Dear Exim users, we got reported two possible (related) vulnerabilities in the latest 4.99 release. From the original report:
,--- | In vulnerable configurations, a remote, unauthenticated attacker can | achieve heap corruption. I was unable to develop an end-to-end exploit | chain for remote code execution, but it may be possible with further | work. `--- We do not publish any further details yet, until the fix goes public. While we do not support older versions, please note, that 4.98.1 is not affected. Other versions might or might not be subject to the same attack vector. 2025-11-22: we received a report to [email protected] 2025-11-25: acknowledged the report to the reporter 2025-12-10: this notification ~2025-12-15: publish the fix via the distros repo (accessible for the distro packagers) ~2025-12-18: publish the fix via the default repo (accessible for the public) Once the fixes passed internal testing, we'll update the schedule and send another notification about the coordinated release date(s) for distros and the public. Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
signature.asc
Description: PGP signature
