Opened 3 weeks ago

Closed 3 weeks ago

#23977 closed enhancement (fixed)

exim-4.100.1

Reported by: Bruce Dubbs Owned by: Bruce Dubbs
Priority: elevated Milestone: 98-Security
Component: BOOK Version: git
Severity: high Keywords:
Cc:

Description

New point version.

Change History (4)

comment:1 by Joe Locash, 3 weeks ago

Priority: normal → elevated
Severity: normal → high
Summary: exim-4.100,1 → exim-4.100.1 
Exim version 4.100.1
--------------------

This is a security release.

JH/01 Proxy Protocol: fix an OOB read in V1 protocol header parsing
      (GCVE-25-2026-09-50-1).

JH/02 Proxy-protocol: account for incomplete V2 protocol header reception.
      Previously uninitialised data was then used for the length field of the
      header, giving possible data leakage to an attacker.  This would require
      a buggy or compromised proxy.  (GCVE-25-2026-09-55-1).

JH/03 GnuTLS: Account for an early close from a client, during session startup.
      Previously a use-after-free could occur.  (GCVE-25-2026-09-51-1)

JH/04 Avoid more "SMTP smuggling" attack types.  This extends the fixes for
      CVE-2023-51766.  (GCVE-25-2026-09-56-1).

comment:2 by Bruce Dubbs, 3 weeks ago

Owner: changed from blfs-book to Bruce Dubbs
Status: new → assigned

comment:3 by Bruce Dubbs, 3 weeks ago

Milestone: 13.2 → 98-Security

Updated at commits: 

ab19503cf0 Update to bind and bind utilities 9.20.29 (Security Update).
577c00681d Update to exim-4.100.1 (Security Update).

Leaving open for SA.

comment:4 by Bruce Dubbs, 3 weeks ago

Resolution: → fixed
Status: assigned → closed

Advisory sa-13.1-032 has been issued.

Note: See TracTickets for help on using tickets.