Summary
Phillip Szelat discovered that Exim misparses multiline MIME header
filenames. A remote attacker could use this issue to bypass a MIME filename
extension-blocking protection mechanism and possibly deliver executable
attachments to the mailboxes of end users.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | exim4 | 4.93-13ubuntu1.12 |
| Ubuntu · 22.04 LTS 22.04:LTS | exim4 | 4.95-4ubuntu2.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | exim4 | 4.97-4ubuntu4.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | exim4 | 4.86.2-2ubuntu2.6+esm8 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | exim4 | 4.90.1-1ubuntu1.10+esm5 |
Vulnerabilities 1
-
Medium 5.4
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filena…
References
-
report
https://ubuntu.com/security/CVE-2024-39929