-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 25 Sep 2026 11:25:38 +0200 Source: exim4 Binary: exim4-base exim4-base-dbgsym exim4-daemon-heavy exim4-daemon-heavy-dbgsym exim4-daemon-light exim4-daemon-light-dbgsym exim4-dev eximon4 eximon4-dbgsym Architecture: armhf Version: 4.98.2-1+deb13u5 Distribution: trixie-security Urgency: high Maintainer: armhf Build Daemon (arm-conova-01) Changed-By: Andreas Metzler Description: exim4-base - support files for all Exim MTA (v4) packages exim4-daemon-heavy - Exim MTA (v4) daemon with extended features, including exiscan-ac exim4-daemon-light - lightweight Exim MTA (v4) daemon exim4-dev - header files for the Exim MTA (v4) packages eximon4 - monitor application for the Exim MTA (v4) (X11 interface) Closes: 1148506 Changes: exim4 (4.98.2-1+deb13u5) trixie-security; urgency=high . * Cherry-pick relevant changes from security release 4.100.1. CVE-2026-94054 EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, has an out-of-bounds write. CVE-2026-94056 EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, allows attackers to read certain uninitialized data from stack memory. CVE-2026-94057 EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1) Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing. Closes: #1148506 (CVE-2026-94055 is not relevant - TLS Early banner support was introduced in 4.99.) Checksums-Sha1: e438dd8b56e96ae6cea139596580532e87c1682a 131588 exim4-base-dbgsym_4.98.2-1+deb13u5_armhf.deb 9aca3c29fbd90bcbaface59fb87d13a5476108d3 1140236 exim4-base_4.98.2-1+deb13u5_armhf.deb 42bb6c814ab203ffa736173300eadc313ef04d73 1680284 exim4-daemon-heavy-dbgsym_4.98.2-1+deb13u5_armhf.deb 1702aecff0e6eda00d07490f29c30764815d5f2f 638540 exim4-daemon-heavy_4.98.2-1+deb13u5_armhf.deb e083ef429c7a1f47e0522590e5db3f63887692b1 1476752 exim4-daemon-light-dbgsym_4.98.2-1+deb13u5_armhf.deb 4fde749bdb43b3904d88ee5077a4685305dbb3d3 583052 exim4-daemon-light_4.98.2-1+deb13u5_armhf.deb 6c312e4cb358e163baa9709243d2aab0cd06ff13 36920 exim4-dev_4.98.2-1+deb13u5_armhf.deb 16d75077705ff245c813c8448b82b96eb15d69f8 11389 exim4_4.98.2-1+deb13u5_armhf-buildd.buildinfo ff60b590fa5a2ff2b7e089b608cd0f52df67d7fb 138612 eximon4-dbgsym_4.98.2-1+deb13u5_armhf.deb 13672d697cabd6f61a7bf41ed75531c255cc9a14 68316 eximon4_4.98.2-1+deb13u5_armhf.deb Checksums-Sha256: cb024f18251f7803fdf08c31d1fb1b517a5c3ec5aa4e6f87f26225571a2e5c49 131588 exim4-base-dbgsym_4.98.2-1+deb13u5_armhf.deb 13aa9640ad0c4447321e6e017200d94da672f12ba7bc37f29c1e2abb72d6e1e0 1140236 exim4-base_4.98.2-1+deb13u5_armhf.deb 0b8fc7cc57ffb7f706c3e051e621292258c4e4d170ad061139fc920e5f8a8580 1680284 exim4-daemon-heavy-dbgsym_4.98.2-1+deb13u5_armhf.deb