Every CVE Search/ Get API key

CVE-2018-19518

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other...

7.5 HighPublic exploitFix available

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

96.1%Up 30.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
CVE-2018-19518
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
8.5 HighAV:N/AC:M/Au:S/C:C/I:C/A:C
Weakness
CWE-88
Updated
2026-11-02
CVE List No score

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
CVE-2018-19518
Updated
2026-11-02
EUVDEUVD-2018-11207 No score

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
EUVD-2018-11207
Updated
2026-11-03
GitHub AdvisoriesGHSA-5qmr-54g6-4256 7.5

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other...

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
GHSA-5qmr-54g6-4256
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
OSVALPINE-CVE-2018-19518 7.5

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
ALPINE-CVE-2018-19518
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-37053 7.5

CVE-2018-19518 affecting package uw-imap 2007f-27

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
AZL-37053
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVAZL-37158 7.5

CVE-2018-19518 affecting package uw-imap 2007f-26

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
AZL-37158
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2018-19518 7.5

CVE-2018-19518 does not affect BellSoft software

Record
BELL-CVE-2018-19518
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.5

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
CVE-2018-19518
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-19518 7.5

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
DEBIAN-CVE-2018-19518
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-19518 7.5

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Record
UBUNTU-CVE-2018-19518
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1777540774 No score

php: Fix of 4 CVEs

  • CVE-2018-14883: fix integer overflow leading to heap buffer overflow in exif_thumbnail_extract
  • CVE-2019-19246: fix heap buffer overflow in oniguruma str_lower_case_match
  • CVE-2018-19518: disable imap rsh/ssh by default to prevent argument injection (imap.enable_insecure_rsh INI added)
  • CVE-2018-20783: add buffer bounds checks to phar_parse_pharfile manifest reads
Record
CLSA-2026-1777540774
Updated
2026-11-02
OSVCLSA-2026-1777946242 No score

php: Fix of 13 CVEs

  • CVE-2018-14883: fix int overflow leading to heap overflow in exif_thumbnail_extract
  • CVE-2019-6977: fix imagecolormatch out-of-bounds write on heap in GD
  • CVE-2019-9022: fix memcpy with negative length via crafted DNS response
  • CVE-2019-9640: fix invalid read in exif_process_SOFn
  • CVE-2019-11042: fix heap buffer overflow in exif_process_user_comment
  • CVE-2019-9638, CVE-2019-9639: fix uninitialized read in exif_process_IFD_in_MAKERNOTE (single upstream commit covers both)
  • CVE-2019-9637: safer rename() procedure to avoid permission leak on EXDEV cross-filesystem fallback
  • CVE-2019-19246: fix Oniguruma out-of-bounds read in str_lower_case_match
  • CVE-2019-9024: fix xmlrpc base64 out-of-bounds read via unsigned char cast
  • CVE-2018-20783: fix phar_parse_pharfile buffer over-read via stricter manifest bounds checks
  • CVE-2018-19518: disable rsh/ssh logins in imap_open by default (new no_rsh/no_ssh INI entries)
  • CVE-2018-19935: fix imap_mail NULL pointer dereference on empty message parameter
Record
CLSA-2026-1777946242
Updated
2026-11-02
OSVMGASA-2018-0484 No score

Updated php packages fix security vulnerability

Bypassing disabled exec functions in PHP via imap_open (CVE-2018-19518).

Record
MGASA-2018-0484
Updated
2026-11-02
OSVSUSE-SU-2018:3986-1 No score

Recommended update for php53

This update for php53 fixes the following issues:

Security issue fixed:

  • CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107).
Record
SUSE-SU-2018:3986-1
Updated
2026-11-02
OSVSUSE-SU-2018:3988-1 No score

Recommended update for php7

This update for php7 fixes the following issues:

Security issue fixed:

  • CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107).
Record
SUSE-SU-2018:3988-1
Updated
2026-11-02
OSVSUSE-SU-2018:3995-1 No score

Recommended update for php5

This update for php5 fixes the following issues:

Security issue fixed:

  • CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107).
Record
SUSE-SU-2018:3995-1
Updated
2026-11-02
OSVUSN-4160-1 No score

uw-imap vulnerability

It was discovered that UW IMAP incorrectly handled inputs. A remote attacker could possibly use this issue to execute arbitrary OS commands.

