Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.

[akuster <akuster () mvista com>]

On 9/5/19 11:00 PM, Heiko Schlittermann wrote:
> [ This is a re-post w/o dmarc protection of the sender (me). ]
>
> *** Note: EMBARGO is still in effect!       ***
If this is true, why is this on the public list?

> *** Distros must not publish any detail yet ***



- armin
> In case you are entitled to access the security repo:
> *and* use the 4.92.2+fixes branch:
>
> The branch got two new commits, fixing a small tool. This tool is not
> designed to process untrusted data, so there is no security issue, but
> it was buggy. It is unlikely to be critical.
>
> You may consider including the fix in the packages to be
> released at CRD (today, 10.00 UTC) or schedule it for a later
> maintainance release of the Exim packages.
>
> commit cdc7f9a9667ecf31d803fc8d1a31b466284360bd
> Author: Heiko Schlittermann (HS12-RIPE) <hs () schlittermann de>
> Date:   Fri Sep 6 06:57:11 2019 +0200
>
> commit 66935633816a88460f5222f40dc29d1a4e877978
> Author: Heiko Schlittermann (HS12-RIPE) <hs () schlittermann de>
> Date:   Thu Sep 5 14:56:22 2019 +0200
>
>     Best regards from Dresden/Germany
>     Viele Grüße aus Dresden
>     Heiko Schlittermann
> --
>  SCHLITTERMANN.de ---------------------------- internet & unix support -
>  Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
>  gnupg encrypted messages are welcome --------------- key ID: F69376CE -
>  ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

Attachment: signature.asc
Description: OpenPGP digital signature