a8967b577202482ead9d14afb66124ea5867ffce887b76b1dac63060b0a1a857 638540 exim4-daemon-heavy_4.98.2-1+deb13u5_armhf.deb 2e0d2074696db99fe1a890dcd6c0c9e4487ef98457f6ff7ca078aeb96beed406 1476752 exim4-daemon-light-dbgsym_4.98.2-1+deb13u5_armhf.deb 92d5e92fcdf3af1defeb2f850f0b897c845cb13618a8355ea50f3726b56c4414 583052 exim4-daemon-light_4.98.2-1+deb13u5_armhf.deb b58aa416200c049f166f535c2969c327691289e0e3eacf55a5471660b6250e71 36920 exim4-dev_4.98.2-1+deb13u5_armhf.deb 56f52618532973498281f6509f22bd1d8a44185329d14c5868f2af92810262b1 11389 exim4_4.98.2-1+deb13u5_armhf-buildd.buildinfo 582840b36cc4edcab190ec5f623acc7ab83cc0174463630c97aacca6dbdf2927 138612 eximon4-dbgsym_4.98.2-1+deb13u5_armhf.deb e0b490ab8ac55949b321ddf8cb358958be369adb52cd27a917096de813b7cd36 68316 eximon4_4.98.2-1+deb13u5_armhf.deb Files: 000fc38f17eee23afae1e2bc7700083d 131588 debug optional exim4-base-dbgsym_4.98.2-1+deb13u5_armhf.deb 48d74ab1ad4c4838c730e141ff0b4064 1140236 mail optional exim4-base_4.98.2-1+deb13u5_armhf.deb 2718f0b113b9bd9985cae8d50b99399b 1680284 debug optional exim4-daemon-heavy-dbgsym_4.98.2-1+deb13u5_armhf.deb fa28cae4552382b83ea863922acead50 638540 mail optional exim4-daemon-heavy_4.98.2-1+deb13u5_armhf.deb 1690cb2984df081b0705b44e3fbc98f5 1476752 debug optional exim4-daemon-light-dbgsym_4.98.2-1+deb13u5_armhf.deb 0e14550e8b0fc55c7928423382f9524b 583052 mail optional exim4-daemon-light_4.98.2-1+deb13u5_armhf.deb c76f757950d2d897555228e5745eae28 36920 mail optional exim4-dev_4.98.2-1+deb13u5_armhf.deb c3f2f61feefc12199d87ff9142cdfba0 11389 mail standard exim4_4.98.2-1+deb13u5_armhf-buildd.buildinfo 86e2b64d181a2cb346d81021fc90f4d9 138612 debug optional eximon4-dbgsym_4.98.2-1+deb13u5_armhf.deb f04186b498ab575d55ba64478a2de4aa 68316 mail optional eximon4_4.98.2-1+deb13u5_armhf.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO4qAQUSIo2p/kVRf8U6eOZMpj68FAmq45SUACgkQ8U6eOZMp j6+pMQ/9EzsLrj+cghtYZtLsvtAqpEf+oh34zmjWL4agNm4/OjDG4dv1L82DAOHQ 4BmCOws4547G3rfm4IklqWMn77DRAcTm4HdPq49VQDvJdBUJKd6aPsjmxORofh69 200k01Yjt956+pPampwcscrPwelCYcjckxe5pZzm+Fcbx32SwpeBow1p3sTirS/A /HEp1N39oZCKSnP4rfPFzVh54QEgMyyOkvFIBNFsRw3yhUME4oSdFgpQtAZRhHJT oys9EU38NgTor5TmQMVrvKSBKx5pKJmaqeEG9+U3Hwc6aKuHu1bK6HQHPEN3gNyh jq9sb6G/PSu6Os/LiGq7hWSJqxQAru7A2+4mMaioQw9kbFRjHerg174ATX/CUVMW mbgNUqtBil4qZTuf2QYRSIT3K2yphB57IJ4UytkKldwE8HvONgGCElO2CKDolANH CLacbbzdnVpm00ce+q4QsFAVnsGGOlMXcI+zvgwGIYBLeYV/5AK3oXmVv97b1uVu dj7ttPzpPsqdVvNZaRL8c3IWkWcDZ6C2Tjn+5SR/KOqYMKiVxFbcVNWjiB7813Vz pmJiMEXjKpgkwnITG8fhR2Uw4VW0Mo4iNpQegbR2u8rOz4WbtYEsMp/In8i33hx6 oycYqKbzcHePyRifSq0PjP7JChciqytTEwFwVoEryv7fAzpx3os= =uUlB -----END PGP SIGNATURE-----