Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.changes > #14409 > unrolled thread

Accepted exim4 4.98.2-1+deb13u5 (source) into proposed-updates

Back to article view | Back to linux.debian.changes

Contents

  Accepted exim4 4.98.2-1+deb13u5 (source) into proposed-updates Debian FTP Masters <ftpmaster@ftp-master.debian.org> - 2026-10-02 17:20 +0200

#14409 — Accepted exim4 4.98.2-1+deb13u5 (source) into proposed-updates

[Multipart message — attachments visible in raw view] — view raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 25 Sep 2026 11:25:38 +0200
Source: exim4
Architecture: source
Version: 4.98.2-1+deb13u5
Distribution: trixie-security
Urgency: high
Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Closes: 1148506
Changes:
 exim4 (4.98.2-1+deb13u5) trixie-security; urgency=high
 .
   * Cherry-pick relevant changes from security release 4.100.1.
     CVE-2026-94054 EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1)
      Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
      controlled proxy, has an out-of-bounds write.
     CVE-2026-94056 EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1)
      Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
      controlled proxy, allows attackers to read certain uninitialized
      data from stack memory.
     CVE-2026-94057 EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1)
      Exim before 4.100.1 allows SMTP smuggling in which the received
      message does not match any sent message, and instead depends on
      crafted data sent after a rejection during DATA processing.
     Closes: #1148506
     (CVE-2026-94055 is not relevant - TLS Early banner support was
     introduced in 4.99.)
Checksums-Sha1: 
 0728494e6b2f1c23310ce38350a9407c74a63312 2929 exim4_4.98.2-1+deb13u5.dsc
 89e08ac252f92df88fc8fef0fa9b9e3cb986be1a 498636 exim4_4.98.2-1+deb13u5.debian.tar.xz
Checksums-Sha256: 
 cc5147d1cd8c253da7e539e91a226b4683d720514c86be9e541c81a6b65f394f 2929 exim4_4.98.2-1+deb13u5.dsc
 29e30dd3e189de38055a62324b5a6fcf9f68cb291e944beebbb8eaa20efb3416 498636 exim4_4.98.2-1+deb13u5.debian.tar.xz
Files: 
 ee66f61601259ca78c83b648f26d2446 2929 mail standard exim4_4.98.2-1+deb13u5.dsc
 9a3c8538308f9d44e75a326a592074f2 498636 mail standard exim4_4.98.2-1+deb13u5.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIyBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmq43oEACgkQpU8BhUOC
FITTBQ/3ZwJ+xhcbAjs/LU8jr5zDk7GG+W7fg3vpH5DAp18tHYgEkXLL1yrb1IWU
1R6aZp46G68bXbFR/9WFPnGLqz0lAGnrbVMexojhhUqKhDWot8d2CjXq+qVRTqh1
uFwSNYFO9WXEM/82Zc4jHVbfinpPvwFDTMi7uWwTszdfqlRzpqXmV6al9R5erFYP
ZbdFLmYObEUyhMhc+U+/qIe/U2bQAKvsLo6mUPo2BLgAXTdZHLK+XGX2eW4KZVj6
jGxK5PHgfkfm25J4zkxqf1a7cZUoBarKTNHsQ5/0McvjiMTYZ4HdSLfOM1IYWCYu
+ovV+gWjk7YBJvpJ2j/6P08cR707L2PB3xBRMh0UaEci3F2Da2UkZjnncGwCHvEJ
Vq2XzBOHrrk9aRxOyV0Ys+38JjFKPNHozZA6esb9kxC6VcVFFVAWlAyz18uiOVnB
XH7PWVyjhY/azPR5HkKYialVRC9xYx8mzuPc6AzlriaR5g2b7pbYHTZ7kQPPihuX
f1woxKqJbPtp8ZsSRKXq4lneA6s2K0abRjQhTzdlttEYWfv49U9bRYXPZw/EcKeM
sPD2i4Z6+Nnnvm6nM95AUTpbM7+/bzdjqyEU76lb9cp3ZgNwd87WB0fR61U4qwWR
scWWFjBCKSXIf3aS/+saF11DjPGK+vOwZgHpMxpqzmII0owUXA==
=iVmN
-----END PGP SIGNATURE-----

[toc] | [standalone]

Back to top | Article view | linux.debian.changes

csiph-web