USN-9086-1: SA-Exim vulnerability
Publication date
12 November 2026
Overview
SA-Exim could be made to run programs if it loaded specially crafted SpamAssassin rules.
Releases
Packages
- sa-exim - Use SpamAssassin at SMTP time with the Exim v4 MTA
Details
It was discovered that SA-Exim unsafely evaluated the parameters of its
greylisting SpamAssassin rule. An attacker able to write SpamAssassin
configuration files or rules could possibly use this issue to execute
arbitrary code.
It was discovered that SA-Exim unsafely evaluated the parameters of its
greylisting SpamAssassin rule. An attacker able to write SpamAssassin
configuration files or rules could possibly use this issue to execute
arbitrary code.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 18.04 LTS bionic | sa-exim – 4.2.1-16ubuntu0.1~esm1 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.