Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-14 Thread Jan Ingvoldstad via Exim-users
On Sat, Sep 14, 2019 at 2:01 AM Jasen Betts via Exim-users < exim-users@exim.org> wrote: > On 2019-09-13, Jan Ingvoldstad via Exim-users wrote: > > From the Wheezy ELTS package: > [...] > > dpkg-source: info: applying > 92_Fix-base64d-buffer-size-CVE-2018-6789.patch > > dpkg-source: info:

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-13 Thread Jasen Betts via Exim-users
On 2019-09-13, Jan Ingvoldstad via Exim-users wrote: > From the Wheezy ELTS package: [...] > dpkg-source: info: applying 92_Fix-base64d-buffer-size-CVE-2018-6789.patch > dpkg-source: info: applying 93_CVE-2019-15846.patch > it looks like the patch is present already in the debian package, that's

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-13 Thread Jan Ingvoldstad via Exim-users
>From the Wheezy ELTS package: dpkg-source: info: applying 30_dontoverridecflags.dpatch dpkg-source: info: applying 31_eximmanpage.dpatch dpkg-source: info: applying 32_exim4.dpatch dpkg-source: info: applying 33_eximon.binary.dpatch dpkg-source: info: applying 34_eximstatsmanpage.dpatch

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-13 Thread Jasen Betts via Exim-users
On 2019-09-12, Richard Jones via Exim-users wrote: > On Sep 12, Heiko Schlittermann via Exim-users wrote >> If you're out of luck, either upgrade your Debian system to a recent >> one, or prepare to compile Exim on your own. (This is not as hard as it >> seems, but you have to care about further

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Cyborg via Exim-users
Am 12.09.19 um 15:40 schrieb Heiko Schlittermann via Exim-users: > Richard Jones via Exim-users (Do 12 Sep 2019 14:36:41 > CEST): >> On Sep 12, Heiko Schlittermann via Exim-users wrote >>> If you're out of luck, either upgrade your Debian system to a recent >>> one, or prepare to compile Exim on

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Heiko Schlittermann via Exim-users
Dmitriy Matrosov via Exim-users (Do 12 Sep 2019 14:57:24 CEST): > >seems, but you have to care about further updates manually). > > Does the fix in acl discussed recently make such versions more or less secure? Yes, as far as we know, you should be on the safe side with the ACL settings

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Heiko Schlittermann via Exim-users
Richard Jones via Exim-users (Do 12 Sep 2019 14:36:41 CEST): > On Sep 12, Heiko Schlittermann via Exim-users wrote > > If you're out of luck, either upgrade your Debian system to a recent > > one, or prepare to compile Exim on your own. (This is not as hard as it > > seems, but you have to care

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Dmitriy Matrosov via Exim-users
On September 12, 2019 1:46:35 PM GMT+03:00, Heiko Schlittermann via Exim-users wrote: >Bhawna.Kapur--- via Exim-users (Do 12 Sep 2019 >12:25:55 CEST): >> We have Debian 7 (Wheezy) in our environment. > >This is very outdated already. > >> Exim version 4.80 #3 built 14-Mar-2016 20:04:52 >> Is

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Jeremy Harris via Exim-users
On 12/09/2019 13:36, Richard Jones via Exim-users wrote: > On Sep 12, Heiko Schlittermann via Exim-users wrote >> If you're out of luck, either upgrade your Debian system to a recent >> one, or prepare to compile Exim on your own. (This is not as hard as it >> seems, but you have to care about

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Heiko Schlittermann via Exim-users
Richard Jones via Exim-users (Do 12 Sep 2019 14:36:41 CEST): > On Sep 12, Heiko Schlittermann via Exim-users wrote > > If you're out of luck, either upgrade your Debian system to a recent > > one, or prepare to compile Exim on your own. (This is not as hard as it > > seems, but you have to care

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Richard Jones via Exim-users
On Sep 12, Heiko Schlittermann via Exim-users wrote > If you're out of luck, either upgrade your Debian system to a recent > one, or prepare to compile Exim on your own. (This is not as hard as it > seems, but you have to care about further updates manually). I don't suppose anyone has magical

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread pi--- via Exim-users
On 12 Sep 2019 at 10:25:55 +, Bhawna.Kapur--- via Exim-users wrote: > Hello Team, > > We have Debian 7 (Wheezy) in our environment. > > PRETTY_NAME="Debian GNU/Linux 7 (wheezy)" > NAME="Debian GNU/Linux" > VERSION_ID="7" > VERSION="7 (wheezy)" > ID=debian > ANSI_COLOR="1;31" >

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Jeremy Harris via Exim-users
On 12/09/2019 11:25, Bhawna.Kapur--- via Exim-users wrote: > We have Debian 7 (Wheezy) in our environment. > Is this version of exim is vulnerable ? What would you recommend? Ask Debian. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim

Re: [exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Heiko Schlittermann via Exim-users
Bhawna.Kapur--- via Exim-users (Do 12 Sep 2019 12:25:55 CEST): > We have Debian 7 (Wheezy) in our environment. This is very outdated already. > Exim version 4.80 #3 built 14-Mar-2016 20:04:52 > Is this version of exim is vulnerable ? What would you recommend? In the CVE we stated, that *all*

[exim] CVE-2019-15846 ..Exim Vulnerability

2019-09-12 Thread Bhawna.Kapur--- via Exim-users
Hello Team, We have Debian 7 (Wheezy) in our environment. PRETTY_NAME="Debian GNU/Linux 7 (wheezy)" NAME="Debian GNU/Linux" VERSION_ID="7" VERSION="7 (wheezy)" ID=debian ANSI_COLOR="1;31" HOME_URL="http://www.debian.org/; SUPPORT_URL="http://www.debian.org/support/;