UbuntuUpdates.org

Package "exim4"

Name: exim4

Description:

metapackage to ease Exim MTA (v4) installation
Latest version: 4.95-4ubuntu2.12
Release: jammy (22.04)
Level: updates
Repository: main
Homepage: https://www.exim.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "exim4"

All arch deb package
APT INSTALL

Other versions of "exim4" in Jammy

Repository Area Version
base main 4.95-4ubuntu2
base universe 4.95-4ubuntu2
security universe 4.95-4ubuntu2.12
security main 4.95-4ubuntu2.12
updates universe 4.95-4ubuntu2.12

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 4.95-4ubuntu2.12 2026-09-28 16:07:34 UTC

exim4 (4.95-4ubuntu2.12) jammy-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write when used with attacker-controlled
    proxy
    - debian/patches/CVE-2026-94054.patch: Proxy-protocol: Fix OOB read in
      src/smtp_in.c.
    - CVE-2026-94054
  * SECURITY UPDATE: uninitialized stack leak when used with attacker-
    controlled proxy
    - debian/patches/CVE-2026-94056.patch: Proxy-protocol: account for short
      received V2 header in src/smtp_in.c.
    - CVE-2026-94056
  * SECURITY UPDATE: SMTP smuggling via crafted data
    - debian/patches/CVE-2026-94057.patch: Avoid more "SMTP smuggling" attack
      types in src/receive.c.
    - CVE-2026-94057

 -- Marc Deslauriers Tue, 22 Sep 2026 14:29:02 -0400
Source diff to previous version
CVE-2026-94054 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
CVE-2026-94056 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack me
CVE-2026-94057 Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent aft

Version: 4.95-4ubuntu2.11 2026-07-22 22:07:28 UTC
No changelog available yet.
Source diff to previous version

Version: 4.95-4ubuntu2.10 2026-06-10 17:07:41 UTC

  exim4 (4.95-4ubuntu2.10) jammy-security; urgency=medium

  * SECURITY REGRESSION: taint mismatch error (LP: #2152830)
    - debian/patches/CVE-2023-42117-2.patch: Use project-standard memory
      management rather than alloca() in src/string.c.

 -- Marc Deslauriers <email address hidden> Tue, 09 Jun 2026 08:58:06 -0400
Source diff to previous version
2152830 Taint mismatch, Ustrncpy: string_is_ip_addressX 110
CVE-2023-42117 Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability

Version: 4.95-4ubuntu2.9 2026-06-01 18:07:46 UTC

  exim4 (4.95-4ubuntu2.9) jammy-security; urgency=medium

  * SECURITY UPDATE: information disclosure in PROXYv2 (LP: #2154366)
    - debian/patches/202605191-security.patch: Security: fix PROXYv2
      uninitialised-stack disclosure (EXIM-Security-2026-05-16.1) in
      src/smtp_in.c.
    - CVE number pending

 -- Marc Deslauriers <email address hidden> Wed, 27 May 2026 10:23:14 -0400
Source diff to previous version

Version: 4.95-4ubuntu2.8 2026-05-12 17:07:36 UTC

  exim4 (4.95-4ubuntu2.8) jammy-security; urgency=medium

  * SECURITY UPDATE: one-byte write into freed buffer (LP: #2152202)
    - debian/patches/202605011-security.patch: TLS: on rxd close with CHUNKING
      active, clean the input processing stack in src/functions.h,
      src/smtp_in.c, src/tls-gnu.c, src/tls-openssl.c.
    - unknown

 -- Marc Deslauriers <email address hidden> Mon, 11 May 2026 19:43:58 +0200
2152202 EXIM-Security-2026-05-01.1 security tracking bug


About   -   Send Feedback to @ubuntu_updates