btw there wasn't need for quite so many pings.
On 2021/05/04 15:47, Renaud Allard wrote:
> Embargo has been removed, it's time to commit :)
>
> For further reference a list of related CVEs:
>
> Local vulnerabilities
> - CVE-2020-28007: Link attack in Exim's log directory
> - CVE-2020-28008: Assorted attacks in Exim's spool directory
> - CVE-2020-28014: Arbitrary PID file creation
> - CVE-2020-28011: Heap buffer overflow in queue_run()
> - CVE-2020-28010: Heap out-of-bounds write in main()
> - CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
> - CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
> - CVE-2020-28015: New-line injection into spool header file (local)
> - CVE-2020-28012: Missing close-on-exec flag for privileged pipe
> - CVE-2020-28009: Integer overflow in get_stdinput()
> Remote vulnerabilities
> - CVE-2020-28017: Integer overflow in receive_add_recipient()
> - CVE-2020-28020: Integer overflow in receive_msg()
> - CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
> - CVE-2020-28021: New-line injection into spool header file (remote)
> - CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
> - CVE-2020-28026: Line truncation and injection in spool_read_header()
> - CVE-2020-28019: Failure to reset function pointer after BDAT error
> - CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
> - CVE-2020-28018: Use-after-free in tls-openssl.c
> - CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
>
> On 5/4/21 8:20 AM, Renaud Allard wrote:
> > ping: the disclosure will take place today (2021-05-04 13:30 UTC)
> >
> > On 5/2/21 10:49 AM, Renaud Allard wrote:
> > > Hi,
> > >
> > > There was a problem in exim 4.94.1, so there is now 4.94.2 which
> > > solves the issue. Embargo dates are the same.
> > >
> > > Best Regards
> > >
> > > On 28/04/2021 08:53, Renaud Allard wrote:
> > > > Hello,
> > > >
> > > > Here is an diff to update exim to 4.94.1. This is a very
> > > > important security update.
> > > >
> > > > Unfortunately, this update is embargoed so that "distro" package
> > > > maintainers have the time to publish the packages. This means
> > > > the source tar.gz is not available before 2021-05-04 13:30 UTC.
> > > > I don't know how we could provide packages for -stable before
> > > > the tar is published. I can build them for 6.8, but I can't sign
> > > > them or build for 6.9 yet.
> > > >
> > > > It solves the following CVE:
> > > >
> > > > - CVE-2020-28007
> > > > - CVE-2020-28008
> > > > - CVE-2020-28009
> > > > - CVE-2020-28010
> > > > - CVE-2020-28011
> > > > - CVE-2020-28012
> > > > - CVE-2020-28013
> > > > - CVE-2020-28014
> > > > - CVE-2020-28015
> > > > - CVE-2020-28016
> > > > - CVE-2020-28017
> > > > - CVE-2020-28018
> > > > - CVE-2020-28019
> > > > - CVE-2020-28020
> > > > - CVE-2020-28021
> > > > - CVE-2020-28022
> > > > - CVE-2020-28023
> > > > - CVE-2020-28024
> > > > - CVE-2020-28025
> > > > - CVE-2020-28026
> > > > - CVE-2021-27216
> > > >
> > > > Best Regards
> >
>