Record
USN-4160-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php7
Alpine:v3.7
 before 7.1.29-r0
7.1.29-r0
uw-imap
Azure Linux:3
 through 2007f-27 None known
uw-imap
Azure Linux:2
 through 2007f-26 None known
php
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-bcmath
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-cli
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-common
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-dba
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-devel
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-embedded
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
Show 68 moreShow less
Affected packages
PackageAffectedFixed
php-enchant
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-fpm
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-gd
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-imap
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-intl
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-ldap
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-mbstring
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-mysql
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-odbc
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-pdo
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-pgsql
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-process
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-pspell
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-recode
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-snmp
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-soap
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-tidy
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-xml
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-xmlrpc
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php-zts
TuxCare:CentOS:6
 before 5.3.3-55.el6.tuxcare.els16
5.3.3-55.el6.tuxcare.els16
php
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-bcmath
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-cli
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-common
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-dba
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-devel
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-embedded
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-enchant
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-fpm
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-gd
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-imap
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-intl
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-ldap
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-mbstring
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-mysql
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-odbc
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-pdo
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-pgsql
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-process
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-pspell
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-recode
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-snmp
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-soap
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-tidy
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-xml
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-xmlrpc
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
php-zts
TuxCare:OracleLinux:6
 before 5.3.3-50.el6_10.tuxcare.ol.els20
5.3.3-50.el6_10.tuxcare.ol.els20
uw-imap
Debian:12
 before 8:2007f~dfsg-6
8:2007f~dfsg-6
php5
Debian:8
 before 5.6.39+dfsg-0+deb8u1, plus listed versions
5.6.11+dfsg-15.6.12+dfsg-0+deb8u15.6.12+dfsg-15.6.13+dfsg-0+deb8u15.6.13+dfsg-1
Show 39 moreShow less
