-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 02 May 2026 11:31:20 +0200
Source: exim4
Architecture: source
Version: 4.98.2-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Closes: 1134984
Changes:
 exim4 (4.98.2-1+deb13u1) trixie; urgency=medium
 .
   * Fix GnuTLS hostname verify of a server certificate with a zero-length
     Subject. Patch from upstream GIT master (Closes: #1134984)
   * Pull CVE-fixes from 4.99.2
     +CVE-2026-40684  Possible crash with malicious DNS data when using musl
      libc On systems using musl libc (not glibc) due to an oddity in octal
      printing it is possible to crash the connection instance when malformed
      DNS data is present in PTR records.
     +CVE-2026-40685  Possible OOB read/write on corrupt JSON in header
      configurations using json operators on invalid externally-provided input
      could trigger heap corruption.
     +CVE-2026-40686  Possible OOB read with large UTF8 trailing characters
      configurations using utf8 operators on malformed utf8 in headers could
      trigger OOB reads and might trigger some data leak if error messages are
      required for subsequent emails in the current connection and similar
      malformed headers are present.
     +CVE-2026-40687  Possible OOB read/write with SPA authenticator in
      configurations using the SPA authentication driver to a
      hostile/compromised external SPA/NTLM connection it is possible to
      trigger an OOB read/write and crash the connection instance or possibly
      leak heap data to the instance.
Checksums-Sha1: 
 7c7ed3e5a10ef5de08f0dfff8e5972a79caff163 2929 exim4_4.98.2-1+deb13u1.dsc
 67aec85babe34388344c3725a84bf2e08ebdd63a 489460 exim4_4.98.2-1+deb13u1.debian.tar.xz
Checksums-Sha256: 
 dfc63bb64d022e9f0282033f9523ef84b7e30e4f1adaed9b774b2ee041a50d0b 2929 exim4_4.98.2-1+deb13u1.dsc
 d27da3d7fa1dd1b0c57f96b045c8709ce9d245bd6cce3e4adb520a3bfbf5d302 489460 exim4_4.98.2-1+deb13u1.debian.tar.xz
Files: 
 02e87a0a40b6b7af9c1f1d2ce97645ea 2929 mail standard exim4_4.98.2-1+deb13u1.dsc
 7d03630deaf880609248c00b0426ec97 489460 mail standard exim4_4.98.2-1+deb13u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmn3L7QACgkQpU8BhUOC
FIQtEw/+O/mGpPwZN32br2j0SulXZjWNOAsvuyv4q23ptud3oDqaCZkF9sZkOkid
ECX6040xGlaVif425nuT0KvofQxTuufIoAikr53KMEwE6X90We5qswv4GFFMV6g8
v3KYR1u+loU8MhYnlfeNmN9Plb26AZ9xp/T7W11TdavpmW47u8/zbkZJmzM3H+dv
CYY8jnaS6n8fMq3kdfD54QmfDYsY4vH49RYSVRcni8uiBZOanrmUsr9F49UtsFuX
z+nEl+Vq35oH7/tP/PdaL1qSOENDltac4pGfctPtdEp45vi0JVqLY73ISV+d/peD
HT+zB19FtrxNEPW4eIVnFQ8vOY9Dn5RldyW4H66wdiodDmcn/XGJCZjNtJjHzZEE
LP0VXjMh4HrXJ8ZHrc/4R/KFnNxCECg1YnjY4lCoYfUoBerqt0AAod0pStznj9Yf
NtooogZrZR5Oqa11WH3TQyOPCFdg73fNmJdw1qrHzLgEXfkpauozzSMnMqeJiA7K
jYt754WzL7PFF9uSyxig7j8aXmzwUH2jGSMtc2JSAz6uLVlRSK5YHEIlMlHISUc/
iTtHEBai99UTmA7RtczSuq60TfKgsKkD5G6Qm/wLkVqhyk3CIZzY7VZjnKouis8D
dyQIVXdx/d3ANv9bZo2Z/9HQ+a0HOUwKg28nmJ4Onhwuk7Mw3m4=
=v4Me
-----END PGP SIGNATURE-----