Exim: Multiple vulnerabilities

Background

Exim is a message transfer agent (MTA) designed to be a a highly configurable, drop-in replacement for sendmail.

Description

Multiple vulnerabilities have been discovered in Exim. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker, by connecting to the SMTP listener daemon, could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Furthermore, a local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running the application or escalate privileges.

Workaround

There is no known workaround at this time.

Resolution

All Exim users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=mail-mta/exim-4.94.2"