Read the docs
TI-2018-13823 Aliases CVE-2018-19518GHSA-5qmr-54g6-4256

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and…

Priority HIGH 77CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-88.

Summary

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Why it matters now

EPSS 0.96107 99th percentileScored 2026-11-07
Public exploit Yes 6 exploit referencesTagged by the CNA and NVD
Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*5.6.0 – 5.6.38; 7.0.0 – 7.0.32; 7.1.0 – 7.1.24; 7.2.0 – 7.2.12VulnerablePHP
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:uw-imap_project:uw-imap:2007f:*:*:*:*:*:*:*2007fVulnerableUw-imap Project
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*19.04VulnerableCanonical
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 5.6.0 – 5.6.38; 7.0.0 – 7.0.32; 7.1.0 – 7.1.24; 7.2.0 – 7.2.12 Vulnerable ·PHP
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:uw-imap_project:uw-imap:2007f:*:*:*:*:*:*:* Versions 2007f Vulnerable ·Uw-imap Project
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-19518
  2. 2026-10-03 Alias added: GHSA-5qmr-54g6-4256

References

Exploit 6

Advisory 11

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences