{"id":"CLSA-2026-1791403476","summary":"Fix CVE(s): CVE-2026-94054, CVE-2026-94056","details":"   * SECURITY UPDATE: out-of-bounds access in Proxy-Protocol v1 header\n     parsing with an attacker-controlled proxy\n     - debian/patches/CVE-2026-94054.patch: set ret to the length of the\n       heap copy of the PROXY v1 line instead of adding the\n       swallow_until_crlf() count, so the memchr() for the CR stays\n       inside the copy\n     - CVE-2026-94054\n   * SECURITY UPDATE: uninitialised stack data read on a short\n     Proxy-Protocol v2 header from an attacker-controlled proxy\n     - debian/patches/CVE-2026-94056.patch: repeat the read of the v2\n       length fields until all 16 header octets have arrived, and abort\n       on EOF or error instead of using uninitialised length data\n     - CVE-2026-94056","modified":"2026-10-26T09:31:40.200035495Z","published":"2026-10-07T20:04:49Z","upstream":["CVE-2026-94054","CVE-2026-94056"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1791403476.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94054"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94056"}],"affected":[{"package":{"name":"exim4","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791403476.json"}},{"package":{"name":"exim4-base","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-base?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791403476.json"}},{"package":{"name":"exim4-config","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-config?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791403476.json"}},{"package":{"name":"exim4-daemon-heavy","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-daemon-heavy?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791403476.json"}},{"package":{"name":"exim4-daemon-light","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-daemon-light?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791403476.json"}},{"package":{"name":"exim4-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/exim4-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791403476.json"}},{"package":{"name":"eximon4","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/eximon4?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.93-13ubuntu1.12+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791403476.json"}}],"schema_version":"1.9.0"}