kritik
CVE-2026-40687
In Exim before 4.99.2, when the SPA authentication driver is used with ...
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Ubuntu (orta).
Açıklama
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.23 | exim | 4.98.2-r0 |
| alpine 3.24 | exim | 4.98.2-r0 |
| alpine edge | exim | 4.98.2-r0 |
| chainguard | exim | 4.99.5-r0 |
| debian 11 | exim4 | düzeltme belirtilmemiş |
| debian 12 | exim4 | 4.96-15+deb12u9 |
| debian 13 | exim4 | 4.98.2-1+deb13u2 |
| debian 14 | exim4 | 4.99.2-1 |
| echo | exim4 | 4.96-15+deb12u9 |
| rapidfort debian 12 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort debian 13 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort fedora 43 | exim, exim-clamav, exim-greylist ve 3 tane daha | 4.99.2-1.fc43 |
23 kaynaktaki 38 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.23 | exim | 4.98.2-r0 |
| alpine 3.24 | exim | 4.98.2-r0 |
| alpine edge | exim | 4.98.2-r0 |
| chainguard | exim | 4.99.5-r0 |
| debian 11 | exim4 | düzeltme belirtilmemiş |
| debian 12 | exim4 | 4.96-15+deb12u9 |
| debian 13 | exim4 | 4.98.2-1+deb13u2 |
| debian 14 | exim4 | 4.99.2-1 |
| echo | exim4 | 4.96-15+deb12u9 |
| rapidfort debian 12 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort debian 13 | exim4 | 0:4.98.2-1+deb13u2, 0:4.99.2-1 |
| rapidfort fedora 43 | exim | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-clamav | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-greylist | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-mon | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-mysql | 4.99.2-1.fc43 |
| rapidfort fedora 43 | exim-pgsql | 4.99.2-1.fc43 |
| rapidfort Oracle Linux 10 | exim | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-clamav | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-greylist | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-mon | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-mysql | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 10 | exim-pgsql | 4.99.2-1.el10_3 |
| rapidfort Oracle Linux 9 | exim | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-clamav | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-greylist | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-mon | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-mysql | 4.99.2-1.el9 |
| rapidfort Oracle Linux 9 | exim-pgsql | 4.99.2-1.el9 |
| rapidfort ubuntu 20.04 | exim4 | 0:4.95-4ubuntu2.7, 0:4.97-4ubuntu4.4, 0:4.99.1-1ubuntu1.1 |
| rapidfort ubuntu 22.04 | exim4 | 0:4.95-4ubuntu2.7, 0:4.97-4ubuntu4.4, 0:4.99.1-1ubuntu1.1 |
| rapidfort ubuntu 24.04 | exim4 | 0:4.95-4ubuntu2.7, 0:4.97-4ubuntu4.4, 0:4.99.1-1ubuntu1.1 |
| ubuntu 20.04-ESM | exim4 | 4.93-13ubuntu1.12+esm1 |
| ubuntu 22.04 | exim4 | 4.95-4ubuntu2.7 |
| ubuntu 24.04 | exim4 | 4.97-4ubuntu4.4 |
| ubuntu 25.10 | exim4 | 4.98.2-1ubuntu2.1 |
| ubuntu 26.04 | exim4 | 4.99.1-1ubuntu1.1 |
| wolfi | exim | 4.99.5-r0 |
Referanslar
- https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505
- https://exim.org/static/doc/security/CVE-2026-40687.txt
- https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment
- https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html
- https://ubuntu.com/security/notices/USN-8228-1
- https://ubuntu.com/security/notices/USN-8382-1
- https://www.cve.org/CVERecord?id=CVE-2026-40687
- https://www.openwall.com/lists/oss-security/2026/04/30/21