USN-9063-1: Yodl vulnerability
USN-9063-1
Summary
It was discovered that Exim had an out-of-bounds write when Proxy-Protocol was used with an attacker-controlled proxy. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-94054)
It was discovered that Exim had a use-after-free when certain non-default TLS settings were used with GnuTLS. A remote attacker could possibly use this issue to cause Exim to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-94055)
It was discovered that Exim allowed attackers to read uninitialized data from stack memory when Proxy-Protocol was used with an attacker-controlled proxy. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-94056)
It was discovered that Exim allowed SMTP smuggling via crafted data sent after a rejection during DATA processing. A remote attacker could possibly use this issue to inject arbitrary email messages. (CVE-2026-94057)
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 4
Updates
- Published by Ubuntu
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.