CVE catalog

CVE-2018-19518

uw-imap: CVE-2018-19518

Severity: High · CVSS 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Nov 19, 2018, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 96.11% · Oct 25, 2026

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	uw-imap	bookworm	`8:2007f~dfsg-7`	fixed
Ubuntu	php-imap	14.04	`5.4.6-0ubuntu3`	vulnerable
Ubuntu	php-imap	14.04	`5.4.6-0ubuntu5`	vulnerable
Ubuntu	php-imap	14.04	`5.4.6-0ubuntu5.1`	fixed
Ubuntu	uw-imap	pro	`8:2007e~dfsg-3.2ubuntu2`	vulnerable
Ubuntu	uw-imap	pro	`8:2007f~dfsg-2`	vulnerable
Ubuntu	uw-imap	pro	`8:2007f~dfsg-2ubuntu0.1~esm1`	fixed
Ubuntu	php7.0	16.04	`7.0.1-5`	vulnerable
Ubuntu	php7.0	16.04	`7.0.1-6`	vulnerable
Ubuntu	php7.0	16.04	`7.0.2-1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.2-3`	vulnerable
Ubuntu	php7.0	16.04	`7.0.2-4`	vulnerable
Ubuntu	php7.0	16.04	`7.0.2-5`	vulnerable
Ubuntu	php7.0	16.04	`7.0.3-2`	vulnerable
Ubuntu	php7.0	16.04	`7.0.3-3`	vulnerable
Ubuntu	php7.0	16.04	`7.0.3-9ubuntu1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.4-5ubuntu1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.4-5ubuntu2`	vulnerable
Ubuntu	php7.0	16.04	`7.0.4-7ubuntu1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.4-7ubuntu2`	vulnerable
Ubuntu	php7.0	16.04	`7.0.4-7ubuntu2.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.8-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.8-0ubuntu0.16.04.2`	vulnerable
Ubuntu	php7.0	16.04	`7.0.8-0ubuntu0.16.04.3`	vulnerable
Ubuntu	php7.0	16.04	`7.0.13-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.15-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.15-0ubuntu0.16.04.2`	vulnerable
Ubuntu	php7.0	16.04	`7.0.15-0ubuntu0.16.04.4`	vulnerable
Ubuntu	php7.0	16.04	`7.0.18-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.22-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.25-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.28-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.30-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.32-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	16.04	`7.0.33-0ubuntu0.16.04.1`	fixed
Ubuntu	uw-imap	16.04	`8:2007f~dfsg-4`	vulnerable
Ubuntu	uw-imap	16.04	`8:2007f~dfsg-4+deb8u1build0.16.04.1`	fixed
Ubuntu	php7.2	18.04	`7.2.1-1ubuntu2`	vulnerable
Ubuntu	php7.2	18.04	`7.2.2-1ubuntu1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.2-1ubuntu2`	vulnerable
Ubuntu	php7.2	18.04	`7.2.3-1ubuntu1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.5-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.7-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.7-0ubuntu0.18.04.2`	vulnerable
Ubuntu	php7.2	18.04	`7.2.10-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.15-0ubuntu0.18.04.1`	fixed
Ubuntu	uw-imap	18.04	`8:2007f~dfsg-5`	vulnerable
Ubuntu	uw-imap	18.04	`8:2007f~dfsg-5build1`	vulnerable
Ubuntu	uw-imap	18.04	`8:2007f~dfsg-5ubuntu0.18.04.1`	vulnerable
Ubuntu	uw-imap	18.04	`8:2007f~dfsg-5ubuntu0.18.04.2`	fixed
Ubuntu	uw-imap	16.04	`8:2007f~dfsg-4`	vulnerable
Ubuntu	uw-imap	16.04	`8:2007f~dfsg-4+deb8u1build0.16.04.1`	fixed
Ubuntu	uw-imap	18.04	`8:2007f~dfsg-5`	vulnerable
Ubuntu	uw-imap	18.04	`8:2007f~dfsg-5build1`	vulnerable
Ubuntu	uw-imap	18.04	`8:2007f~dfsg-5ubuntu0.18.04.1`	vulnerable
Ubuntu	uw-imap	18.04	`8:2007f~dfsg-5ubuntu0.18.04.2`	fixed
Suse	php53	linux enterprise software development kit 11 sp4	`5.3.17-112.45.1`	fixed
Suse	php53	linux enterprise server 11 sp4	`5.3.17-112.45.1`	fixed
Suse	php53	linux enterprise server for sap applications 11 sp4	`5.3.17-112.45.1`	fixed
Suse	php5	linux enterprise module for web and scripting 12	`5.5.14-109.45.2`	fixed
Suse	php5	linux enterprise software development kit 12 sp3	`5.5.14-109.45.2`	fixed
Suse	php5	linux enterprise software development kit 12 sp4	`5.5.14-109.45.2`	fixed
Suse	php7	linux enterprise module for web and scripting 12	`7.0.7-50.56.2`	fixed
Suse	php7	linux enterprise software development kit 12 sp3	`7.0.7-50.56.2`	fixed
Suse	php7	linux enterprise software development kit 12 sp4	`7.0.7-50.56.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	uw-imap	source	bookworm	`8:2007f~dfsg-6`	not yet assigned	Not reported	[914632]
Ubuntu	php-imap	deb	14.04	`5.4.6-0ubuntu5.1`	Not reported	UBUNTU-CVE-2018-19518	Not reported
Ubuntu	uw-imap	deb	pro	`8:2007f~dfsg-2ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2018-19518	Not reported
Ubuntu	php7.0	deb	16.04	`7.0.33-0ubuntu0.16.04.1`	Not reported	UBUNTU-CVE-2018-19518	Not reported
Ubuntu	uw-imap	deb	16.04	`8:2007f~dfsg-4+deb8u1build0.16.04.1`	Not reported	UBUNTU-CVE-2018-19518	Not reported
Ubuntu	php7.2	deb	18.04	`7.2.15-0ubuntu0.18.04.1`	Not reported	UBUNTU-CVE-2018-19518	Not reported
Ubuntu	uw-imap	deb	18.04	`8:2007f~dfsg-5ubuntu0.18.04.2`	Not reported	UBUNTU-CVE-2018-19518	Not reported
Ubuntu	uw-imap	deb	16.04	`8:2007f~dfsg-4+deb8u1build0.16.04.1`	Not reported	USN-4160-1	Not reported
Ubuntu	uw-imap	deb	18.04	`8:2007f~dfsg-5ubuntu0.18.04.2`	Not reported	USN-4160-1	Not reported
Suse	php53	rpm	linux enterprise software development kit 11 sp4	`5.3.17-112.45.1`	Not reported	SUSE-SU-2018:3986-1	Not reported
Suse	php53	rpm	linux enterprise server 11 sp4	`5.3.17-112.45.1`	Not reported	SUSE-SU-2018:3986-1	Not reported
Suse	php53	rpm	linux enterprise server for sap applications 11 sp4	`5.3.17-112.45.1`	Not reported	SUSE-SU-2018:3986-1	Not reported
Suse	php5	rpm	linux enterprise module for web and scripting 12	`5.5.14-109.45.2`	Not reported	SUSE-SU-2018:3995-1	Not reported
Suse	php5	rpm	linux enterprise software development kit 12 sp3	`5.5.14-109.45.2`	Not reported	SUSE-SU-2018:3995-1	Not reported
Suse	php5	rpm	linux enterprise software development kit 12 sp4	`5.5.14-109.45.2`	Not reported	SUSE-SU-2018:3995-1	Not reported
Suse	php7	rpm	linux enterprise module for web and scripting 12	`7.0.7-50.56.2`	Not reported	SUSE-SU-2018:3988-1	Not reported
Suse	php7	rpm	linux enterprise software development kit 12 sp3	`7.0.7-50.56.2`	Not reported	SUSE-SU-2018:3988-1	Not reported
Suse	php7	rpm	linux enterprise software development kit 12 sp4	`7.0.7-50.56.2`	Not reported	SUSE-SU-2018:3988-1	Not reported

