Re: [embargoed security update] mail/exim -> 4.94.2

[Renaud Allard]

Embargo has been removed, it's time to commit :)

For further reference a list of related CVEs:

    Local vulnerabilities
    - CVE-2020-28007: Link attack in Exim's log directory
    - CVE-2020-28008: Assorted attacks in Exim's spool directory
    - CVE-2020-28014: Arbitrary PID file creation
    - CVE-2020-28011: Heap buffer overflow in queue_run()
    - CVE-2020-28010: Heap out-of-bounds write in main()
    - CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
    - CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
    - CVE-2020-28015: New-line injection into spool header file (local)
    - CVE-2020-28012: Missing close-on-exec flag for privileged pipe
    - CVE-2020-28009: Integer overflow in get_stdinput()
    Remote vulnerabilities
    - CVE-2020-28017: Integer overflow in receive_add_recipient()
    - CVE-2020-28020: Integer overflow in receive_msg()
    - CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
    - CVE-2020-28021: New-line injection into spool header file (remote)
    - CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
    - CVE-2020-28026: Line truncation and injection in spool_read_header()
    - CVE-2020-28019: Failure to reset function pointer after BDAT error
    - CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
    - CVE-2020-28018: Use-after-free in tls-openssl.c
    - CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()

On 5/4/21 8:20 AM, Renaud Allard wrote:

ping: the disclosure will take place today (2021-05-04 13:30 UTC)

On 5/2/21 10:49 AM, Renaud Allard wrote:

Hi,



Best Regards

On 28/04/2021 08:53, Renaud Allard wrote:

There was a problem in exim 4.94.1, so there is now 4.94.2 which solves the issue. Embargo dates are the same.

Hello,





It solves the following CVE:

- CVE-2020-28007
- CVE-2020-28008
- CVE-2020-28009
- CVE-2020-28010
- CVE-2020-28011
- CVE-2020-28012
- CVE-2020-28013
- CVE-2020-28014
- CVE-2020-28015
- CVE-2020-28016
- CVE-2020-28017
- CVE-2020-28018
- CVE-2020-28019
- CVE-2020-28020
- CVE-2020-28021
- CVE-2020-28022
- CVE-2020-28023
- CVE-2020-28024
- CVE-2020-28025
- CVE-2020-28026
- CVE-2021-27216

Best Regards

Here is an diff to update exim to 4.94.1. This is a very important security update. Unfortunately, this update is embargoed so that "distro" package maintainers have the time to publish the packages. This means the source tar.gz is not available before 2021-05-04 13:30 UTC. I don't know how we could provide packages for -stable before the tar is published. I can build them for 6.8, but I can't sign them or build for 6.9 yet.

smime.p7s
Description: S/MIME Cryptographic Signature