[From nobody Tue Sep 22 10:51:06 2026 Received: (at 1148506-close) by bugs.debian.org; 22 Sep 2026 09:49:47 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.0 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 105; hammy, 150; neutral, 177; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:57956) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x8x8F-0007tm-1E for 1148506-close@bugs.debian.org; Tue, 22 Sep 2026 09:49:47 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x8x8D-003tmH-1A for 1148506-close@bugs.debian.org; Tue, 22 Sep 2026 09:49:45 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=I44uIJ/bRgnCvxglEeLDUNzmQxAx0eRjcmywsVIB2QU=; b=Lb1p4Ynf4lru6CBNPc6Dkz8S2c 2P63iYY4YM+uhGEgC1vE/8k/ZCTHW/5TCXdW6ZnyfPltyv1rKhYRHSsk5KaA4E1yxtCr9kkhN5yP6 ztuEmbvGCbTI6xR7CcamN5JSjOjMgZBTqTk8f8lDvrhbt2v2TvpGJhE/PvW6mWRFH7qPzO4hqOYCS CgTxrxqXeOSN3J4AF9AMLZ8BHqNFuw2QOEQIS02nZMInpoBExU/Gw7altQG45tMr0LVAxh86o1Y7O aTXHRPm2Q2J/6w4rgHDrRHOTtmPdINncQwYPNUoaDX2jqpvxlRSoiglkIKxhon+d1dftDjzy16IrN 93Q6m2Kw==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1x8x8C-0000000Bl0A-0oae; Tue, 22 Sep 2026 09:49:44 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Andreas Metzler <ametzler@debian.org> To: 1148506-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: exim4 Debian: DAK Debian-Changes: exim4_4.100.1-1_multi.changes Debian-Source: exim4 Debian-Version: 4.100.1-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1148506: fixed in exim4 4.100.1-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============4590098640466431796==" Message-Id: <E1x8x8C-0000000Bl0A-0oae@fasolo.debian.org> Date: Tue, 22 Sep 2026 09:49:44 +0000 --===============4590098640466431796== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: exim4 Source-Version: 4.100.1-1 Done: Andreas Metzler <ametzler@debian.org> We believe that the bug you reported is fixed in the latest version of exim4, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1148506@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Andreas Metzler <ametzler@debian.org> (supplier of updated exim4 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 22 Sep 2026 11:25:05 +0200 Source: exim4 Architecture: source Version: 4.100.1-1 Distribution: unstable Urgency: high Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org> Changed-By: Andreas Metzler <ametzler@debian.org> Closes: 1148506 Changes: exim4 (4.100.1-1) unstable; urgency=3Dhigh . * Upload to unstable. * New upstream version. Closes: #1148506 CVE-2026-94054 EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, has an out-of-bounds write. CVE-2026-94055 EXIM-Security-2026-09-12.3 (GCVE-25-2026-09-51-1) Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. CVE-2026-94056 EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, allows attackers to read certain uninitialized data from stack memory. CVE-2026-94057 EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1) Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing. Checksums-Sha1:=20 8f20ed97274414f6d7caecf753175317e2b6eff2 3455 exim4_4.100.1-1.dsc dd1c70a3f8d7494324e5a7b5625c740adb005853 2007956 exim4_4.100.1.orig.tar.xz a2a1e173ad6e447884e2881de1d3f665937d8b16 252 exim4_4.100.1.orig.tar.xz.asc ce2959b55857b2e5a9562dfa4ce22281c472591a 463248 exim4_4.100.1-1.debian.tar.xz Checksums-Sha256:=20 56dd0420a8d0103350f768ca7ada0809b05ba826e7ff59be304b46d98123d636 3455 exim4_= 4.100.1-1.dsc e9fb41f6724a5b136d64c9d19dbc5f26494af879a3e7e3190f91639eaa79fa0d 2007956 exi= m4_4.100.1.orig.tar.xz a94a658998ff794a93db399b9310a60e2382389d9c105de7899293967c93f787 252 exim4_4= .100.1.orig.tar.xz.asc eae0695f7ccb0557bc9bdc1465e51bb8631ee9af325acdc64a586dc8992f06f0 463248 exim= 4_4.100.1-1.debian.tar.xz Files:=20 dfe83c6026f57652ba4090ea498f423a 3455 mail standard exim4_4.100.1-1.dsc 2156671c9739e4e53b7b2fd9357038ab 2007956 mail standard exim4_4.100.1.orig.ta= r.xz c31716f2a37496b674ed60938ba3a6c2 252 mail standard exim4_4.100.1.orig.tar.xz= .asc 65709e8fe50098e470451079dd484035 463248 mail standard exim4_4.100.1-1.debian= .tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmqyS3EACgkQpU8BhUOC FIRLpQ//Wxx5w8hQcUSaZzqug1/PQmOTDn/jCt8+s3AaGpX26ClIHS0aspdo8rB9 multTflfz1mgsvVl2blAgkCaApGYfzl2Hs3omrNnSQG6rNA0EeQSjwPQKapbyhUJ Fj8KZ0XOmh7PBr4tor7Bao+C0VJ+bWkDNglBVFWeB5QI6cEoeG6YAxKnNJtAQVQ0 OpFqqK117G22DNNiWZxzpp8TfkBZVRbs/DGs73tacmDIdUtp498xauTgg7V7OwIr B6T1f0Ir0Raw04TRdtlWWg7B4ZXKv08sxznXWlAZfXXoBXaQCsNIQGtV+Sp/1AYm ETuAyx9Vq6xFtCxXlQc+JN4G70r5MLKocigvLsnV5K/pgzMKrFTZO1ndHRGKP8BP paQd9DbROk0daw0vgNKHg2ngdFV7vIJzD4A1YlCeuHbbk4g8Qb14B65Z3OD0gEvR b8dyBhuRcFEirImAN/JPG+ClpLePLx+nc2iyRoMFkaczvPIsN/j0cKVXFCjSgyw/ MGBjAN/f7UtAEKWBTNuz83A6kiDAemNzQGnSVJyiznqK4Pjdiy6Zx+Elqx3yfl9J dl2nC4gWZZwqJ4xOTzUadpgCymPsDdt9UG2vMfftS+ht0DsJDVNG44armVQSxNKx mHBwfp2Mdi/HBlJnJRG91mzcodpXoqYht40WXAb1N3da2QT9pxE=3D =3DfExs -----END PGP SIGNATURE----- --===============4590098640466431796== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCarJPOAAKCRCb9qggYcy5 IS21AQCXf4li1lW7EtfEev+kCQZA49OgjnInTLpuR1c9nAGikwEAwF0o9WS4opVF F9e0198xWGcIEushmpSA/eEnsY0FPwg= =CrX6 -----END PGP SIGNATURE----- --===============4590098640466431796==-- ]