-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 25 Sep 2026 11:25:38 +0200 Source: exim4 Binary: exim4-base exim4-base-dbgsym exim4-daemon-heavy exim4-daemon-heavy-dbgsym exim4-daemon-light exim4-daemon-light-dbgsym exim4-dev eximon4 eximon4-dbgsym Architecture: ppc64el Version: 4.98.2-1+deb13u5 Distribution: trixie-security Urgency: high Maintainer: ppc64el Build Daemon (ppc64el-osuosl-02) Changed-By: Andreas Metzler Description: exim4-base - support files for all Exim MTA (v4) packages exim4-daemon-heavy - Exim MTA (v4) daemon with extended features, including exiscan-ac exim4-daemon-light - lightweight Exim MTA (v4) daemon exim4-dev - header files for the Exim MTA (v4) packages eximon4 - monitor application for the Exim MTA (v4) (X11 interface) Closes: 1148506 Changes: exim4 (4.98.2-1+deb13u5) trixie-security; urgency=high . * Cherry-pick relevant changes from security release 4.100.1. CVE-2026-94054 EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, has an out-of-bounds write. CVE-2026-94056 EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1) Exim before 4.100.1, when Proxy-Protocol is used with an attacker- controlled proxy, allows attackers to read certain uninitialized data from stack memory. CVE-2026-94057 EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1) Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing. Closes: #1148506 (CVE-2026-94055 is not relevant - TLS Early banner support was introduced in 4.99.) Checksums-Sha1: fcdd1ab3eebe7875bf8e8194f70ed49b96b011da 132952 exim4-base-dbgsym_4.98.2-1+deb13u5_ppc64el.deb 14b804f726fc3fd338461149af47778ef2f03020 1146252 exim4-base_4.98.2-1+deb13u5_ppc64el.deb fc431b7f3c18e7d8575de69a4608c0cf9ac263c1 1737652 exim4-daemon-heavy-dbgsym_4.98.2-1+deb13u5_ppc64el.deb 48e04768389a82c398b2a0a4c4a6ec239d4b9237 704988 exim4-daemon-heavy_4.98.2-1+deb13u5_ppc64el.deb 67b8f59b71735b52df5f3275dc4e35cb4ef1ea94 1528600 exim4-daemon-light-dbgsym_4.98.2-1+deb13u5_ppc64el.deb 2d87d499a9a68032a4fb22a9cde561b98116023e 643792 exim4-daemon-light_4.98.2-1+deb13u5_ppc64el.deb 20b7d6cc9122a642f7c49d94d29347065e7e7641 36900 exim4-dev_4.98.2-1+deb13u5_ppc64el.deb 183de511c8d90abec6365c74495c39c096174db1 11564 exim4_4.98.2-1+deb13u5_ppc64el-buildd.buildinfo e0a604fc982b488fcf21f076e5b989eada8a6930 142600 eximon4-dbgsym_4.98.2-1+deb13u5_ppc64el.deb 9cc67d56378481063a8da26c2aab5f3e35e4ae2c 75264 eximon4_4.98.2-1+deb13u5_ppc64el.deb Checksums-Sha256: 1267319a010381dc097b6a47145be3d179107c49f071f484115e693c07822974 132952 exim4-base-dbgsym_4.98.2-1+deb13u5_ppc64el.deb a631e03f5de70e4fe3ce26984f9ec4643c4de1a8cf46a86fcbf24fdc3efccc6a 1146252 exim4-base_4.98.2-1+deb13u5_ppc64el.deb 61602879e9cc05482427b0be1be1932157d0e63c681b4264f098e56689482c9a 