Public bug reported:
A new release of exim4 is available for merging from Debian.
Ubuntu: 4.99.4-1ubuntu5
Debian Unstable: 4.100.1-3
### New Debian Changes ###
exim4 (4.100.1-3) unstable; urgency=medium
* Cherry-pick some fixes from upstream GIT master.
+ Fix double const in tls-gnu.c (Broke clang build)
+ JH/07 Bug 3245: fix ${extract} for named fields with leading digits.
In 4.100 a check on the numbered-field variant broke these when the
digits looked like a large number.
+ JH/08 Bug 3252: fix Proxy-Protocol for LOCAL command heartbeat use.
A security update in 4.100.1 caused these to be rejected, requiring a
"pp2-never-send-local" configuration in HAProxy.
* Drop references to external relay tester examples in config.
This also Closes: 1133299
-- Andreas Metzler <[email protected]> Sat, 10 Oct 2026 13:40:13
+0200
exim4 (4.100.1-2) unstable; urgency=high
* Cherry-pick two fixes from upstream GIT master.
* Fix crash on 32bit platforms when delivering to Maildir. Closes: #1149106
-- Andreas Metzler <[email protected]> Sun, 27 Sep 2026 11:50:53
+0200
exim4 (4.100.1-1) unstable; urgency=high
* Upload to unstable.
* New upstream version. Closes: #1148506
CVE-2026-94054 EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1)
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
controlled proxy, has an out-of-bounds write.
CVE-2026-94055 EXIM-Security-2026-09-12.3 (GCVE-25-2026-09-51-1)
Exim before 4.100.1, when certain non-default TLS settings are used
with GnuTLS, has a use-after-free.
CVE-2026-94056 EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1)
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
controlled proxy, allows attackers to read certain uninitialized
data from stack memory.
CVE-2026-94057 EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1)
Exim before 4.100.1 allows SMTP smuggling in which the received
message does not match any sent message, and instead depends on
crafted data sent after a rejection during DATA processing.
-- Andreas Metzler <[email protected]> Tue, 22 Sep 2026 11:25:05
+0200
exim4 (4.100-4) experimental; urgency=low
* Add GNU SASL authenticator module for exim4-daemon-mod. (Closes: #980893)
* Run wrap-and-sort -ast.
* Upload to experimental.
* Add DEP-5 copyright file.
Generated with
cp debian/copyright.template debian/copyright && cme update dpkg-copyright
This is partially broken due to #1135671 and #1139580.
Retain old version in exim4-base's
/usr/share/doc/exim4-base/debian/copyright.readable.gz.
-- Andreas Metzler <[email protected]> Sun, 06 Sep 2026 14:13:30
+0200
exim4 (4.100-3) unstable; urgency=medium
* Drop executable bit from old (formerly dpatch) files.
* Renumber patch files.
* Cherry-pick fix for dovecot 2.4.3 AUTH compat.
-- Andreas Metzler <[email protected]> Sat, 05 Sep 2026 14:06:01
+0200
exim4 (4.100-1) unstable; urgency=medium
* RC3 released without further changes as 4.100.
-- Andreas Metzler <[email protected]> Sat, 22 Aug 2026 13:34:28
+0200
exim4 (4.100~RC3-2) unstable; urgency=low
* Disable some warnings upstream does not care about.
(-Wno-dangling-else -Wno-parentheses)
* Add missing braces in localscan patch.
* Upload to unstable.
-- Andreas Metzler <[email protected]> Sat, 15 Aug 2026 11:29:52
+0200
exim4 (4.100~RC3-1) experimental; urgency=medium
* New upstream rc candidate.
+ Drop cherry-picked patches.
-- Andreas Metzler <[email protected]> Thu, 13 Aug 2026 18:55:51
+0200
exim4 (4.100~RC2-1) experimental; urgency=medium
* New upstream rc candidate.
+ Drop 91_no-hardcode-libnsl-GNUhurd.diff
+ Update copyright info.
* Add some more patches from GIT head.
-- Andreas Metzler <[email protected]> Fri, 07 Aug 2026 18:38:40
+0200
exim4 (4.100~RC1-1) experimental; urgency=medium
* New upstream rc candidate.
* Update build-config.
* Update local_scan patch for new upstream.
Adapt for 6bb19a2ef5 JH/26.
* Enable "psl" and "regdom" lookups. (public suffix)
* Copyright year bumped.
* Use debhelper v14 mode.
-- Andreas Metzler <[email protected]> Sat, 01 Aug 2026 10:49:56
+0200
exim4 (4.99.4-2) unstable; urgency=high
* Fix two local privilege escalation issues.
EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1)
Using command-line arguments intended for transferring queue-name
through an Exim execution chain, files outside the spool area can be
accessed. This can be used for a privilege escalation. CVE-2026-66140
EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3)
A local user having a .forward file can use a string-expansion there.
With certain Exim configurations this can be used as a privilege
escalation. CVE-2026-66141
-- Andreas Metzler <[email protected]> Wed, 22 Jul 2026 18:53:50
+0200
### Old Ubuntu Delta ###
exim4 (4.99.4-1ubuntu5) stonking; urgency=medium
* d/debconf/conf.d/acl/30_exim4-config_check_rcpt: Do not wrap the
spfquery arguments in ${quote:...} since the ${run} command does
not invoke the shell command anymore but invoke the program with
list of args resulting from the command string split (LP: #2165160).
