exim4 (4.95-4ubuntu2.10) jammy-security; urgency=medium

  * SECURITY REGRESSION: taint mismatch error (LP: #2152830)
    - debian/patches/CVE-2023-42117-2.patch: Use project-standard memory
      management rather than alloca() in src/string.c.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 09 Jun 2026 08:58:06 -0400

exim4 (4.95-4ubuntu2.9) jammy-security; urgency=medium

  * SECURITY UPDATE: information disclosure in PROXYv2 (LP: #2154366)
    - debian/patches/202605191-security.patch: Security: fix PROXYv2
      uninitialised-stack disclosure (EXIM-Security-2026-05-16.1) in
      src/smtp_in.c.
    - CVE number pending

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 27 May 2026 10:23:14 -0400

exim4 (4.95-4ubuntu2.8) jammy-security; urgency=medium

  * SECURITY UPDATE: one-byte write into freed buffer (LP: #2152202)
    - debian/patches/202605011-security.patch: TLS: on rxd close with CHUNKING
      active, clean the input processing stack in src/functions.h,
      src/smtp_in.c, src/tls-gnu.c, src/tls-openssl.c.
    - unknown

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 11 May 2026 19:43:58 +0200

exim4 (4.95-4ubuntu2.7) jammy-security; urgency=medium

  * SECURITY UPDATE: Multiple security issues
    - debian/patches/CVE-2026-4068*.patch: backported upstream fixes.
    - CVE-2026-40685 - Possible OOB read/write on corrupt JSON in header
    - CVE-2026-40686 - Possible OOB read with large UTF8 trailing chars
    - CVE-2026-40687 - Possible OOB read/write with SPA authenticator

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 29 Apr 2026 13:23:54 -0400

exim4 (4.95-4ubuntu2.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Multiline header filename parsing issue
    - debian/patches/CVE-2024-39929-*.patch: Fix MIME parsing of filenames
      specified using multiple parameters.
    - CVE-2024-39929

 -- Fabian Toepfer <fabian.toepfer@canonical.com>  Tue, 30 Jul 2024 21:25:34 +0200

exim4 (4.95-4ubuntu2.5) jammy-security; urgency=medium

  * SECURITY UPDATE: SMTP smuggling
    - debian/patches/CVE-2023-51766-1.patch: Reject "dot, LF" as
      ending data phase in src/receive.c, src/smtp_in.c.
    - debian/patches/CVE-2023-51766-2.patch: use enum for body data
      input state-machine in src/receive.c.
    - debian/patches/CVE-2023-51766-3.patch: fix in src/receive.c.
    - CVE-2023-51766

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Thu, 11 Jan 2024 10:16:58 -0300

exim4 (4.95-4ubuntu2.4) jammy-security; urgency=medium

  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2023-42117.patch: fixed string_is_ip_address()
      in string.c
    - CVE-2023-42117
  * SECURITY UPDATE: information disclosure
    - debian/patches/CVE-2023-42119.patch: hardened dnsdb.c against
      crafted DNS responses.
    - CVE-2023-42119

 -- Allen Huang <allen.huang@canonical.com>  Wed, 25 Oct 2023 01:36:57 +0100

exim4 (4.95-4ubuntu2.3) jammy-security; urgency=medium

  * SECURITY UPDATE: information disclosure
    - debian/patches/CVE-2023-42114.patch: fix possible OOB read in
      SPA authenticator
    - CVE-2023-42114
  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2023-42115.patch: fix possible OOB write in
      external authenticator
    - CVE-2023-42115
  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2023-42116.patch: fix possible OOB write in
      SPA authenticator
    - CVE-2023-42116
  * debian/patches/CVE-2023-42114_15_16.patch:
    - use uschar more in spa authenticator

 -- Allen Huang <allen.huang@canonical.com>  Mon, 02 Oct 2023 17:10:42 +0100

exim4 (4.95-4ubuntu2.2) jammy-security; urgency=medium

  * SECURITY UPDATE: use after free in regex handler
    - debian/patches/CVE-2022-3559-1.patch: properly clear references in
      src/exim.c, src/expand.c, src/functions.h, src/globals.c,
      src/regex.c, src/smtp_in.c.
    - debian/patches/CVE-2022-3559-2.patch: fix non-WITH_CONTENT_SCAN build
      in src/exim.c, src/regex.c.
    - debian/patches/CVE-2022-3559-3.patch: fix non-WITH_CONTENT_SCAN build
      in src/exim.c, src/functions.h, src/globals.h, src/regex.c,
      src/smtp_in.c.
    - debian/patches/CVE-2022-3559-4.patch: fix non-WITH_CONTENT_SCAN build
      in src/expand.c.
    - CVE-2022-3559

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 23 Nov 2022 10:53:26 -0500

exim4 (4.95-4ubuntu2.1) jammy; urgency=medium

  * d/p/lp1974214-segfault-smtp-delivery-0{1,2}.patch: Fix segfault when
    there's an SMTP delivery attempt following a deferral. (LP: #1974214)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Fri, 03 Jun 2022 17:51:15 -0400

# For older changelog entries, run 'apt-get changelog exim4-dev'
