Package "exim4-config"
| Name: |
exim4-config
|
Description: |
configuration for the Exim MTA (v4)
|
| Latest version: |
4.97-4ubuntu4.8 |
| Release: |
noble (24.04) |
| Level: |
security |
| Repository: |
main |
| Head package: |
exim4 |
| Homepage: |
https://www.exim.org/ |
Links
Download "exim4-config"
Other versions of "exim4-config" in Noble
Changelog
|
exim4 (4.97-4ubuntu4.8) noble-security; urgency=medium
* SECURITY UPDATE: out-of-bounds write when used with attacker-controlled
proxy
- debian/patches/CVE-2026-94054.patch: Proxy-protocol: Fix OOB read in
src/proxy.c.
- CVE-2026-94054
* SECURITY UPDATE: uninitialized stack leak when used with attacker-
controlled proxy
- debian/patches/CVE-2026-94056.patch: Proxy-protocol: account for short
received V2 header in src/proxy.c.
- CVE-2026-94056
* SECURITY UPDATE: SMTP smuggling via crafted data
- debian/patches/CVE-2026-94057.patch: Avoid more "SMTP smuggling" attack
types in src/receive.c.
- CVE-2026-94057
-- Marc Deslauriers Tue, 22 Sep 2026 14:24:17 -0400
|
| Source diff to previous version |
| CVE-2026-94054 |
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. |
| CVE-2026-94056 |
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack me |
| CVE-2026-94057 |
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent aft |
|
|
exim4 (4.97-4ubuntu4.6) noble-security; urgency=medium
* SECURITY UPDATE: information disclosure in PROXYv2 (LP: #2154366)
- debian/patches/202605191-security.patch: Security: fix PROXYv2
uninitialised-stack disclosure (EXIM-Security-2026-05-16.1) in
src/proxy.c.
- CVE number pending
-- Marc Deslauriers <email address hidden> Wed, 27 May 2026 10:20:24 -0400
|
| Source diff to previous version |
|
exim4 (4.97-4ubuntu4.5) noble-security; urgency=medium
* SECURITY UPDATE: one-byte write into freed buffer (LP: #2152202)
- debian/patches/202605011-security.patch: TLS: on rxd close with CHUNKING
active, clean the input processing stack in src/functions.h,
src/smtp_in.c, src/tls-gnu.c, src/tls-openssl.c.
- unknown
-- Marc Deslauriers <email address hidden> Mon, 11 May 2026 19:29:36 +0200
|
| Source diff to previous version |
| 2152202 |
EXIM-Security-2026-05-01.1 security tracking bug |
|
|
exim4 (4.97-4ubuntu4.4) noble-security; urgency=medium
* SECURITY UPDATE: Multiple security issues
- debian/patches/CVE-2026-4068*.patch: backported upstream fixes.
- CVE-2026-40685 - Possible OOB read/write on corrupt JSON in header
- CVE-2026-40686 - Possible OOB read with large UTF8 trailing chars
- CVE-2026-40687 - Possible OOB read/write with SPA authenticator
-- Marc Deslauriers <email address hidden> Wed, 29 Apr 2026 13:16:58 -0400
|
| CVE-2026-4068 |
The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is |
| CVE-2026-40685 |
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrus |
| CVE-2026-40686 |
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF- |
| CVE-2026-40687 |
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes |
|
About
-
Send Feedback to @ubuntu_updates
