Devuan bug report logs -
#579
Security: Please update exim on beowulf
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to devuan-bugs@lists.dyne.org, devuan-dev@lists.dyne.org:
bug#579; Package exim4.
(Sun, 09 May 2021 08:18:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Klaus Ethgen <Klaus@ethgen.de>:
New bug report received and forwarded. Copy sent to devuan-dev@lists.dyne.org.
(Sun, 09 May 2021 08:18:05 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.devuan.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Package: exim4
Version: 4.92-8+deb10u5
Severity: critical
Tags: security
Please update exim4 to 4.92-8+deb10u6 on beowulf as already in debian.
Version 4.92-8+deb10u5 has several sever security bugs which are fixed
in 4.92-8+deb10u6.
* CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
* CVE-2020-28018: Use-after-free in tls-openssl.c
* CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
* CVE-2020-28010: Heap out-of-bounds write in main()
* CVE-2020-28011: Heap buffer overflow in queue_run()
* CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
* CVE-2020-28017: Integer overflow in receive_add_recipient()
* CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
* CVE-2020-28026: Line truncation and injection in spool_read_header()
* CVE-2020-28015 and CVE-2020-28021: New-line injection into spool header file.
* CVE-2020-28009: Integer overflow in get_stdinput()
* CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
* CVE-2020-28012: Missing close-on-exec flag for privileged pipe
* CVE-2020-28019: Failure to reset function pointer after BDAT error
* CVE-2020-28007: Link attack in Exim's log directory
* CVE-2020-28008: Assorted attacks in Exim's spool directory
* CVE-2020-28014, CVE-2021-27216: Arbitrary PID file creation, clobbering, and deletion.
-- System Information:
Distributor ID: Devuan
Description: Devuan GNU/Linux 3 (beowulf)
Codename: beowulf
Architecture: x86_64
Gruß
Klaus
--
Klaus Ethgen http://www.ethgen.ch/
pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <Klaus@Ethgen.ch>
Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to devuan-bugs@lists.dyne.org, devuan-dev@lists.dyne.org:
bug#579; Package exim4.
(Mon, 10 May 2021 17:33:01 GMT) (full text, mbox, link).
Message #8 received at 579@bugs.devuan.org (full text, mbox, reply):
Control: reassign -1 amprolla
This is an amprolla issue. Reassigning.
Mark
bug reassigned from package 'exim4' to 'amprolla'.
Request was from Mark Hindley <mark@hindley.org.uk>
to 579-submit@bugs.devuan.org.
(Mon, 10 May 2021 17:33:03 GMT) (full text, mbox, link).
No longer marked as found in versions 4.92-8+deb10u5.
Request was from Mark Hindley <mark@hindley.org.uk>
to 579-submit@bugs.devuan.org.
(Mon, 10 May 2021 17:33:03 GMT) (full text, mbox, link).
Reply sent
to Mark Hindley <mark@hindley.org.uk>:
You have taken responsibility.
(Mon, 10 May 2021 17:48:01 GMT) (full text, mbox, link).
Notification sent
to Klaus Ethgen <Klaus@ethgen.de>:
bug acknowledged by developer.
(Mon, 10 May 2021 17:48:04 GMT) (full text, mbox, link).
Message #17 received at 579-done@bugs.devuan.org (full text, mbox, reply):
On Sun, May 09, 2021 at 09:59:55AM +0200, Klaus Ethgen wrote:
> Package: exim4
> Version: 4.92-8+deb10u5
> Severity: critical
> Tags: security
>
> Please update exim4 to 4.92-8+deb10u6 on beowulf as already in debian.
Bad amprolla merge is now fixed (thanks rrq) and the updated exim4 packages are
available in the archive.
Closing.
Mark
Send a report that this bug log contains spam.