{"id":"CLSA-2026-1778003565","summary":"Fix CVE(s): CVE-2026-40684, CVE-2026-40685, CVE-2026-40687","details":"   * SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape\n     decoding when running against musl libc\n     - debian/patches/CVE-2026-40684.patch: harden string_copy_dnsdomain()\n       to consume 1, 2, or 3 digits incrementally instead of indexing past\n       the input string when fewer than 3 digits follow a backslash escape\n     - CVE-2026-40684\n   * SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed\n     header value ending in a trailing backslash\n     - debian/patches/CVE-2026-40685.patch: only skip a backslash in\n       dewrap() when followed by a non-NUL character\n     - CVE-2026-40685\n   * SECURITY UPDATE: SPA authenticator out-of-bounds write and\n     uninitialised-heap information disclosure\n     - debian/patches/CVE-2026-40687.patch: zero the spa_base64_to_bits()\n       output buffer to plug the infoleak; replace assert()-based length\n       guards in unicodeToString(), strToUnicode(), and toString() with\n       explicit length clamping to prevent OOB writes\n     - CVE-2026-40687","modified":"2026-06-04T09:47:38.300963951Z","published":"2026-05-05T17:52:50Z","upstream":["CVE-2026-40684","CVE-2026-40685","CVE-2026-40687"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1778003565.html"}],"affected":[{"package":{"name":"exim4","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1778003565.json"}},{"package":{"name":"exim4-base","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-base?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1778003565.json"}},{"package":{"name":"exim4-config","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-config?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1778003565.json"}},{"package":{"name":"exim4-daemon-heavy","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-daemon-heavy?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1778003565.json"}},{"package":{"name":"exim4-daemon-light","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-daemon-light?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1778003565.json"}},{"package":{"name":"exim4-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1778003565.json"}},{"package":{"name":"eximon4","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/eximon4?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1778003565.json"}}],"schema_version":"1.7.5"}