[SECURITY] [DLA 2650-1] exim4 security update

2021-05-0510:38:28

lists.debian.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

13.3%

JSON

Debian LTS Advisory DLA-2650-1 [email protected]
https://www.debian.org/lts/security/ Thorsten Alteholz
May 05, 2021 https://wiki.debian.org/LTS

Package : exim4
Version : 4.89-2+deb9u8
CVE ID : CVE-2020-28007 CVE-2020-28008 CVE-2020-28009
CVE-2020-28011 CVE-2020-28012 CVE-2020-28013
CVE-2020-28014 CVE-2020-28015 CVE-2020-28017
CVE-2020-28019 CVE-2020-28020 CVE-2020-28021
CVE-2020-28022 CVE-2020-28023 CVE-2020-28024
CVE-2020-28025 CVE-2020-28026

The Qualys Research Labs reported several vulnerabilities in Exim, a mail
transport agent, which could result in local privilege escalation and
remote code execution.

Details can be found in the Qualys advisory at
https://www.qualys.com/2021/05/04/21nails/21nails.txt

For Debian 9 stretch, these problems have been fixed in version
4.89-2+deb9u8.

We recommend that you upgrade your exim4 packages.

For the detailed security status of exim4 please refer to its security
tracker page at: https://security-tracker.debian.org/tracker/exim4

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10mips64elexim4-daemon-heavy< 4.92-8+deb10u6exim4-daemon-heavy_4.92-8+deb10u6_mips64el.deb
Debian10ppc64elexim4-dev< 4.92-8+deb10u6exim4-dev_4.92-8+deb10u6_ppc64el.deb
Debian10arm64exim4-base< 4.92-8+deb10u6exim4-base_4.92-8+deb10u6_arm64.deb
Debian9allexim4< 4.89-2+deb9u8exim4_4.89-2+deb9u8_all.deb
Debian9i386exim4-dev< 4.89-2+deb9u8exim4-dev_4.89-2+deb9u8_i386.deb
Debian10i386eximon4-dbgsym< 4.92-8+deb10u6eximon4-dbgsym_4.92-8+deb10u6_i386.deb
Debian10ppc64elexim4-daemon-light< 4.92-8+deb10u6exim4-daemon-light_4.92-8+deb10u6_ppc64el.deb
Debian9i386exim4-dbg< 4.89-2+deb9u8exim4-dbg_4.89-2+deb9u8_i386.deb
Debian10mipseximon4< 4.92-8+deb10u6eximon4_4.92-8+deb10u6_mips.deb
Debian10armhfeximon4< 4.92-8+deb10u6eximon4_4.92-8+deb10u6_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	mips64el	exim4-daemon-heavy	< 4.92-8+deb10u6	exim4-daemon-heavy_4.92-8+deb10u6_mips64el.deb
Debian	10	ppc64el	exim4-dev	< 4.92-8+deb10u6	exim4-dev_4.92-8+deb10u6_ppc64el.deb
Debian	10	arm64	exim4-base	< 4.92-8+deb10u6	exim4-base_4.92-8+deb10u6_arm64.deb
Debian	9	all	exim4	< 4.89-2+deb9u8	exim4_4.89-2+deb9u8_all.deb
Debian	9	i386	exim4-dev	< 4.89-2+deb9u8	exim4-dev_4.89-2+deb9u8_i386.deb
Debian	10	i386	eximon4-dbgsym	< 4.92-8+deb10u6	eximon4-dbgsym_4.92-8+deb10u6_i386.deb
Debian	10	ppc64el	exim4-daemon-light	< 4.92-8+deb10u6	exim4-daemon-light_4.92-8+deb10u6_ppc64el.deb
Debian	9	i386	exim4-dbg	< 4.89-2+deb9u8	exim4-dbg_4.89-2+deb9u8_i386.deb
Debian	10	mips	eximon4	< 4.92-8+deb10u6	eximon4_4.92-8+deb10u6_mips.deb
Debian	10	armhf	eximon4	< 4.92-8+deb10u6	eximon4_4.92-8+deb10u6_armhf.deb