-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 25 Sep 2026 11:25:38 +0200
Source: exim4
Binary: exim4 exim4-config
Architecture: all
Version: 4.98.2-1+deb13u5
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) <buildd_amd64-x86-grnet-03@buildd.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Description:
 exim4      - metapackage to ease Exim MTA (v4) installation
 exim4-config - configuration for the Exim MTA (v4)
Closes: 1148506
Changes:
 exim4 (4.98.2-1+deb13u5) trixie-security; urgency=high
 .
   * Cherry-pick relevant changes from security release 4.100.1.
     CVE-2026-94054 EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1)
      Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
      controlled proxy, has an out-of-bounds write.
     CVE-2026-94056 EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1)
      Exim before 4.100.1, when Proxy-Protocol is used with an attacker-
      controlled proxy, allows attackers to read certain uninitialized
      data from stack memory.
     CVE-2026-94057 EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1)
      Exim before 4.100.1 allows SMTP smuggling in which the received
      message does not match any sent message, and instead depends on
      crafted data sent after a rejection during DATA processing.
     Closes: #1148506
     (CVE-2026-94055 is not relevant - TLS Early banner support was
     introduced in 4.99.)
Checksums-Sha1:
 0991bbc41636c9e5d8628044dae4bb551104513e 250372 exim4-config_4.98.2-1+deb13u5_all.deb
 af74a9cf18f28e21c4e8acbdf72c08a389e858cd 9260 exim4_4.98.2-1+deb13u5_all-buildd.buildinfo
 63afb457595a8ce972e771444b708548497aed48 7196 exim4_4.98.2-1+deb13u5_all.deb
Checksums-Sha256:
 2829f47de50a5ec953805135a26ca050245e9b89fe24a030646b89fea18c50f6 250372 exim4-config_4.98.2-1+deb13u5_all.deb
 83068c88c557fe349ee4b7b46706627697419e40613ee5cf95c3f6b1b7c31aea 9260 exim4_4.98.2-1+deb13u5_all-buildd.buildinfo
 5fda3f1b4d611016de4c72def2febc1ddc398389a80ce417ed356f466f691710 7196 exim4_4.98.2-1+deb13u5_all.deb
Files:
 690e8ee1c865b14ff9a10973181aa80d 250372 mail optional exim4-config_4.98.2-1+deb13u5_all.deb
 182fa2779007a74b7b305e4ea0739025 9260 mail standard exim4_4.98.2-1+deb13u5_all-buildd.buildinfo
 1a115f05b5b67f5f596eb6a0e33bc060 7196 mail optional exim4_4.98.2-1+deb13u5_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmq49bAACgkQN8Ugyu9d
QiQnDQ/8DiWaL9M/IIyBIOPn868/P3w2EXA7I5KyN1qK2SFqDVX0Q16ZXNqQEllF
m8CNRkgy4hnVQLvX5rM2uN2TSPHVNRe29pH1DM4EC1fPZ8ep1Q2vL+Bo+xGC85js
N3VEh89EMJ8aXSjhifiqnO8bPm80kDhHRBQkpMaxLSyoCHkKr+SnccEIRg+tzNbM
pnvGVad+GxXHcyL3d3O0ywr0p2l7f4nHBUDoT3/yqejkefJpTwIzpXc2x6Ha5vv7
W79W9PO6YB/EwpVhU26RIKhCpZqXx/AAhHZZ0k47kt3iPukiQKynLUJvnNNTGccT
qt/TpXDEEWBr/OCk5+au/mopilvJaRMobOs8cRT9rY+TyRzPuQDobzB5ak3Vpfcw
JSu9uqjb9FhPDIFE2U90iQbd1kDxMM4yCOhcpTKJ8qUh36l9MBQhP9P9tMQUnzzo
Ak6c/7ICByC4XVYlLQsw0m8p68iGhQUvjM4EF2DaCBpvRR+hO9aj1/aouzQvgfwN
RBYsMRtE//XJeb8tlglUVDZjyFHnBkUzr6dXKqTwD+rYFCpVF2VKNlDyyFVwxBTt
lrIC2grtgR1t1D2IIi/q45b5NH5Lsrm2x0ClX55CVJJXnSfCX2x9XejbT34xaLQe
12dcCcxSSAUh5SWW/NV5bfvuPsT4c/ON4IPF5TW4qB/I5/wlahA=
=MbFU
-----END PGP SIGNATURE-----