{"id":"CLSA-2026-1787328725","summary":"Fix CVE(s): CVE-2026-66140, CVE-2026-66141","details":"   * SECURITY UPDATE: directory traversal outside the spool area through\n     mishandled named-queue arguments, leading to privilege escalation\n     - debian/patches/CVE-2026-66140.patch: add validate_queue_name() and\n       apply it to both command-line sources of a queue name, -MCG \u003cname\u003e\n       and -q[f][f][l]G\u003cname\u003e, rejecting a name that contains '/', is longer\n       than 32 characters, or collides with one of the reserved spool\n       subdirectories input, db, msglog and scan; mark -MC and every -MCx\n       argument as admin-only and refuse them for a non-admin caller\n     - CVE-2026-66140\n   * SECURITY UPDATE: .forward privilege escalation caused by expansion of\n     the pipe command under force_command\n     - debian/patches/CVE-2026-66141.patch: stop passing addr-\u003elocal_part\n       through expand_string() in the $address_pipe special case of a pipe\n       transport that has force_command set, so command text supplied by a\n       local user in a .forward file is only dequoted and split into\n       arguments instead of being evaluated with the transport's privileges\n     - CVE-2026-66141","modified":"2026-10-26T09:31:40.157252135Z","published":"2026-08-21T16:12:18Z","upstream":["CVE-2026-66140","CVE-2026-66141"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1787328725.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66140"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66141"}],"affected":[{"package":{"name":"exim4","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1787328725.json"}},{"package":{"name":"exim4-base","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-base?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1787328725.json"}},{"package":{"name":"exim4-config","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-config?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1787328725.json"}},{"package":{"name":"exim4-daemon-heavy","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-daemon-heavy?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1787328725.json"}},{"package":{"name":"exim4-daemon-light","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-daemon-light?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1787328725.json"}},{"package":{"name":"exim4-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1787328725.json"}},{"package":{"name":"eximon4","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/eximon4?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1787328725.json"}}],"schema_version":"1.9.0"}