{"binary_name":"mailutils-guile","binary_version":"1:2.99.99-1ubuntu2"},{"binary_name":"mailutils-imap4d","binary_version":"1:2.99.99-1ubuntu2"},{"binary_version":"1:2.99.99-1ubuntu2","binary_name":"mailutils-mh"},{"binary_version":"1:2.99.99-1ubuntu2","binary_name":"mailutils-pop3d"},{"binary_name":"python-mailutils","binary_version":"1:2.99.99-1ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-18862.json"}},{"package":{"name":"mailutils","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/mailutils?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.1.1-1","1:3.3-1","1:3.4-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libmailutils5","binary_version":"1:3.4-1"},{"binary_name":"mailutils","binary_version":"1:3.4-1"},{"binary_name":"mailutils-common","binary_version":"1:3.4-1"},{"binary_name":"mailutils-comsatd","binary_version":"1:3.4-1"},{"binary_version":"1:3.4-1","binary_name":"mailutils-guile"},{"binary_name":"mailutils-imap4d","binary_version":"1:3.4-1"},{"binary_version":"1:3.4-1","binary_name":"mailutils-mh"},{"binary_name":"mailutils-pop3d","binary_version":"1:3.4-1"},{"binary_name":"python-mailutils","binary_version":"1:3.4-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-18862.json"}},{"package":{"name":"mailutils","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/mailutils?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.6-1build1","1:3.7-1","1:3.7-2","1:3.7-2ubuntu1","1:3.7-2.1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:3.7-2.1","binary_name":"libmailutils6"},{"binary_version":"1:3.7-2.1","binary_name":"mailutils"},{"binary_version":"1:3.7-2.1","binary_name":"mailutils-common"},{"binary_version":"1:3.7-2.1","binary_name":"mailutils-comsatd"},{"binary_name":"mailutils-guile","binary_version":"1:3.7-2.1"},{"binary_name":"mailutils-imap4d","binary_version":"1:3.7-2.1"},{"binary_version":"1:3.7-2.1","binary_name":"mailutils-mh"},{"binary_name":"mailutils-pop3d","binary_version":"1:3.7-2.1"},{"binary_name":"python3-mailutils","binary_version":"1:3.7-2.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-18862.json"}},{"package":{"name":"mailutils","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/mailutils?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.11.1-5build1","1:3.13-1","1:3.14-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libmailutils8","binary_version":"1:3.14-1"},{"binary_name":"libmu-dbm8","binary_version":"1:3.14-1"},{"binary_version":"1:3.14-1","binary_name":"mailutils"},{"binary_name":"mailutils-common","binary_version":"1:3.14-1"},{"binary_name":"mailutils-comsatd","binary_version":"1:3.14-1"},{"binary_name":"mailutils-guile","binary_version":"1:3.14-1"},{"binary_name":"mailutils-imap4d","binary_version":"1:3.14-1"},{"binary_version":"1:3.14-1","binary_name":"mailutils-mda"},{"binary_name":"mailutils-mh","binary_version":"1:3.14-1"},{"binary_name":"mailutils-pop3d","binary_version":"1:3.14-1"},{"binary_name":"python3-mailutils","binary_version":"1:3.14-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-18862.json"}},{"package":{"name":"mailutils","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/mailutils?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.16-1","1:3.16-1build1","1:3.17-1","1:3.17-1.1build2","1:3.17-1.1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"libmailutils9t64","binary_version":"1:3.17-1.1build3"},{"binary_name":"libmu-dbm9t64","binary_version":"1:3.17-1.1build3"},{"binary_version":"1:3.17-1.1build3","binary_name":"mailutils"},{"binary_name":"mailutils-common","binary_version":"1:3.17-1.1build3"},{"binary_version":"1:3.17-1.1build3","binary_name":"mailutils-comsatd"},{"binary_version":"1:3.17-1.1build3","binary_name":"mailutils-guile"},{"binary_version":"1:3.17-1.1build3","binary_name":"mailutils-imap4d"},{"binary_name":"mailutils-mda","binary_version":"1:3.17-1.1build3"},{"binary_name":"mailutils-mh","binary_version":"1:3.17-1.1build3"},{"binary_name":"mailutils-pop3d","binary_version":"1:3.17-1.1build3"},{"binary_version":"1:3.17-1.1build3","binary_name":"python3-mailutils"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-18862.json"}},{"package":{"name":"mailutils","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/mailutils?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.18-1","1:3.19-1","1:3.20-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libmailutils9t64","binary_version":"1:3.20-2"},{"binary_version":"1:3.20-2","binary_name":"libmu-dbm9t64"},{"binary_name":"mailutils","binary_version":"1:3.20-2"},{"binary_name":"mailutils-common","binary_version":"1:3.20-2"},{"binary_name":"mailutils-comsatd","binary_version":"1:3.20-2"},{"binary_version":"1:3.20-2","binary_name":"mailutils-guile"},{"binary_name":"mailutils-imap4d","binary_version":"1:3.20-2"},{"binary_name":"mailutils-mda","binary_version":"1:3.20-2"},{"binary_name":"mailutils-mh","binary_version":"1:3.20-2"},{"binary_name":"mailutils-pop3d","binary_version":"1:3.20-2"},{"binary_name":"python3-mailutils","binary_version":"1:3.20-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-18862.json"}},{"package":{"name":"mailutils","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/mailutils?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.20-2","1:3.20-3","1:3.20-3build1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:3.20-3build1","binary_name":"libmailutils9t64"},{"binary_version":"1:3.20-3build1","binary_name":"libmu-dbm9t64"},{"binary_version":"1:3.20-3build1","binary_name":"mailutils"},{"binary_name":"mailutils-common","binary_version":"1:3.20-3build1"},{"binary_name":"mailutils-comsatd","binary_version":"1:3.20-3build1"},{"binary_name":"mailutils-guile","binary_version":"1:3.20-3build1"},{"binary_name":"mailutils-imap4d","binary_version":"1:3.20-3build1"},{"binary_version":"1:3.20-3build1","binary_name":"mailutils-mda"},{"binary_name":"mailutils-mh","binary_version":"1:3.20-3build1"},{"binary_name":"mailutils-pop3d","binary_version":"1:3.20-3build1"},{"binary_name":"python3-mailutils","binary_version":"1:3.20-3build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-18862.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"low"}]}