Re: [exim] CVE-2019-15846 ..Exim Vulnerability

Top Page
Delete this message
Reply to this message
Author: Jan Ingvoldstad
Date:  
To: exim users
Subject: Re: [exim] CVE-2019-15846 ..Exim Vulnerability
>From the Wheezy ELTS package:

dpkg-source: info: applying 30_dontoverridecflags.dpatch
dpkg-source: info: applying 31_eximmanpage.dpatch
dpkg-source: info: applying 32_exim4.dpatch
dpkg-source: info: applying 33_eximon.binary.dpatch
dpkg-source: info: applying 34_eximstatsmanpage.dpatch
dpkg-source: info: applying 35_install.dpatch
dpkg-source: info: applying 50_localscan_dlopen.dpatch
dpkg-source: info: applying 60_convert4r4.dpatch
dpkg-source: info: applying 66_enlarge-dh-parameters-size.dpatch
dpkg-source: info: applying 67_unnecessaryCopt.diff
dpkg-source: info: applying 70_remove_exim-users_references.dpatch
dpkg-source: info: applying 75_openssl_sni.diff
dpkg-source: info: applying 76_tls_dh_min_bits.diff
dpkg-source: info: applying 77_docsfortls_dh_min_bits.diff
dpkg-source: info: applying 78_pkcs11_init.diff
dpkg-source: info: applying 84_CVE-2012-5671.patch
dpkg-source: info: applying 85_server_set_id_SPA.diff
dpkg-source: info: applying 86_Dovecot-robustness.diff
dpkg-source: info: applying 87_double_expansion.diff
dpkg-source: info: applying 88_CVE-2016-1531.diff
dpkg-source: info: applying 89_01_only_warn_on_nonempty_environment.diff
dpkg-source: info: applying 89_02_Store-the-initial-working-directory.diff
dpkg-source: info: applying 89_03_Fix_initial_cwd_expansion.diff
dpkg-source: info: applying 90_Fix-DKIM-information-leakage.patch
dpkg-source: info: applying 91_CVE-2017-1000369.patch
dpkg-source: info: applying 92_Fix-base64d-buffer-size-CVE-2018-6789.patch
dpkg-source: info: applying 93_CVE-2019-15846.patch

On Fri, Sep 13, 2019 at 1:22 PM Jasen Betts via Exim-users <
exim-users@???> wrote:

> On 2019-09-12, Richard Jones via Exim-users <exim-users@???> wrote:
> > On Sep 12, Heiko Schlittermann via Exim-users wrote
> >> If you're out of luck, either upgrade your Debian system to a recent
> >> one, or prepare to compile Exim on your own. (This is not as hard as it
> >> seems, but you have to care about further updates manually).
> >
> > I don't suppose anyone has magical instructions on how to do this for
> > exim4-daemon-heavy?
> >
>
> grab the exim sources from a recent debian and install build-deps
> and try to compile... all the exim-* packages in debian come from a
> single source package.
>
> I was unsuccessful building exim 4.80 on Jessie (debian 8) earlier
> this year. so that building on Wheezy may require significant effort
> (like building other libraries from source to support this exim)
>
> it's probably easier to install the wheezy exim4 source package, patch
> it manually, (it's a one line patch) and rebuild.
>
>
> workflow something like this, (* represents a version number):
>
> sudo apt-get build-dep exim4
> apt-get source exim4
> cd exim4*
> vi src/strings.c # make the edit
> fakeroot debian/rules binary # build takes several minutes.
> sudo dpkg -i ../exim4-daemon-heavy*.deb
>
>
>
> --
> When I tried casting out nines I made a hash of it.
>
> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/
>



--
Jan