critique
CVE-2026-40687
In Exim before 4.99.2, when the SPA authentication driver is used with ...
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Ubuntu (moyenne).
Description
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.23 | exim | 4.98.2-r0 |
| alpine 3.24 | exim | 4.98.2-r0 |
| alpine edge | exim | 4.98.2-r0 |
| chainguard | exim | 4.99.5-r0 |
| debian 11 | exim4 | pas de correctif indiqué |
| debian 12 | exim4 | 4.96-15+deb12u9 |
| debian 13 | exim4 | 4.98.2-1+deb13u2 |
| debian 14 | exim4 | 4.99.2-1 |
| echo | exim4 | 4.96-15+deb12u9 |
| rapidfort debian 12 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort debian 13 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort fedora 43 | exim, exim-clamav, exim-greylist et 3 autres | 4.99.2-1.fc43 |
Afficher les 38 entrées de 23 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.23 | exim | 4.98.2-r0 |
| alpine 3.24 | exim | 4.98.2-r0 |
| alpine edge | exim | 4.98.2-r0 |
| chainguard | exim | 4.99.5-r0 |
| debian 11 | exim4 | pas de correctif indiqué |
| debian 12 | exim4 | 4.96-15+deb12u9 |
| debian 13 | exim4 | 4.98.2-1+deb13u2 |
| debian 14 | exim4 | 4.99.2-1 |
| echo | exim4 | 4.96-15+deb12u9 |
| rapidfort debian 12 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort debian 13 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort fedora 43 | exim | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-clamav | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-greylist | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-mon | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-mysql | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-pgsql | 4.99.2-1.fc43 |
| rapidfort Oracle Linux 10 | exim | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-clamav | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-greylist | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-mon | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-mysql | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-pgsql | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 9 | exim | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-clamav | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-greylist | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-mon | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-mysql | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-pgsql | 4.99.2-1.el9 |
| rapidfort ubuntu 20.04 | exim4 | 0:4.95-4ubuntu2.7, 0:4.97-4ubuntu4.4, 0:4.99.1-1ubuntu1.1 |
| rapidfort ubuntu 22.04 | exim4 | 0:4.95-4ubuntu2.7, 0:4.97-4ubuntu4.4, 0:4.99.1-1ubuntu1.1 |
| rapidfort ubuntu 24.04 | exim4 | 0:4.95-4ubuntu2.7, 0:4.97-4ubuntu4.4, 0:4.99.1-1ubuntu1.1 |
| ubuntu 20.04-ESM | exim4 | 4.93-13ubuntu1.12+esm1 |
| ubuntu 22.04 | exim4 | 4.95-4ubuntu2.7 |
| ubuntu 24.04 | exim4 | 4.97-4ubuntu4.4 |
| ubuntu 25.10 | exim4 | 4.98.2-1ubuntu2.1 |
| ubuntu 26.04 | exim4 | 4.99.1-1ubuntu1.1 |
| wolfi | exim | 4.99.5-r0 |
Références
- https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505
- https://exim.org/static/doc/security/CVE-2026-40687.txt
- https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment
- https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html
- https://ubuntu.com/security/notices/USN-8228-1
- https://ubuntu.com/security/notices/USN-8382-1
- https://www.cve.org/CVERecord?id=CVE-2026-40687
- https://www.openwall.com/lists/oss-security/2026/04/30/21