[SECURITY] [DLA 3599-1] exim4 security update

2023-10-0216:20:12

lists.debian.org

ntlm

exim4

system updates

cve-2023-42114

debian

mail transport agent

remote code execution

debian lts

spa

cve-2023-42116

security update

security advisories

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

28.9%

JSON

Debian LTS Advisory DLA-3599-1 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
October 02, 2023 https://wiki.debian.org/LTS

Package : exim4
Version : 4.92-8+deb10u8
CVE ID : CVE-2023-42114 CVE-2023-42116

Several vulnerabilities were discovered in Exim, a mail transport agent,
which could result in remote code execution if the SPA/NTLM authenticators
are used.

For Debian 10 buster, these problems have been fixed in version
4.92-8+deb10u8.

We recommend that you upgrade your exim4 packages.

For the detailed security status of exim4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/exim4

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian11mipselexim4-daemon-heavy< 4.94.2-7+deb11u1exim4-daemon-heavy_4.94.2-7+deb11u1_mipsel.deb
Debian12arm64eximon4< 4.96-15+deb12u2eximon4_4.96-15+deb12u2_arm64.deb
Debian12armelexim4-daemon-heavy< 4.96-15+deb12u2exim4-daemon-heavy_4.96-15+deb12u2_armel.deb
Debian12mips64elexim4-daemon-heavy-dbgsym< 4.96-15+deb12u2exim4-daemon-heavy-dbgsym_4.96-15+deb12u2_mips64el.deb
Debian11armeleximon4-dbgsym< 4.94.2-7+deb11u1eximon4-dbgsym_4.94.2-7+deb11u1_armel.deb
Debian10arm64exim4-daemon-light< 4.92-8+deb10u8exim4-daemon-light_4.92-8+deb10u8_arm64.deb
Debian11s390xexim4-base< 4.94.2-7+deb11u1exim4-base_4.94.2-7+deb11u1_s390x.deb
Debian12s390xexim4-daemon-heavy< 4.96-15+deb12u2exim4-daemon-heavy_4.96-15+deb12u2_s390x.deb
Debian12s390xexim4-base-dbgsym< 4.96-15+deb12u2exim4-base-dbgsym_4.96-15+deb12u2_s390x.deb
Debian12arm64exim4-daemon-heavy-dbgsym< 4.96-15+deb12u2exim4-daemon-heavy-dbgsym_4.96-15+deb12u2_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	mipsel	exim4-daemon-heavy	< 4.94.2-7+deb11u1	exim4-daemon-heavy_4.94.2-7+deb11u1_mipsel.deb
Debian	12	arm64	eximon4	< 4.96-15+deb12u2	eximon4_4.96-15+deb12u2_arm64.deb
Debian	12	armel	exim4-daemon-heavy	< 4.96-15+deb12u2	exim4-daemon-heavy_4.96-15+deb12u2_armel.deb
Debian	12	mips64el	exim4-daemon-heavy-dbgsym	< 4.96-15+deb12u2	exim4-daemon-heavy-dbgsym_4.96-15+deb12u2_mips64el.deb
Debian	11	armel	eximon4-dbgsym	< 4.94.2-7+deb11u1	eximon4-dbgsym_4.94.2-7+deb11u1_armel.deb
Debian	10	arm64	exim4-daemon-light	< 4.92-8+deb10u8	exim4-daemon-light_4.92-8+deb10u8_arm64.deb
Debian	11	s390x	exim4-base	< 4.94.2-7+deb11u1	exim4-base_4.94.2-7+deb11u1_s390x.deb
Debian	12	s390x	exim4-daemon-heavy	< 4.96-15+deb12u2	exim4-daemon-heavy_4.96-15+deb12u2_s390x.deb
Debian	12	s390x	exim4-base-dbgsym	< 4.96-15+deb12u2	exim4-base-dbgsym_4.96-15+deb12u2_s390x.deb
Debian	12	arm64	exim4-daemon-heavy-dbgsym	< 4.96-15+deb12u2	exim4-daemon-heavy-dbgsym_4.96-15+deb12u2_arm64.deb