[SECURITY] [DLA 1911-1] exim4 security update

2019-09-0610:38:28

lists.debian.org

128

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.197 Low

EPSS

Percentile

96.2%

JSON

Package : exim4
Version : 4.84.2-2+deb8u6
CVE ID : CVE-2019-15846

"Zerons" and Qualys discovered that a buffer overflow triggerable in the
TLS negotiation code of the Exim mail transport agent could result in the
execution of arbitrary code with root privileges.

For Debian 8 "Jessie", this problem has been fixed in version
4.84.2-2+deb8u6.

We recommend that you upgrade your exim4 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10armelexim4-daemon-light-dbgsym< 4.92-8+deb10u2exim4-daemon-light-dbgsym_4.92-8+deb10u2_armel.deb
Debian10ppc64elexim4-daemon-light-dbgsym< 4.92-8+deb10u2exim4-daemon-light-dbgsym_4.92-8+deb10u2_ppc64el.deb
Debian10mipselexim4-dev< 4.92-8+deb10u2exim4-dev_4.92-8+deb10u2_mipsel.deb
Debian9i386exim4-daemon-heavy< 4.89-2+deb9u6exim4-daemon-heavy_4.89-2+deb9u6_i386.deb
Debian10arm64exim4-base-dbgsym< 4.92-8+deb10u2exim4-base-dbgsym_4.92-8+deb10u2_arm64.deb
Debian8armelexim4-daemon-light< 4.84.2-2+deb8u6exim4-daemon-light_4.84.2-2+deb8u6_armel.deb
Debian8amd64exim4-daemon-heavy-dbg< 4.84.2-2+deb8u6exim4-daemon-heavy-dbg_4.84.2-2+deb8u6_amd64.deb
Debian10mipsexim4-daemon-light< 4.92-8+deb10u2exim4-daemon-light_4.92-8+deb10u2_mips.deb
Debian10i386exim4-daemon-heavy-dbgsym< 4.92-8+deb10u2exim4-daemon-heavy-dbgsym_4.92-8+deb10u2_i386.deb
Debian9mipsexim4-daemon-light-dbg< 4.89-2+deb9u6exim4-daemon-light-dbg_4.89-2+deb9u6_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	armel	exim4-daemon-light-dbgsym	< 4.92-8+deb10u2	exim4-daemon-light-dbgsym_4.92-8+deb10u2_armel.deb
Debian	10	ppc64el	exim4-daemon-light-dbgsym	< 4.92-8+deb10u2	exim4-daemon-light-dbgsym_4.92-8+deb10u2_ppc64el.deb
Debian	10	mipsel	exim4-dev	< 4.92-8+deb10u2	exim4-dev_4.92-8+deb10u2_mipsel.deb
Debian	9	i386	exim4-daemon-heavy	< 4.89-2+deb9u6	exim4-daemon-heavy_4.89-2+deb9u6_i386.deb
Debian	10	arm64	exim4-base-dbgsym	< 4.92-8+deb10u2	exim4-base-dbgsym_4.92-8+deb10u2_arm64.deb
Debian	8	armel	exim4-daemon-light	< 4.84.2-2+deb8u6	exim4-daemon-light_4.84.2-2+deb8u6_armel.deb
Debian	8	amd64	exim4-daemon-heavy-dbg	< 4.84.2-2+deb8u6	exim4-daemon-heavy-dbg_4.84.2-2+deb8u6_amd64.deb
Debian	10	mips	exim4-daemon-light	< 4.92-8+deb10u2	exim4-daemon-light_4.92-8+deb10u2_mips.deb
Debian	10	i386	exim4-daemon-heavy-dbgsym	< 4.92-8+deb10u2	exim4-daemon-heavy-dbgsym_4.92-8+deb10u2_i386.deb
Debian	9	mips	exim4-daemon-light-dbg	< 4.89-2+deb9u6	exim4-daemon-light-dbg_4.89-2+deb9u6_mips.deb