oss-security - EXIM-Security-2025-12-09.1: Exim 4.99: Remote heap corruption

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <aTlswbw7mu0DyFec@jumper.schlittermann.de>
Date: Wed, 10 Dec 2025 13:51:13 +0100
From: Heiko Schlittermann <hs@...marc.schlittermann.de>
To: oss-security <oss-security@...ts.openwall.com>
Subject: EXIM-Security-2025-12-09.1: Exim 4.99: Remote heap corruption

Dear Exim users,

we got reported two possible (related) vulnerabilities in the
latest 4.99 release. From the original report:

,---
| In vulnerable configurations, a remote, unauthenticated attacker can
| achieve heap corruption. I was unable to develop an end-to-end exploit
| chain for remote code execution, but it may be possible with further
| work.
`---

We do not publish any further details yet, until the fix goes public.

While we do not support older versions, please note, that 4.98.1 is not
affected. Other versions might or might not be subject to the same
attack vector.

2025-11-22: we received a report to security@...m.org
2025-11-25: acknowledged the report to the reporter
2025-12-10: this notification

~2025-12-15: publish the fix via the distros repo (accessible for the distro packagers)
~2025-12-18: publish the fix via the default repo (accessible for the public)

Once the fixes passed internal testing, we'll update the schedule and send
another notification about the coordinated release date(s) for distros and
the public.

    Best regards from Dresden/Germany
    Viele Grüße aus Dresden
    Heiko Schlittermann
-- 
 SCHLITTERMANN.de ---------------------------- internet & unix support -
 Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
 gnupg encrypted messages are welcome --------------- key ID: F69376CE -

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.