-- Hector Cao <[email protected]> Tue, 08 Sep 2026 16:06:27
+0200
exim4 (4.99.4-1ubuntu4) stonking; urgency=medium
* SECURITY UPDATE: out-of-bounds write when used with attacker-controlled
proxy
- debian/patches/CVE-2026-94054.patch: Proxy-protocol: Fix OOB read in
src/proxy.c.
- CVE-2026-94054
* SECURITY UPDATE: use-after-free with non-default TLS settings
- debian/patches/CVE-2026-94055.patch: GnuTLS: fix early-close under Early
Banner in src/tls-gnu.c.
- CVE-2026-94055
* SECURITY UPDATE: uninitialized stack leak when used with attacker-
controlled proxy
- debian/patches/CVE-2026-94056.patch: Proxy-protocol: account for short
received V2 header in src/proxy.c.
- CVE-2026-94056
* SECURITY UPDATE: SMTP smuggling via crafted data
- debian/patches/CVE-2026-94057.patch: Avoid more "SMTP smuggling" attack
types in src/receive.c.
- CVE-2026-94057
-- Marc Deslauriers <[email protected]> Tue, 22 Sep 2026
14:09:18 -0400
exim4 (4.99.4-1ubuntu3) stonking; urgency=medium
* SECURITY UPDATE: 2026-07 security updates (LP: #2161106)
- debian/patches/202607451-security.patch: Restrict names permitted for
named-queues. in exim_monitor/em_globals.c, src/child.c, src/exim.c,
src/exim_dbmbuild.c, src/exim_dbutil.c, src/functions.h, src/globals.c,
src/globals.h, src/spool_out.c, src/structs.h.
- debian/patches/202607453-security.patch: Do not expand local_part in a
pipe transport under force_command. in src/rda.c, src/transport.c.
- CVE-2026-66140
- CVE-2026-66141
-- Marc Deslauriers <[email protected]> Mon, 31 Aug 2026
13:13:37 -0400
exim4 (4.99.4-1ubuntu2) stonking; urgency=medium
* No-change rebuild against perl 5.42.3
-- Graham Inggs <[email protected]> Sat, 22 Aug 2026 09:43:29 +0000
exim4 (4.99.4-1ubuntu1) stonking; urgency=medium
* Merge with Debian unstable (LP: #2154099). Remaining changes:
- Show Ubuntu distribution in SMTP banner
+ d/p/fix_smtp_banner.patch: Show Ubuntu distribution
in SMTP banner.
+ d/control: Build-Depends on lsb-release to detect Distribution.
- Disable external SPF support to avoid Build-Depends on libspf2-dev
(only available in universe). SPF can still be implemented via
spf-tools-perl, as documented in exim4.conf.template. This reverts
Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
(LP #1952738)
+ d/control: drop Build-Depends on libspf2-dev.
+ d/EDITME.exim4-heavy.diff: disable support for libspf2.
+ d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
on spfquery.mail-spf-perl from spf-tools-perl, but without
the previously supported helo detection.
* New changes:
- Disable SPF for exim4-daemon-mod
+ d/EDITME.exim4-mod.diff, d/control: remove SUPPORT_SPF, remove
the package exim4-mod-spf
+ d/t/spf-disabled: add test to check spf support removal
- d/control: remove systemd-standalone-tmpfiles dep
as it is in universe and needed only for non systemd systems.
* Dropped changes:
- SECURITY UPDATE: Multiple security issues
- debian/patches/CVE-2026-4068x.patch: backported upstream fix.
- CVE-2026-40685 - Possible OOB read/write on corrupt JSON in header
- CVE-2026-40686 - Possible OOB read with large UTF8 trailing chars
- CVE-2026-40687 - Possible OOB read/write with SPA authenticator
[Fixes in upstream 4.99.2]
- SECURITY UPDATE: one-byte write into freed buffer (LP 2152202)
- debian/patches/202605011-security.patch: TLS: on rxd close with CHUNKING
active, clean the input processing stack in src/functions.h,
src/smtp_in.c, src/tls-gnu.c, src/tls-openssl.c.
- unknown
[Fixes in upstream 4.99.3, backported to Debian 4.99.2-2]
- SECURITY UPDATE: information disclosure in PROXYv2 (LP 2154366)
- debian/patches/202605191-security.patch: Security: fix PROXYv2
uninitialised-stack disclosure (EXIM-Security-2026-05-16.1) in
src/proxy.c.
- CVE number pending
[Fixes in upstream v4.99.4, backported to Debian 4.99.3-2]
-- Hector Cao <[email protected]> Fri, 03 Jul 2026 16:35:04
+0200
** Affects: exim4 (Ubuntu)
Importance: Wishlist
Status: New
** Tags: needs-merge upgrade-software-version
** Changed in: exim4 (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: exim4 (Ubuntu)
Milestone: None => ubuntu-27.01
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171123
Title:
Merge exim4 4.100.1-3 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/exim4/+bug/2171123/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
