USN-6455-2: Exim regression
Publication date
10 June 2026
Overview
USN-6455-1 introduced a regression in Exim
Releases
Packages
- exim4 - Exim is a mail transport agent
Details
USN-6455-1 fixed vulnerabilities in Exim. The fix for CVE-2023-42117
introduced a regression on Ubuntu 22.04 LTS that resulted in certain
connections logging a Taint mismatch error. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Exim incorrectly handled validation of user-supplied
data, which could lead to memory corruption. A remote attacker could
possibly use this issue to execute arbitrary code. (CVE-2023-42117)
It was discovered that Exim incorrectly handled validation of user-supplied
data, which could lead to an out-of-bounds read. An attacker could possibly
use this issue to expose sensitive information. (CVE-2023-42119)
USN-6455-1 fixed vulnerabilities in Exim. The fix for CVE-2023-42117
introduced a regression on Ubuntu 22.04 LTS that resulted in certain
connections logging a Taint mismatch error. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Exim incorrectly handled validation of user-supplied
data, which could lead to memory corruption. A remote attacker could
possibly use this issue to execute arbitrary code. (CVE-2023-42117)
It was discovered that Exim incorrectly handled validation of user-supplied
data, which could lead to an out-of-bounds read. An attacker could possibly
use this issue to expose sensitive information. (CVE-2023-42119)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 22.04 LTS jammy | exim4 – 4.95-4ubuntu2.10 | ||
| exim4-daemon-heavy – 4.95-4ubuntu2.10 | |||
| exim4-daemon-light – 4.95-4ubuntu2.10 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.