[From nobody Fri Oct 2 16:19:08 2026 Received: (at 1148506-close) by bugs.debian.org; 2 Oct 2026 15:17:35 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-112.6 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,MONEY,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,STOCKLIKE,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 80; hammy, 150; neutral, 192; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:36456) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xCf0w-003jTg-1A for 1148506-close@bugs.debian.org; Fri, 02 Oct 2026 15:17:35 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xCf0v-001Jgc-31 for 1148506-close@bugs.debian.org; Fri, 02 Oct 2026 15:17:33 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=/3B0ItjG/ztdvnP5YHPnMFR05KBzKYHSuHXyeUMTclE=; b=YIK1n2cPQ/+8O82YsIyGT2yjPC uf48g0L0sN0zg2695tRhAAprgXpo9VFRXi/eRhxDR7jHxbNQSVMfavJL5U7wMO9fZ5ZqU/qsoK6jU EY8imGZNRNTUKEl1W4w8DtDSwFz7LZuteuktvQCVS2UdVNDjMCn5YrzRUolzjCk78JPaa5UFn5X5z 117Zin3y68sidMXEwi9WbhSjNisu9xD4ZkdtUBl3Xhvv54tHlsrnWgbQeYeIi0XKbs5mDMbShsDNK FMCl/IpQbbo9/BImK9M32K4nQoqz4LK2EA9vb6vpJcywzKUqngGCvAJxq+6vX5RqGqBroNI1Szswr NvJ80h/Q==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xCf0v-000000046yg-0JBK; Fri, 02 Oct 2026 15:17:33 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Andreas Metzler <ametzler@debian.org> To: 1148506-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: exim4 Debian: DAK Debian-Changes: exim4_4.98.2-1+deb13u5_multi.changes Debian-Source: exim4 Debian-Version: 4.98.2-1+deb13u5 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1148506: fixed in exim4 4.98.2-1+deb13u5 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============0738241726913529502==" Message-Id: <E1xCf0v-000000046yg-0JBK@fasolo.debian.org> Date: Fri, 02 Oct 2026 15:17:33 +0000 --===============0738241726913529502== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: exim4 Source-Version: 4.98.2-1+deb13u5 Done: Andreas Metzler <ametzler@debian.org> We believe that the bug you reported is fixed in the latest version of exim4, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1148506@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Andreas Metzler <ametzler@debian.org> (supplier of updated exim4 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 25 Sep 2026 11:25:38 +0200 Source: exim4 Architecture: source Version: 4.98.2-1+deb13u5 Distribution: trixie-security Urgency: high Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org> Changed-By: Andreas Metzler <ametzler@debian.org> Closes: 1148506 Changes: exim4 (4.98.2-1+deb13u5) trixie-security; urgency=3Dhigh . * Cherry-pick relevant changes from security release 4.100.1. CVE-2026-94054 EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, has an out-of-bounds write. CVE-2026-94056 EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, allows attackers to read certain uninitialized data from stack memory. CVE-2026-94057 EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1) Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing. Closes: #1148506 (CVE-2026-94055 is not relevant - TLS Early banner support was introduced in 4.99.) Checksums-Sha1:=20 0728494e6b2f1c23310ce38350a9407c74a63312 2929 exim4_4.98.2-1+deb13u5.dsc 89e08ac252f92df88fc8fef0fa9b9e3cb986be1a 498636 exim4_4.98.2-1+deb13u5.debia= n.tar.xz Checksums-Sha256:=20 cc5147d1cd8c253da7e539e91a226b4683d720514c86be9e541c81a6b65f394f 2929 exim4_= 4.98.2-1+deb13u5.dsc 29e30dd3e189de38055a62324b5a6fcf9f68cb291e944beebbb8eaa20efb3416 498636 exim= 4_4.98.2-1+deb13u5.debian.tar.xz Files:=20 ee66f61601259ca78c83b648f26d2446 2929 mail standard exim4_4.98.2-1+deb13u5.d= sc 9a3c8538308f9d44e75a326a592074f2 498636 mail standard exim4_4.98.2-1+deb13u5= .debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIyBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmq43oEACgkQpU8BhUOC FITTBQ/3ZwJ+xhcbAjs/LU8jr5zDk7GG+W7fg3vpH5DAp18tHYgEkXLL1yrb1IWU 1R6aZp46G68bXbFR/9WFPnGLqz0lAGnrbVMexojhhUqKhDWot8d2CjXq+qVRTqh1 uFwSNYFO9WXEM/82Zc4jHVbfinpPvwFDTMi7uWwTszdfqlRzpqXmV6al9R5erFYP ZbdFLmYObEUyhMhc+U+/qIe/U2bQAKvsLo6mUPo2BLgAXTdZHLK+XGX2eW4KZVj6 jGxK5PHgfkfm25J4zkxqf1a7cZUoBarKTNHsQ5/0McvjiMTYZ4HdSLfOM1IYWCYu +ovV+gWjk7YBJvpJ2j/6P08cR707L2PB3xBRMh0UaEci3F2Da2UkZjnncGwCHvEJ Vq2XzBOHrrk9aRxOyV0Ys+38JjFKPNHozZA6esb9kxC6VcVFFVAWlAyz18uiOVnB XH7PWVyjhY/azPR5HkKYialVRC9xYx8mzuPc6AzlriaR5g2b7pbYHTZ7kQPPihuX f1woxKqJbPtp8ZsSRKXq4lneA6s2K0abRjQhTzdlttEYWfv49U9bRYXPZw/EcKeM sPD2i4Z6+Nnnvm6nM95AUTpbM7+/bzdjqyEU76lb9cp3ZgNwd87WB0fR61U4qwWR scWWFjBCKSXIf3aS/+saF11DjPGK+vOwZgHpMxpqzmII0owUXA=3D=3D =3DiVmN -----END PGP SIGNATURE----- --===============0738241726913529502== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCar/LDQAKCRCb9qggYcy5 IR3nAQDtrXuJw0LxwCjQspWKUSQB5pBTocfv/Aznif41Rt9JPQEA0pQUbtREel3Z IpAP7UY6Hog7hsNamHn+dd4ElDexjgg= =Zc9D -----END PGP SIGNATURE----- --===============0738241726913529502==-- ]