Back Linuxsecurity

Ubuntu 26.04 Exim Critical Information Disclosure Vulnerability USN-8353

Linuxsecurity •LinuxSecurity Advisories • June 1, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Exim could be made to expose sensitive information over the network. Software Description: - exim4: Exim is a mail transport agent Details: Warisjeet Singh discovered that Exim with SUPPORT_PROXY enabled did not properly handle memory before SMTP authentication. A remote attacker could possibly use this issue to obtain sensitive information.

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS exim4 4.99.1-1ubuntu1.3 exim4-base 4.99.1-1ubuntu1.3 eximon4 4.99.1-1ubuntu1.3 Ubuntu 25.10 exim4 4.98.2-1ubuntu2.3 exim4-base 4.98.2-1ubuntu2.3 eximon4 4.98.2-1ubuntu2.3 Ubuntu 24.04 LTS exim4 4.97-4ubuntu4.6 exim4-base 4.97-4ubuntu4.6 eximon4 4.97-4ubuntu4.6 Ubuntu 22.04 LTS exim4 4.95-4ubuntu2.9 exim4-base 4.95-4ubuntu2.9 eximon4 4.95-4ubuntu2.9 In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8353-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Exim Vulnerability in Ubuntu Exposes Sensitive Information A critical vulnerability in Exim, a mail transport agent used in multiple Ubuntu versions, has been discovered. The issue, identified by Warisjeet Singh, occurs when SUPPORT_PROXY is enabled, allowing remote attackers to potentially access sensitive information before SMTP authentication. Affected releases include Ubuntu 26.04 LTS, 25.10, 24.04 LTS, and 22.04 LTS. The vulnerability can be mitigated by updating to specific package versions provided in the advisory. Users are urged to perform a standard system update to address this issue. The vulnerability highlights the importance of timely updates in maintaining system security. No CVE identifier was mentioned in the articles. The current status is that the vulnerability has been acknowledged, and updates are available. 6 sources 58

Extracted Entities

Ubuntu 26.04 Exim Critical Information Disclosure Vulnerability USN-8353

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)