5.6.13+dfsg-25.6.14+dfsg-0+deb8u15.6.14+dfsg-15.6.15+dfsg-15.6.16+dfsg-15.6.16+dfsg-25.6.16+dfsg-35.6.16+dfsg-45.6.17+dfsg-0+deb8u15.6.17+dfsg-15.6.17+dfsg-35.6.18+dfsg-15.6.19+dfsg-0+deb8u15.6.19+dfsg-15.6.19+dfsg-25.6.20+dfsg-0+deb8u15.6.20+dfsg-15.6.21+dfsg-15.6.21+dfsg-25.6.22+dfsg-0+deb8u15.6.22+dfsg-15.6.22+dfsg-25.6.23+dfsg-0+deb8u15.6.23+dfsg-15.6.24+dfsg-0+deb8u15.6.24+dfsg-15.6.26+dfsg-0+deb8u15.6.26+dfsg-15.6.27+dfsg-0+deb8u15.6.28+dfsg-0+deb8u15.6.29+dfsg-0+deb8u15.6.30+dfsg-0+deb8u15.6.33+dfsg-0+deb8u15.6.36+dfsg-0+deb8u15.6.37+dfsg-0+deb8u15.6.38+dfsg-0+deb8u15.6.7+dfsg-15.6.9+dfsg-0+deb8u15.6.9+dfsg-1
5.6.39+dfsg-0+deb8u1
uw-imap
Debian:8
 before 8:2007f~dfsg-4+deb8u1, plus listed versions
8:2007f~dfsg-4
8:2007f~dfsg-4+deb8u1
uw-imap
Debian:9
 before 8:2007f~dfsg-5+deb9u1, plus listed versions
8:2007f~dfsg-5
8:2007f~dfsg-5+deb9u1
php7.0
Debian:9
 before 7.0.33-0+deb9u1, plus listed versions
7.0.19-17.0.20-17.0.20-27.0.22-17.0.22-2
Show 12 moreShow less
7.0.22-37.0.25-17.0.26-17.0.27-0+deb9u17.0.27-17.0.28-17.0.29-17.0.30-0+deb9u17.0.30-17.0.30-27.0.31-17.0.32-1
7.0.33-0+deb9u1
php
Mageia:6
 before 5.6.39-1.mga6
5.6.39-1.mga6
php53
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 5.3.17-112.45.1
5.3.17-112.45.1
php53
SUSE:Linux Enterprise Server 11 SP4
 before 5.3.17-112.45.1
5.3.17-112.45.1
php53
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 5.3.17-112.45.1
5.3.17-112.45.1
php7
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 7.0.7-50.56.2
7.0.7-50.56.2
php7
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 7.0.7-50.56.2
7.0.7-50.56.2
php7
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 7.0.7-50.56.2
7.0.7-50.56.2
php5
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 5.5.14-109.45.2
5.5.14-109.45.2
php5
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 5.5.14-109.45.2
5.5.14-109.45.2
php5
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 5.5.14-109.45.2
5.5.14-109.45.2
php-imap
Ubuntu:14.04:LTS
 before 5.4.6-0ubuntu5.1, plus listed versions
5.4.6-0ubuntu35.4.6-0ubuntu5
5.4.6-0ubuntu5.1
uw-imap
Ubuntu:Pro:14.04:LTS
 before 8:2007f~dfsg-2ubuntu0.1~esm1, plus listed versions
8:2007e~dfsg-3.2ubuntu28:2007f~dfsg-2
8:2007f~dfsg-2ubuntu0.1~esm1
php7.0
Ubuntu:16.04:LTS
 before 7.0.33-0ubuntu0.16.04.1, plus listed versions
7.0.1-57.0.1-67.0.2-17.0.2-37.0.2-4
Show 22 moreShow less
7.0.2-57.0.3-27.0.3-37.0.3-9ubuntu17.0.4-5ubuntu17.0.4-5ubuntu27.0.4-7ubuntu17.0.4-7ubuntu27.0.4-7ubuntu2.17.0.8-0ubuntu0.16.04.17.0.8-0ubuntu0.16.04.27.0.8-0ubuntu0.16.04.37.0.13-0ubuntu0.16.04.17.0.15-0ubuntu0.16.04.17.0.15-0ubuntu0.16.04.27.0.15-0ubuntu0.16.04.47.0.18-0ubuntu0.16.04.17.0.22-0ubuntu0.16.04.17.0.25-0ubuntu0.16.04.17.0.28-0ubuntu0.16.04.17.0.30-0ubuntu0.16.04.17.0.32-0ubuntu0.16.04.1
7.0.33-0ubuntu0.16.04.1
uw-imap
Ubuntu:16.04:LTS
 before 8:2007f~dfsg-4+deb8u1build0.16.04.1, plus listed versions
8:2007f~dfsg-4
8:2007f~dfsg-4+deb8u1build0.16.04.1
php7.2
Ubuntu:18.04:LTS
 before 7.2.15-0ubuntu0.18.04.1, plus listed versions
7.2.1-1ubuntu27.2.2-1ubuntu17.2.2-1ubuntu27.2.3-1ubuntu17.2.5-0ubuntu0.18.04.17.2.7-0ubuntu0.18.04.17.2.7-0ubuntu0.18.04.27.2.10-0ubuntu0.18.04.1
7.2.15-0ubuntu0.18.04.1
uw-imap
Ubuntu:18.04:LTS
 before 8:2007f~dfsg-5ubuntu0.18.04.2, plus listed versions
8:2007f~dfsg-58:2007f~dfsg-5build18:2007f~dfsg-5ubuntu0.18.04.1
8:2007f~dfsg-5ubuntu0.18.04.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Metasploitphp imap_open Remote Code Execution2018-10-23
Exploit-DBPHP imap_open - Remote Code Execution (Metasploit)2018-11-29
PoC in GitHubensimag-security/CVE-2018-195182018-12-31
PoC in GitHubhouqe/EXP_CVE-2018-195182023-04-15

History

History
RecordedChangedSources
affected, aliases, exploits, referencesOSV
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19518 is a high vulnerability (CVSS 7.5) in Php, published November 25, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.1%, the 99th percentile. Fixed in php7 7.1.29-r0.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open