exim4 - Debian Package Tracker

general

source: exim4 (main)
version: 4.100~RC3-2
maintainer: Exim4 Maintainers (archive) (DMD)
uploaders: Andreas Metzler [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.94.2-7+deb11u3
o-o-sec: 4.94.2-7+deb11u6
o-o-p-u: 4.94.2-7+deb11u3
oldstable: 4.96-15+deb12u10
old-sec: 4.96-15+deb12u10
old-bpo: 4.98.2-1~bpo12+1
old-p-u: 4.96-15+deb12u10
stable: 4.98.2-1+deb13u3
stable-sec: 4.98.2-1+deb13u4
stable-bpo: 4.99.4-2~bpo13+1
stable-p-u: 4.98.2-1+deb13u4
testing: 4.100~RC3-2
unstable: 4.100~RC3-2

versioned links

4.94.2-7+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.94.2-7+deb11u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.96-15+deb12u10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.98.2-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.98.2-1+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.98.2-1+deb13u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.99.4-1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.99.4-2~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.100~RC3-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

exim4 (64 bugs: 0, 33, 31, 0)
exim4-base (18 bugs: 0, 10, 8, 0)
exim4-config (74 bugs: 0, 30, 44, 0)
exim4-daemon-heavy (16 bugs: 0, 9, 7, 0)
exim4-daemon-light (4 bugs: 0, 3, 1, 0)
exim4-daemon-mod
exim4-dev
exim4-mod-cyrus-sasl
exim4-mod-ldap
exim4-mod-mysql
exim4-mod-pam
exim4-mod-perl
exim4-mod-postgresql
exim4-mod-spf
eximon4

action needed

4 security issues in bullseye high

There are 4 open security issues in bullseye.

2 important issues:

CVE-2026-66140: Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
CVE-2026-66141: Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.

2 issues postponed or untriaged:

CVE-2026-40686: (postponed; to be fixed through a stable update) In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.
CVE-2026-40687: (postponed; to be fixed through a stable update) In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.

Created: 2026-07-23 Last update: 2026-08-19 11:00

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-66140: Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
CVE-2026-66141: Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.

Created: 2026-07-23 Last update: 2026-08-19 11:00

Depends on packages which need a new maintainer normal

The packages that exim4 depends on which need a new maintainer are:

libspf2 (#1141676)
- Depends: libspf2-2t64 libspf2-2t64
- Build-Depends: libspf2-dev
docbook-xsl (#802370)
- Build-Depends: docbook-xsl

Created: 2023-09-01 Last update: 2026-08-21 17:30

1 bug tagged help in the BTS normal

The BTS contains 1 bug tagged help, please consider helping the maintainer in dealing with it.

Created: 2019-03-21 Last update: 2026-08-21 16:30

16 bugs tagged patch in the BTS normal

The BTS contains patches fixing 16 bugs (17 if counting merged bugs), consider including or untagging them.

Created: 2026-08-15 Last update: 2026-08-21 16:30

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit c6eccefab512bf585df936a17896419db20f2932
Author: Andreas Metzler <ametzler@bebt.de>
Date:   Thu Aug 20 18:23:16 2026 +0200

    Point watchfile to release directory again.

https://salsa.debian.org/api/v4/projects/exim-team%2Fexim4 API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-08-20 Last update: 2026-08-20 18:01

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-04-30 Last update: 2026-08-16 00:32

testing migrations

This package will soon be part of the auto-perl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-08-20] exim4 4.100~RC3-2 MIGRATED to testing (Debian testing watch)
[2026-08-15] Accepted exim4 4.100~RC3-2 (source) into unstable (Andreas Metzler)
[2026-08-13] Accepted exim4 4.100~RC3-1 (source) into experimental (Andreas Metzler)
[2026-08-07] Accepted exim4 4.100~RC2-1 (source) into experimental (Andreas Metzler)
[2026-08-01] Accepted exim4 4.100~RC1-1 (source) into experimental (Andreas Metzler)
[2026-08-01] exim4 4.99.4-2 MIGRATED to testing (Debian testing watch)
[2026-07-25] Accepted exim4 4.98.2-1+deb13u4 (source) into proposed-updates (Debian FTP Masters) (signed by: Andreas Metzler)
[2026-07-24] Accepted exim4 4.98.2-1+deb13u4 (source) into stable-security (Debian FTP Masters) (signed by: Andreas Metzler)
[2026-07-24] Accepted exim4 4.99.4-2~bpo13+1 (source) into stable-backports (Andreas Metzler)
[2026-07-22] Accepted exim4 4.99.4-2 (source) into unstable (Andreas Metzler)
[2026-06-13] Accepted exim4 4.99.4-1~bpo13+1 (source) into stable-backports (Andreas Metzler)
[2026-06-12] exim4 4.99.4-1 MIGRATED to testing (Debian testing watch)
[2026-06-05] Accepted exim4 4.94.2-7+deb11u6 (source) into oldoldstable-security (Thorsten Alteholz)
[2026-06-04] Accepted exim4 4.99.4-1 (source) into unstable (Andreas Metzler)
[2026-06-02] exim4 4.99.3-2 MIGRATED to testing (Debian testing watch)
[2026-05-30] Accepted exim4 4.99.3-2~bpo13+1 (source) into stable-backports (Andreas Metzler)
[2026-05-29] Accepted exim4 4.96-15+deb12u10 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Andreas Metzler)
[2026-05-29] Accepted exim4 4.98.2-1+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Andreas Metzler)
[2026-05-29] Accepted exim4 4.99.3-2 (source) into unstable (Andreas Metzler)
[2026-05-29] Accepted exim4 4.98.2-1+deb13u3 (source) into stable-security (Debian FTP Masters) (signed by: Andreas Metzler)
[2026-05-29] Accepted exim4 4.96-15+deb12u10 (source) into oldstable-security (Debian FTP Masters) (signed by: Andreas Metzler)
[2026-05-29] exim4 4.99.3-1 MIGRATED to testing (Debian testing watch)
[2026-05-25] Accepted exim4 4.99.3-1 (source) into unstable (Andreas Metzler)
[2026-05-14] exim4 4.99.2-2 MIGRATED to testing (Debian testing watch)
[2026-05-13] Accepted exim4 4.99.2-2~bpo13+1 (source) into stable-backports (Andreas Metzler)
[2026-05-12] Accepted exim4 4.96-15+deb12u9 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Andreas Metzler)
[2026-05-12] Accepted exim4 4.98.2-1+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Andreas Metzler)
[2026-05-12] Accepted exim4 4.94.2-7+deb11u5 (source) into oldoldstable-security (Thorsten Alteholz)
[2026-05-12] Accepted exim4 4.99.2-2 (source) into unstable (Andreas Metzler)
[2026-05-12] Accepted exim4 4.98.2-1+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Andreas Metzler)

bugs [bug history graph]

all: 177 179
RC: 0
I&N: 85 87
M&W: 92
F&P: 0
patch: 16 17
help: 1

links

homepage
lintian (0, 3)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (92, -)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.99.4-1ubuntu1
patches for 4.99.4-1ubuntu1