-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 25 Sep 2026 11:25:38 +0200 Source: exim4 Architecture: source Version: 4.98.2-1+deb13u5 Distribution: trixie-security Urgency: high Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org> Changed-By: Andreas Metzler <ametzler@debian.org> Closes: 1148506 Changes: exim4 (4.98.2-1+deb13u5) trixie-security; urgency=high . * Cherry-pick relevant changes from security release 4.100.1. CVE-2026-94054 EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, has an out-of-bounds write. CVE-2026-94056 EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, allows attackers to read certain uninitialized data from stack memory. CVE-2026-94057 EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1) Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing. Closes: #1148506 (CVE-2026-94055 is not relevant - TLS Early banner support was introduced in 4.99.) Checksums-Sha1: 0728494e6b2f1c23310ce38350a9407c74a63312 2929 exim4_4.98.2-1+deb13u5.dsc 89e08ac252f92df88fc8fef0fa9b9e3cb986be1a 498636 exim4_4.98.2-1+deb13u5.debian.tar.xz Checksums-Sha256: cc5147d1cd8c253da7e539e91a226b4683d720514c86be9e541c81a6b65f394f 2929 exim4_4.98.2-1+deb13u5.dsc 29e30dd3e189de38055a62324b5a6fcf9f68cb291e944beebbb8eaa20efb3416 498636 exim4_4.98.2-1+deb13u5.debian.tar.xz Files: ee66f61601259ca78c83b648f26d2446 2929 mail standard exim4_4.98.2-1+deb13u5.dsc 9a3c8538308f9d44e75a326a592074f2 498636 mail standard exim4_4.98.2-1+deb13u5.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIyBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmq43oEACgkQpU8BhUOC FITTBQ/3ZwJ+xhcbAjs/LU8jr5zDk7GG+W7fg3vpH5DAp18tHYgEkXLL1yrb1IWU 1R6aZp46G68bXbFR/9WFPnGLqz0lAGnrbVMexojhhUqKhDWot8d2CjXq+qVRTqh1 uFwSNYFO9WXEM/82Zc4jHVbfinpPvwFDTMi7uWwTszdfqlRzpqXmV6al9R5erFYP ZbdFLmYObEUyhMhc+U+/qIe/U2bQAKvsLo6mUPo2BLgAXTdZHLK+XGX2eW4KZVj6 jGxK5PHgfkfm25J4zkxqf1a7cZUoBarKTNHsQ5/0McvjiMTYZ4HdSLfOM1IYWCYu +ovV+gWjk7YBJvpJ2j/6P08cR707L2PB3xBRMh0UaEci3F2Da2UkZjnncGwCHvEJ Vq2XzBOHrrk9aRxOyV0Ys+38JjFKPNHozZA6esb9kxC6VcVFFVAWlAyz18uiOVnB XH7PWVyjhY/azPR5HkKYialVRC9xYx8mzuPc6AzlriaR5g2b7pbYHTZ7kQPPihuX f1woxKqJbPtp8ZsSRKXq4lneA6s2K0abRjQhTzdlttEYWfv49U9bRYXPZw/EcKeM sPD2i4Z6+Nnnvm6nM95AUTpbM7+/bzdjqyEU76lb9cp3ZgNwd87WB0fR61U4qwWR scWWFjBCKSXIf3aS/+saF11DjPGK+vOwZgHpMxpqzmII0owUXA== =iVmN -----END PGP SIGNATURE-----
