ALT-BU-2023-4214-1
Branch sisyphus_mipsel update bulletin.
Package exim updated to version 4.96-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2022-04829
Уязвимость функции host_name_lookup (host.c) почтового сервера Exim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2022-04830
Уязвимость функции pam_converse (auths/call_pam.c) почтового сервера Exim, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-01672
Уязвимость функционала STARTTLS почтового сервера Exim, связанная с недостаточной нейтрализацией специальных элементов в запросе, позволяющая нарушителю оказать воздействие на целостность данных
Modified: 2024-11-21
CVE-2021-38371
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
Modified: 2024-11-21
CVE-2022-37451
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
- https://cwe.mitre.org/data/definitions/762.html
- https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42
- https://github.com/Exim/exim/compare/exim-4.95...exim-4.96
- https://github.com/Exim/exim/wiki/EximSecurity
- https://github.com/ivd38/exim_invalid_free
- https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html
- FEDORA-2022-1ca1d22165
- FEDORA-2022-f9a8388e62
- https://www.exim.org/static/doc/security/
- https://www.openwall.com/lists/oss-security/2022/08/06/1
- https://cwe.mitre.org/data/definitions/762.html
- https://www.openwall.com/lists/oss-security/2022/08/06/1
- https://www.exim.org/static/doc/security/
- FEDORA-2022-f9a8388e62
- FEDORA-2022-1ca1d22165
- https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html
- https://github.com/ivd38/exim_invalid_free
- https://github.com/Exim/exim/wiki/EximSecurity
- https://github.com/Exim/exim/compare/exim-4.95...exim-4.96
- https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42
Modified: 2024-11-21
CVE-2022-37452
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743
- https://github.com/Exim/exim/compare/exim-4.94...exim-4.95
- https://github.com/Exim/exim/wiki/EximSecurity
- https://github.com/ivd38/exim_overflow
- [debian-lts-announce] 20220827 [SECURITY] [DLA 3082-1] exim4 security update
- https://www.exim.org/static/doc/security/
- https://www.openwall.com/lists/oss-security/2022/08/06/8
- https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743
- https://www.openwall.com/lists/oss-security/2022/08/06/8
- https://www.exim.org/static/doc/security/
- [debian-lts-announce] 20220827 [SECURITY] [DLA 3082-1] exim4 security update
- https://github.com/ivd38/exim_overflow
- https://github.com/Exim/exim/wiki/EximSecurity
- https://github.com/Exim/exim/compare/exim-4.94...exim-4.95