- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202402-18
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: Exim: Multiple Vulnerabilities
Date: February 18, 2024
Bugs: #914923, #921520
ID: 202402-18
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been discovered in Exim, the worst of
which can lead to remote code execution.
Background
==========
Exim is a message transfer agent (MTA) designed to be a a highly
configurable, drop-in replacement for sendmail.
Affected packages
=================
Package Vulnerable Unaffected
------------- ------------ ------------
mail-mta/exim < 4.97.1 >= 4.97.1
Description
===========
Multiple vulnerabilities have been discovered in Exim. Please review the
CVE identifiers referenced below for details.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Exim users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-mta/exim-4.97.1"
References
==========
[ 1 ] CVE-2023-42114
https://nvd.nist.gov/vuln/detail/CVE-2023-42114
[ 2 ] CVE-2023-42115
https://nvd.nist.gov/vuln/detail/CVE-2023-42115
[ 3 ] CVE-2023-42116
https://nvd.nist.gov/vuln/detail/CVE-2023-42116
[ 4 ] CVE-2023-42117
https://nvd.nist.gov/vuln/detail/CVE-2023-42117
[ 5 ] CVE-2023-42119
https://nvd.nist.gov/vuln/detail/CVE-2023-42119
[ 6 ] CVE-2023-51766
https://nvd.nist.gov/vuln/detail/CVE-2023-51766
[ 7 ] ZDI-CAN-17433
[ 8 ] ZDI-CAN-17434
[ 9 ] ZDI-CAN-17515
[ 10 ] ZDI-CAN-17554
[ 11 ] ZDI-CAN-17643
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202402-18
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmXRzh8ACgkQFMQkOaVy +9mwOA//axvd81StKHfB0z8M3MLuzm/KnjrfScfBNs4i4mfrPZ2J7HrhduIyLcuV 9AkloBShWaGiuNNiTu/7kS7a2YigketkL69+CwFCMA00G3AyuB3uhQ6Fv6sDs2VF /WbJZmVn0MjtjVINCuuj9SX30XedqmUemU6pCTiHQ+hEBJgMbv56iWiJYfyuVsve 6zgoxd83sLRfRhM/Ktyp9ZveqmtRZ4QBcKgSEum2qBaiUznOb+xogv5m13ibGLD3 N/Bfa72r1fwicEHphW/ED9YGTuBs/33gniHA2k58CPDHW9eyFxObl771tBGZcdL6 etcTrDZZZllwQDvi8VrZ1BWFJupg8Je3luoHJX/c93okK5QcoHQYN23aN5bNWU+Q qmmxfX4NDKecK0qKybKti6TaybDgfMbxzcr8Uxxrh9FyfslMBU95GLTr8Q7IKk2m mSbOgAHtPOgFhFBslrvtFZVLxyF4Tx7LYPPF8TpxwSJnxCKgi1Bwm3gJl1gethm5 tvnNYuLjvgyLMW9EFVLkXrll3pWR6GBZTPxmS99g2wCFGzcZ8PBqScos4P8fxJYx gCYCCAsSfrfLNHNH+5YMstT4UVAkfgy6GK6TMJtrVCJNBuP2aRHqfdNZrFwBV+r2 4BTciYMxiFcxHWZrug/F4VzsjdRbAHnwNAbAA6e7ek1/VSBcnJU=
=9ykX
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)