-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 24 Jul 2026 19:08:58 +0200
Source: exim4
Architecture: source
Version: 4.99.4-2~bpo13+1
Distribution: trixie-backports
Urgency: high
Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Changes:
exim4 (4.99.4-2~bpo13+1) trixie-backports; urgency=high
.
* Rebuild for trixie-backports.
* Security upload.
.
exim4 (4.99.4-2) unstable; urgency=high
.
* Fix two local privilege escalation issues.
EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1)
Using command-line arguments intended for transferring queue-name
through an Exim execution chain, files outside the spool area can be
accessed. This can be used for a privilege escalation.
EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3)
A local user having a .forward file can use a string-expansion there.
With certain Exim configurations this can be used as a privilege
escalation.
Checksums-Sha1:
8f06343c70d23961c596ef1934445c02168b9516 3404 exim4_4.99.4-2~bpo13+1.dsc
adc60847a2348ff24cad0d730debfb6427088cb4 485740 exim4_4.99.4-2~bpo13+1.debian.tar.xz
40efd56083e725887c8b8c3123ef476a0ee35e4d 8469 exim4_4.99.4-2~bpo13+1_source.buildinfo
Checksums-Sha256:
6f4e889b0ed0c3a7dd1c60dd628f5d78884dcff3f6d3cb24a53ad9d0029f51de 3404 exim4_4.99.4-2~bpo13+1.dsc
9dbea90961af1994d4dd88336f10213d1a332fe3641b1b6157ead3893ce00eda 485740 exim4_4.99.4-2~bpo13+1.debian.tar.xz
e7e77424d6deee06798ce5ff46114a9c493ad42cdd1537a6f2314dd61919d6df 8469 exim4_4.99.4-2~bpo13+1_source.buildinfo
Files:
e32802b1a06492bef3edb3335298e1f1 3404 mail standard exim4_4.99.4-2~bpo13+1.dsc
8663bbe9da86df6d22fe70656466b80a 485740 mail standard exim4_4.99.4-2~bpo13+1.debian.tar.xz
1a0db66b0b0d3814803890611241f0dc 8469 mail standard exim4_4.99.4-2~bpo13+1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmpjniwACgkQpU8BhUOC
FITh5w//QSixIXpYOuzerB9GD09qdiwodbRzoxpx7XBdKhI5z6+ko7B9LSYFAEAh
HCXqdtnwy6tdLCHQ97A6QARmW1j5Ywsk3TF2tfvlO6E21FnVB6aEsLvVZMjx+3i8
sXzKZAJFywbPhQc4ciE1ZGcZ43vKkVNLRbtANvuXrE55//QZ+3aMojT5P4UHODPm
Z6gg2C273dAsXYn0YX9zefgsZ9p1MIOJJWupU4msI9C2JUZB6NuK+HR3Bh+r9jBo
K6zEeN7zdU/vd7mxp+KMBMtfPfv86HwPuIAka8pJcxMjxD5wURFpSda/QO7TWVDR
E4Iueb0eYSGQj36fX1sJbLYrzu8aKczm/gxSxzsEDNvoye+Cwfi5pazle1UtXYNn
g+OUZbQKxZxZ2xc2Crsvb3scgWXeqLm/ij9bTtBDDL/I7ynFGJd/WuUGtPoIkAt2
d/Z3Db8LzhyK1tKonTDjaErlvy7FrQe+7x1M8nOL2FR7ySfUmsWzXDXEXhjYPdXk
/F1THZXyfOm/NpTb+6hSCek8nrjDsfeB9WJnvPzxGCWbFE7LAGAs8So8fWxUmY53
AtayROUIliBXalGRnsvifECcl6pp+4l3dEfOcD0cEMv4yDaPLJEr5oWQXn8JByK0
D4gL4d0JMuCpALZbAF5CkW2eMCs8pnnjI2yRVAi3TNEFRieNxqA=
=s5u8
-----END PGP SIGNATURE-----
