CVE-2026-40687: Missing Initialization of Resource

In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory...

Debian DLA-2213-1 : exim4 security update

It was discovered that exim4, a mail transport agent, suffers from a authentication bypass vulnerability in the spa authentication driver. The spa authentication driver is not enabled by default. For Debian 8 'Jessie', this problem has been fixed in version 4.84.2-2+deb8u7. We recommend that you...

Debian: Security Advisory (DLA-2213-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4687-1 : exim4 - security update

It was discovered that exim4, a mail transport agent, suffers from a authentication bypass vulnerability in the spa authentication driver. The spa authentication driver is not enabled by default. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...