-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 23 Jul 2026 19:04:03 +0200
Source: exim4
Architecture: source
Version: 4.98.2-1+deb13u4
Distribution: trixie-security
Urgency: high
Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Changes:
exim4 (4.98.2-1+deb13u4) trixie-security; urgency=high
.
* Fix two local privilege escalation issues.
EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1)
Using command-line arguments intended for transferring queue-name
through an Exim execution chain, files outside the spool area can be
accessed. This can be used for a privilege escalation. CVE-2026-66140
EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3)
A local user having a .forward file can use a string-expansion there.
With certain Exim configurations this can be used as a privilege
escalation. CVE-2026-66141
Checksums-Sha1:
3ab4068ce8825b9a876fcec6163501a218e5e84e 2929 exim4_4.98.2-1+deb13u4.dsc
3b00ac09e61261bb64f2b90e0926da01391f48eb 495728 exim4_4.98.2-1+deb13u4.debian.tar.xz
93203414e1e2d9e035ab1cdb26de2f7a44a64181 8790 exim4_4.98.2-1+deb13u4_source.buildinfo
Checksums-Sha256:
dffd0ddf2a4462ecf38cf289625b90c0ebcad2f991f298573c1eadc0eae2b5b2 2929 exim4_4.98.2-1+deb13u4.dsc
3039cab74d5878c1fc45563913fa29e07f71d732c448ce9b9d115f2fae7d5a94 495728 exim4_4.98.2-1+deb13u4.debian.tar.xz
f87e39851156f84b8dba3ccb4ab5409ee951d945d2556f7693cd90fd5eccdd4a 8790 exim4_4.98.2-1+deb13u4_source.buildinfo
Files:
ded437d9475553a488febb6968c4f051 2929 mail standard exim4_4.98.2-1+deb13u4.dsc
63e3dfaf844c63c98f1c309821bd3b4d 495728 mail standard exim4_4.98.2-1+deb13u4.debian.tar.xz
5b3384bfa53918841a398232de8f1ab3 8790 mail standard exim4_4.98.2-1+deb13u4_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmpjm0oACgkQpU8BhUOC
FITLixAAj47vLIWKsc4cJqmnp0qapLgBrT+q1hN94g1VmgQHYDCJd5+mJXt8fop2
4N50bqvuLIVkwgc7WPcYJt8lKP5eNSQspOaPW3LlOFlwAB0PmZieV3PCer6rV4Ip
v/cw1s4HtCVTFoCGMyE9Ti/awR8JncR569xMGnaYjpSXzrnzMrLLe7Gk1/b6kgI+
ZX2BXpwnb689LIfxn+bzaeDZoLX1HBt+6taG62yDTuEhxZr910UR9mBnll/svRmx
+Ygeq3gzoCcO/pd5wgxwLFaDNIzpuP1BYJhvEOtcOPj4PdVWdY+4b9OSGe8oS2/Y
tcO9Ht42nVimbVmzTSlw15KG0iCUljDmax6bNusBvewuf7NR4Rcv9Ud+3cALKnwt
z+ut9W4lV5nYqER9okzUI2CWtu055YMFGWm164RSObFBKvSVlPBgUm8QnAwe0GU2
iC5RwvXqcR0HgHZ+QyOST/HcRPTnjsJHFCNsMPoo65+3oqWsH3qMSKk0v8WxJELG
uKelMP0KHjN77K7IFCnTiarikBHCz+BDD3Gu4qutqlO6nxY4TJ5RFMGwjDQ60BGS
qgpCxSM3QnojrfbRngUu9tsxtKRogKtf7tsUG3/MZKzvljkv6lrA36hdHhkrBNBP
tbtPI+gByFxKwSF9bPYEwM3ESQ58kfdn7AxV3ZfMjILSd1hQAN8=
=TYe7
-----END PGP SIGNATURE-----
