Summary
Warisjeet Singh discovered that Exim with SUPPORT_PROXY enabled did not
properly handle memory before SMTP authentication. A remote attacker could
possibly use this issue to obtain sensitive information.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | exim4 | 4.95-4ubuntu2.9 |
| Ubuntu · 24.04 LTS 24.04:LTS | exim4 | 4.97-4ubuntu4.6 |
| Ubuntu · 25.10 | exim4 | 4.98.2-1ubuntu2.3 |
| Ubuntu · 26.04 LTS 26.04:LTS | exim4 | 4.99.1-1ubuntu1.3 |
Vulnerabilities 1
-
Medium 5.3
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of unin…
References
-
report
https://ubuntu.com/security/CVE-2026-48840