Ubuntu alert USN-8590-1 (exim4)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8590-1] Exim vulnerabilities
Date:
             
 
Wed, 22 Jul 2026 17:54:58 +0000
Message-ID:
             
 
<E1wmb9m-0007ZH-6A@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8590-1
July 22, 2026

exim4 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in Exim.

Software Description:
- exim4: Exim is a mail transport agent

Details:

It was discovered that Exim incorrectly handled certain command line
options. A local attacker could possibly use this issue to access files
outside of the spool area.

It was discovered that Exim incorrectly handled string expansion in
.local files. A local attacker could possibly use this issue to escalate
privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  exim4                           4.99.1-1ubuntu1.4

Ubuntu 24.04 LTS
  exim4                           4.97-4ubuntu4.7

Ubuntu 22.04 LTS
  exim4                           4.95-4ubuntu2.11

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8590-1
  https://launchpad.net/bugs/2161106

Package Information:
  https://launchpad.net/ubuntu/+source/exim4/4.99.1-1ubuntu1.4
  https://launchpad.net/ubuntu/+source/exim4/4.97-4ubuntu4.7
  https://launchpad.net/ubuntu/+source/exim4/4.95-4ubuntu2.11


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmphA+EACgkQcpJm3tlz
hgE4NRAAujbXk3s+1iGAfKTOvVpgxoXVSKa94cguYpdrpIKCyMPyTXVQv54dV1yz
bW9Qc/A38Xm/xgwMCAofDfUEK1+IAU3nNbqMX0JFNz0O8S9n7fu6L0k0dZ3eft0R
EBlIt+oUcZSighOPaXwLPMbni8pfTy4eDwq1IIVwiMICEQ2C0vhR1WjKrL3jNViP
A9BvmPim07n2o7zkfPga8/IuFtbstpVkZld8o44cxO7qPXGbPEnZe3Uc58FFVgTt
Cmns0FFCXIFHzs7ZVlOGPB/+PV1sRpl4xKDydkSccLUMUGDQRk/ccNazT3qUAkmS
Xy/PCJcIvsm/SvlnR4lgFsX3Ojtg633zNGgYREfM9oD1PlVnFwMSqMg+ZE3GgDPB
EudlWw/wMOv2RhpuljWIgJjHfRPqal3E7LQSsHFctRqC6n8BW2OKPS2mvzMsrZqh
9HtM76Ra1UnNt+qvh9Kg+NwUYn5/x4ztWwdEfugiviMifORLbCB/JfwGKXry88J8
lQLA15b7diXbrTpmIDJTJZ+61vPqXitju0QWdI+qhqh37fr5JoXEB+IPp6LKGLv1
pQzUI87OYM5M11w5hMlh8b+lwdBUF+LmxIIfooB2HCy1hfgtGlnaWlnHuzN9kZJM
Kqb2btg3+C9/fTuMEACUCGdI0f6YiiQkr2jEomF8Dr3H//hxQCI=
=yZvh
-----END PGP SIGNATURE-----