Summary
USN-4934-1 fixed several vulnerabilities in Exim. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
CVE-2020-28026 only affected Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Exim contained multiple security issues. An attacker
could use these issues to cause a denial of service, execute arbitrary
code remotely, obtain sensitive information, or escalate local privileges.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | exim4 | 4.82-3ubuntu2.4+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | exim4 | 4.86.2-2ubuntu2.6+esm1 |
Vulnerabilities 15
-
Unscored —
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (…
-
Unscored —
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory…
-
Unscored —
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are ac…
-
Unscored —
Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause p…
-
Unscored —
Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privi…
-
Unscored —
Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus ma…
-
Unscored —
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and al…
-
Unscored —
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root process…
-
Unscored —CVE-2020-28017 EPSS 37%
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fif…
-
Unscored —
Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute …
-
Unscored —CVE-2020-28022 Public exploit
Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs whe…
-
Unscored —
Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary c…
-
Unscored —
Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between…
-
Unscored —
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable…
-
Unscored —
Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local…
References
-
report
https://ubuntu.com/security/CVE-2020-28007
-
report
https://ubuntu.com/security/CVE-2020-28008
-
report
https://ubuntu.com/security/CVE-2020-28009
-
report
https://ubuntu.com/security/CVE-2020-28011
-
report
https://ubuntu.com/security/CVE-2020-28012
-
report
https://ubuntu.com/security/CVE-2020-28013
-
report
https://ubuntu.com/security/CVE-2020-28014
-
report
https://ubuntu.com/security/CVE-2020-28015
-
report
https://ubuntu.com/security/CVE-2020-28016
-
report
https://ubuntu.com/security/CVE-2020-28017
-
report
https://ubuntu.com/security/CVE-2020-28020
-
report
https://ubuntu.com/security/CVE-2020-28022
-
report
https://ubuntu.com/security/CVE-2020-28024
-
report
https://ubuntu.com/security/CVE-2020-28025
-
report
https://ubuntu.com/security/CVE-2020-28026
-
report
https://ubuntu.com/security/CVE-2021-27216