Re: [BLFS Trac] #23224: exim-4.99.2

#23224: exim-4.99.2
-------------------------+------------------------------
 Reporter:  Bruce Dubbs  |       Owner:  Douglas R. Reno
     Type:  enhancement  |      Status:  assigned
 Priority:  elevated     |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+------------------------------
Changes (by Douglas R. Reno):

 * owner:  blfs-book => Douglas R. Reno
 * priority:  normal => elevated
 * status:  new => assigned

Comment:

 {{{
 Dear Exim users and maintainers,

 we are pleased to announce the availability of release 4.99.2 of Exim.

 This is a security release.

 It fixes the following vulnerabilities.

 CVE-2026-40684     Possible crash with malicious DNS data when using musl
 libc

    On systems using musl libc (not glibc) due to an oddity in octal
 printing
    it is possible to crash the connection instance when malformed DNS data
    is present in PTR records.

 CVE-2026-40685     Possible OOB read/write on corrupt JSON in header

    configurations using json operators on invalid externally-provided
 input
    could trigger heap corruption.

 CVE-2026-40686     Possible OOB read with large UTF8 trailing characters

    configurations using utf8 operators on malformed utf8 in headers could
    trigger OOB reads and might trigger some data leak if error
    messages are required for subsequent emails in the current connection
    and similar malformed headers are present.

 CVE-2026-40687     Possible OOB read/write with SPA authenticator

    in configurations using the SPA authentication driver to a
 hostile/compromised
    external SPA/NTLM connnection it is possible to trigger an OOB
 read/write
    and crash the connection instance or possibly leak heap data to the
 instance.

 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23224#comment:1>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page