[Debian bug #914632]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libc-client2007e]Fixed
Source package: [uw-imap]
Details (2)
- 8:2007f~dfsg-7+b1 · arm64 · bookworm
  Fixed · Fixed: 8:2007f~dfsg-6
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
- 8:2007f~dfsg-7+b2 · amd64 · bookworm
  Fixed · Fixed: 8:2007f~dfsg-6
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
[libc-client2007e-dev]Fixed
Source package: [uw-imap]
Details (2)
- 8:2007f~dfsg-7+b1 · arm64 · bookworm
  Fixed · Fixed: 8:2007f~dfsg-6
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
- 8:2007f~dfsg-7+b2 · amd64 · bookworm
  Fixed · Fixed: 8:2007f~dfsg-6
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
[mlock]Fixed
Source package: [uw-imap]
Details (2)
- 8:2007f~dfsg-7+b1 · arm64 · bookworm
  Fixed · Fixed: 8:2007f~dfsg-6
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
- 8:2007f~dfsg-7+b2 · amd64 · bookworm
  Fixed · Fixed: 8:2007f~dfsg-6
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
[uw-mailutils]Fixed
Source package: [uw-imap]
Details (2)
- 8:2007f~dfsg-7+b1 · arm64 · bookworm
  Fixed · Fixed: 8:2007f~dfsg-6
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12
- 8:2007f~dfsg-7+b2 · amd64 · bookworm
  Fixed · Fixed: 8:2007f~dfsg-6
  dsa · uw-imap · debian · bookworm; dsa · uw-imap · debian · 12

Observed: Oct 23, 2026, 5:35:45 PM UTC

References

[CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]