Ubuntu alert USN-8382-1 (exim4)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8382-1] Exim vulnerabilities | |
| Date: | Wed, 03 Jun 2026 21:22:37 +0000 | |
| Message-ID: | <E1wUt2r-0008FH-GE@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8382-1 June 03, 2026 exim4 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Exim. Software Description: - exim4: Exim is a mail transport agent Details: Timo Longin discovered that Exim incorrectly handled certain SMTP messages in PIPELINING/CHUNKING configurations. A remote attacker could possibly use this issue to perform SMTP smuggling. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-51766) It was discovered that Exim incorrectly handled certain malformed JSON data in headers. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40685) It was discovered that Exim incorrectly handled certain malformed UTF-8 headers. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40686) It was discovered that Exim incorrectly handled certain SPA resources. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40687) It was discovered that Exim incorrectly handled certain CHUNKING transfers in some GnuTLS configurations. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-45185) Warisjeet Singh discovered that Exim incorrectly handled certain proxy connections in builds with proxy support enabled. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-48840) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS exim4 4.93-13ubuntu1.12+esm1 Available with Ubuntu Pro exim4-base 4.93-13ubuntu1.12+esm1 Available with Ubuntu Pro exim4-daemon-heavy 4.93-13ubuntu1.12+esm1 Available with Ubuntu Pro exim4-daemon-light 4.93-13ubuntu1.12+esm1 Available with Ubuntu Pro exim4-dev 4.93-13ubuntu1.12+esm1 Available with Ubuntu Pro eximon4 4.93-13ubuntu1.12+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS exim4 4.90.1-1ubuntu1.10+esm6 Available with Ubuntu Pro exim4-base 4.90.1-1ubuntu1.10+esm6 Available with Ubuntu Pro exim4-daemon-heavy 4.90.1-1ubuntu1.10+esm6 Available with Ubuntu Pro exim4-daemon-light 4.90.1-1ubuntu1.10+esm6 Available with Ubuntu Pro exim4-dev 4.90.1-1ubuntu1.10+esm6 Available with Ubuntu Pro eximon4 4.90.1-1ubuntu1.10+esm6 Available with Ubuntu Pro Ubuntu 16.04 LTS exim4 4.86.2-2ubuntu2.6+esm9 Available with Ubuntu Pro exim4-base 4.86.2-2ubuntu2.6+esm9 Available with Ubuntu Pro exim4-daemon-heavy 4.86.2-2ubuntu2.6+esm9 Available with Ubuntu Pro exim4-daemon-light 4.86.2-2ubuntu2.6+esm9 Available with Ubuntu Pro exim4-dev 4.86.2-2ubuntu2.6+esm9 Available with Ubuntu Pro eximon4 4.86.2-2ubuntu2.6+esm9 Available with Ubuntu Pro Ubuntu 14.04 LTS exim4 4.82-3ubuntu2.4+esm9 Available with Ubuntu Pro exim4-base 4.82-3ubuntu2.4+esm9 Available with Ubuntu Pro exim4-daemon-heavy 4.82-3ubuntu2.4+esm9 Available with Ubuntu Pro exim4-daemon-light 4.82-3ubuntu2.4+esm9 Available with Ubuntu Pro exim4-dev 4.82-3ubuntu2.4+esm9 Available with Ubuntu Pro eximon4 4.82-3ubuntu2.4+esm9 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8382-1 CVE-2023-51766, CVE-2026-40685, CVE-2026-40686, CVE-2026-40687, CVE-2026-45185, CVE-2026-48840
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmogmvwACgkQcpJm3tlz hgG2ohAArDBgt7Pfr/3AjEbNsBAgwI7dwdM5O+fI6df1Y74v2VkbRA9WkfWdf9BX jZtyT7ROfgtczz3Lej1PwHxzVJvmCa5cxFNPCdZiv4BFrxgg2pfSyg2XaoQQRuIx HdG4o0fUPm6ZaEhl1dMpQaphnW7BFo7+2RYXjZP5fX57Wr+wFvC49d23bRI+QQLY KfpRYzx6pw0V9DuphW5svW31CrZA0z714LaVJPhr8wsWn6qLpllWN/WZ7fnB4hOX /XGYW/+RYw1T+fL4eacdnZc3jujUSYXpirVwWJ20cQFa49Q3sdgDn+EdAD9Qm1qW n7LblIGxwH/fKYzN3HlKxYE0U/PMjSsxMezOAm6xsSeyBZbQdA7amB//h8A1mRvD tvIXgkjb7o48QxjHnQH4UVoUTd4eum8h/UO5UXnTnVnrEgMf9fxhdVFMXKv/P5gJ Hr/SCkNIBNLwouzxqUtmCV13FSl/FLSQEx92qQNDvQX2W2zFp6wMCcNDANVsnm/c 7ayVFafwgSuw/5fqp0vmQkU+ruEAZDHK7zaG2L7ntk5MIVOkqZerWLHe0z/PUssS F5RF8SRopHYT5RBmgU+ZRuQXe7GexOxOFpG9gwj4yN439stgpBZTpKXOKVKbhVcr aL/DPOiQivQYZg8jLTUfUx/VGSqWPsdH3JbtXG67f/pC9UoyD1g= =RkuT -----END PGP SIGNATURE-----