CLSA-2026-1787664471

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787664471.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1787664471
Upstream
CVE (2)
  • CVE-2026-66140
  • CVE-2026-66141
Published
2026-08-25T15:11:29Z
Modified
2026-10-26T09:32:03Z
Summary
Fix CVE(s): CVE-2026-66140, CVE-2026-66141
Details
  • SECURITY UPDATE: directory traversal via named-queue arguments
    • debian/patches/CVE-2026-66140.patch: add validate_queue_name() and apply it to the -MCG and -q[f][f][l]G command-line queue names, rejecting names containing '/', longer than 32 characters, or colliding with the reserved spool subdirectories; restrict -MC and all -MCx arguments to admin users.
    • CVE-2026-66140
  • SECURITY UPDATE: .forward privilege escalation under force_command
    • debian/patches/CVE-2026-66141.patch: stop expanding addr->local_part in a pipe transport under force_command, so a command taken from a user's .forward file is only dequoted and split into argv, never evaluated with the transport's privileges.
    • CVE-2026-66141
References

Affected packages

TuxCare:Ubuntu:18.04
exim4

Package

Name
exim4
Purl
pkg:deb/tuxcare/exim4?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.90.1-1ubuntu1.10+tuxcare.els7

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787664471.json"
exim4-base

Package

Name
exim4-base
Purl
pkg:deb/tuxcare/exim4-base?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.90.1-1ubuntu1.10+tuxcare.els7

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787664471.json"
exim4-config

Package

Name
exim4-config
Purl
pkg:deb/tuxcare/exim4-config?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.90.1-1ubuntu1.10+tuxcare.els7

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787664471.json"
exim4-daemon-heavy

Package

Name
exim4-daemon-heavy
Purl
pkg:deb/tuxcare/exim4-daemon-heavy?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.90.1-1ubuntu1.10+tuxcare.els7

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787664471.json"
exim4-daemon-light

Package

Name
exim4-daemon-light
Purl
pkg:deb/tuxcare/exim4-daemon-light?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.90.1-1ubuntu1.10+tuxcare.els7

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787664471.json"
exim4-dev

Package

Name
exim4-dev
Purl
pkg:deb/tuxcare/exim4-dev?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.90.1-1ubuntu1.10+tuxcare.els7

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787664471.json"
eximon4

Package

Name
eximon4
Purl
pkg:deb/tuxcare/eximon4?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.90.1-1ubuntu1.10+tuxcare.els7

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787664471.json"