[BSA-035] Security Update for exim4

2011-05-1017:01:09

lists.debian.org

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.7 High

AI Score

Confidence

High

0.097 Low

EPSS

Percentile

94.8%

JSON

Andreas Metzler uploaded new packages for exim4 which fixed the
following security problems:

CVE-2011-1764
DKIM related format string vulnerability

For the lenny-backports distribution the problems have been fixed in
version 4.72-6+squeeze1~bpo50+1.

For the stable distribution (squeeze), this problem has been fixed in
version 4.72-6+squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 4.75-3.

If you don't use pinning (see [1]) you have to update the package
manually via "apt-get -t lenny-backports install <packagelist>" with
the packagelist of your installed packages affected by this update.
[1] <http://backports.debian.org/Instructions>

We recommend to pin (in /etc/apt/preferences) the backports repository to
200 so that new versions of installed backports will be installed
automatically.

Package: *
Pin: release a=lenny-backports
Pin-Priority: 200

Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian999powerpcexim4-daemon-light-dbg< 4.75-3exim4-daemon-light-dbg_4.75-3_powerpc.deb
Debian6kfreebsd-i386exim4-base< 4.72-6+squeeze1exim4-base_4.72-6+squeeze1_kfreebsd-i386.deb
Debian6mipsexim4-daemon-light< 4.72-6+squeeze1exim4-daemon-light_4.72-6+squeeze1_mips.deb
Debian6ia64eximon4< 4.72-6+squeeze1eximon4_4.72-6+squeeze1_ia64.deb
Debian999ia64eximon4< 4.75-3eximon4_4.75-3_ia64.deb
Debian999amd64exim4-daemon-heavy-dbg< 4.75-3exim4-daemon-heavy-dbg_4.75-3_amd64.deb
Debian6i386exim4-daemon-light< 4.72-6+squeeze1exim4-daemon-light_4.72-6+squeeze1_i386.deb
Debian6mipsexim4-dev< 4.72-6+squeeze1exim4-dev_4.72-6+squeeze1_mips.deb
Debian999armhfexim4-dbg< 4.75-3exim4-dbg_4.75-3_armhf.deb
Debian6armelexim4-base< 4.72-6+squeeze1exim4-base_4.72-6+squeeze1_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	999	powerpc	exim4-daemon-light-dbg	< 4.75-3	exim4-daemon-light-dbg_4.75-3_powerpc.deb
Debian	6	kfreebsd-i386	exim4-base	< 4.72-6+squeeze1	exim4-base_4.72-6+squeeze1_kfreebsd-i386.deb
Debian	6	mips	exim4-daemon-light	< 4.72-6+squeeze1	exim4-daemon-light_4.72-6+squeeze1_mips.deb
Debian	6	ia64	eximon4	< 4.72-6+squeeze1	eximon4_4.72-6+squeeze1_ia64.deb
Debian	999	ia64	eximon4	< 4.75-3	eximon4_4.75-3_ia64.deb
Debian	999	amd64	exim4-daemon-heavy-dbg	< 4.75-3	exim4-daemon-heavy-dbg_4.75-3_amd64.deb
Debian	6	i386	exim4-daemon-light	< 4.72-6+squeeze1	exim4-daemon-light_4.72-6+squeeze1_i386.deb
Debian	6	mips	exim4-dev	< 4.72-6+squeeze1	exim4-dev_4.72-6+squeeze1_mips.deb
Debian	999	armhf	exim4-dbg	< 4.75-3	exim4-dbg_4.75-3_armhf.deb
Debian	6	armel	exim4-base	< 4.72-6+squeeze1	exim4-base_4.72-6+squeeze1_armel.deb