[SECURITY] [DSA 4912-1] exim4 security update

2021-05-0413:53:56

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

JSON

Debian Security Advisory DSA-4912-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
May 04, 2021 https://www.debian.org/security/faq

Package : exim4
CVE ID : CVE-2020-28007 CVE-2020-28008 CVE-2020-28009 CVE-2020-28010
CVE-2020-28011 CVE-2020-28012 CVE-2020-28013 CVE-2020-28014
CVE-2020-28015 CVE-2020-28017 CVE-2020-28019 CVE-2020-28021
CVE-2020-28022 CVE-2020-28023 CVE-2020-28024 CVE-2020-28025
CVE-2020-28026

The Qualys Research Labs reported several vulnerabilities in Exim, a
mail transport agent, which could result in local privilege escalation
and remote code execution.

Details can be found in the Qualys advisory at
https://www.qualys.com/2021/05/04/21nails/21nails.txt

For the stable distribution (buster), these problems have been fixed in
version 4.92-8+deb10u6.

We recommend that you upgrade your exim4 packages.

For the detailed security status of exim4 please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/exim4

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9arm64exim4-dev< 4.89-2+deb9u8exim4-dev_4.89-2+deb9u8_arm64.deb
Debian10s390xexim4-daemon-light-dbgsym< 4.92-8+deb10u6exim4-daemon-light-dbgsym_4.92-8+deb10u6_s390x.deb
Debian10amd64exim4-daemon-heavy< 4.92-8+deb10u6exim4-daemon-heavy_4.92-8+deb10u6_amd64.deb
Debian9i386exim4-daemon-heavy-dbg< 4.89-2+deb9u8exim4-daemon-heavy-dbg_4.89-2+deb9u8_i386.deb
Debian9amd64exim4-daemon-light< 4.89-2+deb9u8exim4-daemon-light_4.89-2+deb9u8_amd64.deb
Debian10armelexim4-daemon-heavy< 4.92-8+deb10u6exim4-daemon-heavy_4.92-8+deb10u6_armel.deb
Debian10mips64elexim4-daemon-light< 4.92-8+deb10u6exim4-daemon-light_4.92-8+deb10u6_mips64el.deb
Debian9amd64eximon4< 4.89-2+deb9u8eximon4_4.89-2+deb9u8_amd64.deb
Debian9armhfexim4-daemon-heavy-dbg< 4.89-2+deb9u8exim4-daemon-heavy-dbg_4.89-2+deb9u8_armhf.deb
Debian10arm64eximon4-dbgsym< 4.92-8+deb10u6eximon4-dbgsym_4.92-8+deb10u6_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	arm64	exim4-dev	< 4.89-2+deb9u8	exim4-dev_4.89-2+deb9u8_arm64.deb
Debian	10	s390x	exim4-daemon-light-dbgsym	< 4.92-8+deb10u6	exim4-daemon-light-dbgsym_4.92-8+deb10u6_s390x.deb
Debian	10	amd64	exim4-daemon-heavy	< 4.92-8+deb10u6	exim4-daemon-heavy_4.92-8+deb10u6_amd64.deb
Debian	9	i386	exim4-daemon-heavy-dbg	< 4.89-2+deb9u8	exim4-daemon-heavy-dbg_4.89-2+deb9u8_i386.deb
Debian	9	amd64	exim4-daemon-light	< 4.89-2+deb9u8	exim4-daemon-light_4.89-2+deb9u8_amd64.deb
Debian	10	armel	exim4-daemon-heavy	< 4.92-8+deb10u6	exim4-daemon-heavy_4.92-8+deb10u6_armel.deb
Debian	10	mips64el	exim4-daemon-light	< 4.92-8+deb10u6	exim4-daemon-light_4.92-8+deb10u6_mips64el.deb
Debian	9	amd64	eximon4	< 4.89-2+deb9u8	eximon4_4.89-2+deb9u8_amd64.deb
Debian	9	armhf	exim4-daemon-heavy-dbg	< 4.89-2+deb9u8	exim4-daemon-heavy-dbg_4.89-2+deb9u8_armhf.deb
Debian	10	arm64	eximon4-dbgsym	< 4.92-8+deb10u6	eximon4-dbgsym_4.92-8+deb10u6_arm64.deb