This bug was fixed in the package exim4 - 4.99.4-1ubuntu3
---------------
exim4 (4.99.4-1ubuntu3) stonking; urgency=medium
* SECURITY UPDATE: 2026-07 security updates (LP: #2161106)
- debian/patches/202607451-security.patch: Restrict names permitted for
named-queues. in exim_monitor/em_globals.c, src/child.c, src/exim.c,
src/exim_dbmbuild.c, src/exim_dbutil.c, src/functions.h, src/globals.c,
src/globals.h, src/spool_out.c, src/structs.h.
- debian/patches/202607453-security.patch: Do not expand local_part in a
pipe transport under force_command. in src/rda.c, src/transport.c.
- CVE-2026-66140
- CVE-2026-66141
-- Marc Deslauriers <[email protected]> Mon, 31 Aug 2026
13:13:37 -0400
** Changed in: exim4 (Ubuntu Stonking)
Status: Confirmed => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2026-66140
** CVE added: https://cve.org/CVERecord?id=CVE-2026-66141
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161106
Title:
Exim 2026-07 security update
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/exim4/+bug/2161106/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
