Devuan bug report logs - #579
Security: Please update exim on beowulf

Package: amprolla; Maintainer for amprolla is Evilham <devuan@evilham.com>;

Reported by: Klaus Ethgen <Klaus@ethgen.de>

Date: Sun, 9 May 2021 08:18:02 UTC

Severity: critical

Done: Mark Hindley <mark@hindley.org.uk>

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to devuan-bugs@lists.dyne.org, devuan-dev@lists.dyne.org:
bug#579; Package exim4. (Sun, 09 May 2021 08:18:02 GMT) (full text, mbox, link).


Acknowledgement sent to Klaus Ethgen <Klaus@ethgen.de>:
New bug report received and forwarded. Copy sent to devuan-dev@lists.dyne.org. (Sun, 09 May 2021 08:18:05 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.devuan.org (full text, mbox, reply):

From: Klaus Ethgen <Klaus@ethgen.de>
To: Devuan Bug Tracking System <submit@bugs.devuan.org>
Subject: Security: Please update exim on beowulf
Date: Sun, 9 May 2021 09:59:55 +0200
[Message part 1 (text/plain, inline)]
Package: exim4
Version: 4.92-8+deb10u5
Severity: critical
Tags: security

Please update exim4 to 4.92-8+deb10u6 on beowulf as already in debian.

Version 4.92-8+deb10u5 has several sever security bugs which are fixed
in 4.92-8+deb10u6.

* CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
* CVE-2020-28018: Use-after-free in tls-openssl.c
* CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
* CVE-2020-28010: Heap out-of-bounds write in main()
* CVE-2020-28011: Heap buffer overflow in queue_run()
* CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
* CVE-2020-28017: Integer overflow in receive_add_recipient()
* CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
* CVE-2020-28026: Line truncation and injection in spool_read_header()
* CVE-2020-28015 and CVE-2020-28021: New-line injection into spool header file.
* CVE-2020-28009: Integer overflow in get_stdinput()
* CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
* CVE-2020-28012: Missing close-on-exec flag for privileged pipe
* CVE-2020-28019: Failure to reset function pointer after BDAT error
* CVE-2020-28007: Link attack in Exim's log directory
* CVE-2020-28008: Assorted attacks in Exim's spool directory
* CVE-2020-28014, CVE-2021-27216: Arbitrary PID file creation, clobbering, and deletion.

-- System Information:
Distributor ID:	Devuan
Description:	Devuan GNU/Linux 3 (beowulf)
Codename:	beowulf
Architecture: x86_64

Gruß
   Klaus
-- 
Klaus Ethgen                                       http://www.ethgen.ch/
pub  4096R/4E20AF1C 2011-05-16            Klaus Ethgen <Klaus@Ethgen.ch>
Fingerprint: 85D4 CA42 952C 949B 1753  62B3 79D0 B06F 4E20 AF1C
[signature.asc (application/pgp-signature, inline)]

Information forwarded to devuan-bugs@lists.dyne.org, devuan-dev@lists.dyne.org:
bug#579; Package exim4. (Mon, 10 May 2021 17:33:01 GMT) (full text, mbox, link).


Message #8 received at 579@bugs.devuan.org (full text, mbox, reply):

From: Mark Hindley <mark@hindley.org.uk>
To: Klaus Ethgen <Klaus@ethgen.de>, 579@bugs.devuan.org
Subject: Re: bug#579: Security: Please update exim on beowulf
Date: Mon, 10 May 2021 18:16:06 +0100
Control: reassign -1 amprolla

This is an amprolla issue. Reassigning.

Mark

bug reassigned from package 'exim4' to 'amprolla'. Request was from Mark Hindley <mark@hindley.org.uk> to 579-submit@bugs.devuan.org. (Mon, 10 May 2021 17:33:03 GMT) (full text, mbox, link).


No longer marked as found in versions 4.92-8+deb10u5. Request was from Mark Hindley <mark@hindley.org.uk> to 579-submit@bugs.devuan.org. (Mon, 10 May 2021 17:33:03 GMT) (full text, mbox, link).


Reply sent to Mark Hindley <mark@hindley.org.uk>:
You have taken responsibility. (Mon, 10 May 2021 17:48:01 GMT) (full text, mbox, link).


Notification sent to Klaus Ethgen <Klaus@ethgen.de>:
bug acknowledged by developer. (Mon, 10 May 2021 17:48:04 GMT) (full text, mbox, link).


Message #17 received at 579-done@bugs.devuan.org (full text, mbox, reply):

From: Mark Hindley <mark@hindley.org.uk>
To: 579-done@bugs.devuan.org
Subject: Re: bug#579: Security: Please update exim on beowulf
Date: Mon, 10 May 2021 18:31:17 +0100
On Sun, May 09, 2021 at 09:59:55AM +0200, Klaus Ethgen wrote:
> Package: exim4
> Version: 4.92-8+deb10u5
> Severity: critical
> Tags: security
> 
> Please update exim4 to 4.92-8+deb10u6 on beowulf as already in debian.

Bad amprolla merge is now fixed (thanks rrq) and the updated exim4 packages are
available in the archive.

Closing.

Mark

Send a report that this bug log contains spam.


Devuan BTS -- Powered by Debian bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.

Devuan Bugs Owner <owner@bugs.devuan.org>.
Last modified: Thu Dec 2 04:26:29 2021;