UbuntuUpdates.org

Package "eximon4"

Name: eximon4

Description:

monitor application for the Exim MTA (v4) (X11 interface)
Latest version: 4.97-4ubuntu4.8
Release: noble (24.04)
Level: security
Repository: universe
Head package: exim4
Homepage: https://www.exim.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "eximon4"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "eximon4" in Noble

Repository Area Version
base universe 4.97-4ubuntu4
updates universe 4.97-4ubuntu4.8

Changelog

Version: 4.97-4ubuntu4.8 2026-09-28 14:07:32 UTC

exim4 (4.97-4ubuntu4.8) noble-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write when used with attacker-controlled
    proxy
    - debian/patches/CVE-2026-94054.patch: Proxy-protocol: Fix OOB read in
      src/proxy.c.
    - CVE-2026-94054
  * SECURITY UPDATE: uninitialized stack leak when used with attacker-
    controlled proxy
    - debian/patches/CVE-2026-94056.patch: Proxy-protocol: account for short
      received V2 header in src/proxy.c.
    - CVE-2026-94056
  * SECURITY UPDATE: SMTP smuggling via crafted data
    - debian/patches/CVE-2026-94057.patch: Avoid more "SMTP smuggling" attack
      types in src/receive.c.
    - CVE-2026-94057

 -- Marc Deslauriers Tue, 22 Sep 2026 14:24:17 -0400
Source diff to previous version
CVE-2026-94054 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
CVE-2026-94056 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack me
CVE-2026-94057 Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent aft

Version: 4.97-4ubuntu4.7 2026-07-22 20:08:11 UTC
No changelog available yet.
Source diff to previous version

Version: 4.97-4ubuntu4.6 2026-06-01 18:07:55 UTC

  exim4 (4.97-4ubuntu4.6) noble-security; urgency=medium

  * SECURITY UPDATE: information disclosure in PROXYv2 (LP: #2154366)
    - debian/patches/202605191-security.patch: Security: fix PROXYv2
      uninitialised-stack disclosure (EXIM-Security-2026-05-16.1) in
      src/proxy.c.
    - CVE number pending

 -- Marc Deslauriers <email address hidden> Wed, 27 May 2026 10:20:24 -0400
Source diff to previous version

Version: 4.97-4ubuntu4.5 2026-05-12 16:07:40 UTC

  exim4 (4.97-4ubuntu4.5) noble-security; urgency=medium

  * SECURITY UPDATE: one-byte write into freed buffer (LP: #2152202)
    - debian/patches/202605011-security.patch: TLS: on rxd close with CHUNKING
      active, clean the input processing stack in src/functions.h,
      src/smtp_in.c, src/tls-gnu.c, src/tls-openssl.c.
    - unknown

 -- Marc Deslauriers <email address hidden> Mon, 11 May 2026 19:29:36 +0200
Source diff to previous version
2152202 EXIM-Security-2026-05-01.1 security tracking bug

Version: 4.97-4ubuntu4.4 2026-05-04 15:36:07 UTC

  exim4 (4.97-4ubuntu4.4) noble-security; urgency=medium

  * SECURITY UPDATE: Multiple security issues
    - debian/patches/CVE-2026-4068*.patch: backported upstream fixes.
    - CVE-2026-40685 - Possible OOB read/write on corrupt JSON in header
    - CVE-2026-40686 - Possible OOB read with large UTF8 trailing chars
    - CVE-2026-40687 - Possible OOB read/write with SPA authenticator

 -- Marc Deslauriers <email address hidden> Wed, 29 Apr 2026 13:16:58 -0400
CVE-2026-4068 The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is
CVE-2026-40685 In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrus
CVE-2026-40686 In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-
CVE-2026-40687 In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes


About   -   Send Feedback to @ubuntu_updates