-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 22 Jul 2026 18:53:50 +0200
Source: exim4
Architecture: source
Version: 4.99.4-2
Distribution: unstable
Urgency: high
Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Changes:
exim4 (4.99.4-2) unstable; urgency=high
.
* Fix two local privilege escalation issues.
EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1)
Using command-line arguments intended for transferring queue-name
through an Exim execution chain, files outside the spool area can be
accessed. This can be used for a privilege escalation.
EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3)
A local user having a .forward file can use a string-expansion there.
With certain Exim configurations this can be used as a privilege
escalation.
Checksums-Sha1:
734df7f20d532dce140ff57ff4139f5330070545 3370 exim4_4.99.4-2.dsc
224758e311507105d4c7e4e34d3df33b95d5c13f 485776 exim4_4.99.4-2.debian.tar.xz
Checksums-Sha256:
bbfbd711d7a27b3f22afa2723695b6b0cd5b4511ee950ebcd2e19035fcd998e2 3370 exim4_4.99.4-2.dsc
19c7dfcc844b5a3c44b7a97c9b69c746787893681820201805aab160c7b8f0d5 485776 exim4_4.99.4-2.debian.tar.xz
Files:
ace326e24fa6e8735b82d2d73677d5f4 3370 mail standard exim4_4.99.4-2.dsc
359f3a80d1131baf375ec993787d1ec4 485776 mail standard exim4_4.99.4-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmpg9ugACgkQpU8BhUOC
FITkjw//TS/igS7R7USu//jmdMcmRQh9lMtVOWnXSnNxlNxcVvzvakf716d3lOBQ
WCTI0oBqAvKoXJMXEea/DNa0qGrv5i9d2RouV+NeRbxdTZoKzrZt2VStqaEseGaW
pEa17/QrHxHPtEp7n4nV/Pdeef4a7+4/7BUd0CFN60pu5zH30cLJaT/U1dbciaFX
CmVcLp4KVI3t3JezgG5d++n20WHRvZ3hYDPwSJwdzHN49iOoqPSFt5JcbcMbGw7f
W1PeNxb5y4I7W+yC9LJ4x31Q5WNOND8KMFqBlLFMP20zVdx+EWMFAk01m2dd44w5
v+BsbHgCybRbp3W7edrl0HWDMAUUBX/qTSaKWzB+VG3d0tzYlANdhbQJVljoxXLA
RHD+loAql4p4qxuXXhCSzbcblmlbaB6GFq3SiSVMY6FgNNpwOJQ2J1ERilMUFQwN
Aer6Xh5fzUxAFCQoCuskSuvYkrV/ledYNS+Gc9JOndddWVHDpAcViUVYNvUMyAxs
ddzeXZSWLCs7qYoiNoPuKCm8NwtviyR/OxA6IJKahSc+kHfA+FTnS15HBUMdaghW
ZC62sSteqI3rLS/wPeZEiw9tagquDALksUT/AalpAMGE3zcLJoC/65Vy2EISaGFo
aLKrNMCDYR59PYqLpybbHEFbF7yNa4LtYLe7kDklG+ogypFfU8U=
=OmHK
-----END PGP SIGNATURE-----