1737652 exim4-daemon-heavy-dbgsym_4.98.2-1+deb13u5_ppc64el.deb 12f3bb2202225ef75bff8d3a4036f14a4045a107b43c7f971724a19ee7210241 704988 exim4-daemon-heavy_4.98.2-1+deb13u5_ppc64el.deb 7b0b2a041f69b70c6baf791f9ed54b73c1962c3d91ebaee6d02e2075b23eb2ed 1528600 exim4-daemon-light-dbgsym_4.98.2-1+deb13u5_ppc64el.deb 9e070dcb73721c1601a38a4a8b4060a6ccbf8acd1f0ed9a792be7520137a287a 643792 exim4-daemon-light_4.98.2-1+deb13u5_ppc64el.deb 46f77dd20878efc3bf0edda2f29d368495c87fb4339e4deb2d1ac0f56b7bc490 36900 exim4-dev_4.98.2-1+deb13u5_ppc64el.deb b48e229efebbbea7da402a9fb6f371793f333786112167afb4ef2a9103943aac 11564 exim4_4.98.2-1+deb13u5_ppc64el-buildd.buildinfo 068e7e9427c904fbf8f3e93c9dc06a3ce38b477664a4e9f5ed974a6d5567f945 142600 eximon4-dbgsym_4.98.2-1+deb13u5_ppc64el.deb 6ceff0397459855d690a130dbc6e4bf2a2ff7de6c6aa855126c265187270f54c 75264 eximon4_4.98.2-1+deb13u5_ppc64el.deb Files: 40086c6d855509369a893023496ca2f9 132952 debug optional exim4-base-dbgsym_4.98.2-1+deb13u5_ppc64el.deb 106051078cf5eb72ab3a2689b39560b6 1146252 mail optional exim4-base_4.98.2-1+deb13u5_ppc64el.deb cb589235445042b2aee4fa9be536d83d 1737652 debug optional exim4-daemon-heavy-dbgsym_4.98.2-1+deb13u5_ppc64el.deb 7f533079558a73763819f750708966b0 704988 mail optional exim4-daemon-heavy_4.98.2-1+deb13u5_ppc64el.deb 28e3f4a50da993b910f9bc5de75444ff 1528600 debug optional exim4-daemon-light-dbgsym_4.98.2-1+deb13u5_ppc64el.deb c6097fa6cace3c0456443b0a57e7a4db 643792 mail optional exim4-daemon-light_4.98.2-1+deb13u5_ppc64el.deb a50ceb477192f41921c981bf2ed61ab4 36900 mail optional exim4-dev_4.98.2-1+deb13u5_ppc64el.deb d3307865ba6556375b5525fed2a2d158 11564 mail standard exim4_4.98.2-1+deb13u5_ppc64el-buildd.buildinfo 14a6762eb33442846854a2963db1d194 142600 debug optional eximon4-dbgsym_4.98.2-1+deb13u5_ppc64el.deb b97bacfa552c5136f428d6327d23200b 75264 mail optional eximon4_4.98.2-1+deb13u5_ppc64el.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE9ibmwdV9gdKNbK7oV8ucRsMTpuMFAmq45PoACgkQV8ucRsMT puOZHhAAqGWFWqPn4Ngcb1VFv7U/SxlT3M+yOVpXMRyketT63mZQqOX6C5VAE/0A P1dmx50BMsdjF3ScT43XI8cbceheLlPsWnADdGk47ZH3D1nhaPjGgYTVYDyZgSuf 0z8YJN74itJLUGXP5fecHeW7V8Fc1FBV3QOJWw1Xj9oCTtqZ5c/BhkA0+2QgiMfR ScU4hkZvHS2tRloZdALiou/SdV9EBNjfN4xRJ55pbf/rVM1P5VG7GctNRHyKtyrm QN+lQIf+DwkaSnrWGvn8TjBc1xxbYiMp/LR4Lfh8L5X+QwP8DMVJC/IeVSKVITuk oRbfPW6GkhqjcZj/ZY4sKn6cbbF+Jou/dDFD1IihA7nWHzfaQpcbudo4mCZnEnsu LAX/U7ZefmM7+dafle1G+UcE7vuhIscptFqeGHvb+mRwNCZyhQiX6TN6EWjDC2kr n2v4cRpXvdY4TuZTKFIv0xrn9ScvCG1T7O3MvqfbTCCTuUTVDA+vJULbgjbKQqsU LPn5kQMHqyD7mSJBQ6fLnuRl3sYpp9w+5iP7kaZeL69DTyONVz2BSRww2KgBkDTq mpL/nwIrHeTnTtWjVA8tPtn3R4zqhrAoehLNUb3abhdef6jNzqu5O6oGowcdwVk/ KQZ3dorYEnRUv174CwG6M5h06dzMzmn4CnNlbVacOnE7cAEvUpQ= =HDSJ -----END PGP SIGNATURE-----