exim4 4.90.1-1ubuntu1.8: exim4 4.90.1-1ubuntu1.8 for Ubuntu 18.04.6 LTS (bionic)

exim4 4.90.1-1ubuntu1.8, released May 4, 2021, fixes 20 CVEs in exim4. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.

RoutineUnsupported product

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

n/a

No CVSS score published

Highest EPSS

0.6166

99th percentile

Priority of the 20 CVEs

Patch now 0
                                Urgent 0
                                High 0
                                Routine 20

Fixed package versions

Product	Release	Fixed in
exim4	Ubuntu 18.04.6 LTS (bionic)	4.90.1-1ubuntu1.8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Routine	CVE-2020-28019	exim4: Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other conseque...	n/a	0.6166	None reported
Routine	CVE-2020-28018	exim4: Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with Ope...	n/a	0.5648	None reported
Routine	CVE-2020-28017	exim4: Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with f...	n/a	0.3665	None reported
Routine	CVE-2020-28026	exim4: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enab...	n/a	0.0933	None reported
Routine	CVE-2020-28020	exim4: Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execut...	n/a	0.0794	None reported
Routine	CVE-2020-28024	exim4: Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary...	n/a	0.0415	None reported
Routine	CVE-2020-28021	exim4: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters	n/a	0.0414	None reported
Routine	CVE-2020-28022	exim4: Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer	n/a	0.0302	None reported
Routine	CVE-2020-28025	exim4: Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship betwe...	n/a	0.0276	None reported
Routine	CVE-2020-28023	exim4: Exim 4 before 4.94.2 allows Out-of-bounds Read	n/a	0.0261	None reported
Routine	CVE-2021-27216	exim4: Exim 4 before 4.94.2 has Execution with Unnecessary Privileges	n/a	0.0098	None reported
Routine	CVE-2020-28014	exim4: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges	n/a	0.0094	None reported
Routine	CVE-2020-28007	exim4: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges	n/a	0.0053	None reported
Routine	CVE-2020-28009	exim4: Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are...	n/a	0.0047	None reported
Routine	CVE-2020-28010	exim4: Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current work...	n/a	0.0042	None reported
Routine	CVE-2020-28008	exim4-daemon-heavy: Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges	n/a	0.0041	None reported
Routine	CVE-2020-28012	exim4-config: Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a pri...	n/a	0.0040	None reported
Routine	CVE-2020-28011	exim4: Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S	n/a	0.0039	None reported
Routine	CVE-2020-28013	exim4: Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus...	n/a	0.0039	None reported
Routine	CVE-2020-28015	exim4: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters	n/a	0.0038	None reported

Also fixes CVE-2020-28019

exim4-base 4.90.1-1ubuntu1.8
exim4-base on Ubuntu 18.04.6 LTS (bionic)
exim4-config 4.90.1-1ubuntu1.8
exim4-config on Ubuntu 18.04.6 LTS (bionic)
exim4-daemon-heavy 4.90.1-1ubuntu1.8
exim4-daemon-heavy on Ubuntu 18.04.6 LTS (bionic)
exim4-daemon-light 4.90.1-1ubuntu1.8
exim4-daemon-light on Ubuntu 18.04.6 LTS (bionic)
eximon4 4.90.1-1ubuntu1.8
eximon4 on Ubuntu 18.04.6 LTS (bionic)
exim4 4.93-13ubuntu1.5
exim4 on Ubuntu 20.04 LTS (focal)
exim4-base 4.93-13ubuntu1.5
exim4-base on Ubuntu 20.04 LTS (focal)
exim4-config 4.93-13ubuntu1.5
exim4-config on Ubuntu 20.04 LTS (focal)

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/ubuntu-bionic-exim4-4.90.1-1ubuntu1.8">exim4 4.90.1-1ubuntu1.8 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.