openSUSE Security Update: Security update for exim
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2016:0721-1
Rating:             important
References:         #968844 
Cross-References:   CVE-2016-1531
Affected Products:
                    openSUSE Leap 42.1
                    openSUSE 13.2
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update to exim 4.86.2 fixes the following issues:

   * CVE-2016-1531: local privilege escalation for set-uid root exim when
     using 'perl_startup' (boo#968844)

   Important: Exim now cleans the complete execution environment by default.
   This affects Exim and subprocesses such as transports calling other
   programs. The following new options are supported to adjust this behaviour:
   * keep_environment
   * add_environment A warning will be printed upon startup if none of these
     are configured.

   Also includes upstream changes, improvements and bug fixes:
     * Support for using the system standard CA bundle.
     * New expansion items $config_file, $config_dir, containing the file and
       directory name of the main configuration file. Also $exim_version.
     * New "malware=" support for Avast.
     * New "spam=" variant option for Rspamd.
     * Assorted options on malware= and spam= scanners.
     * A commandline option to write a comment into the logfile.
     * A logging option for slow DNS lookups.
     * New ${env {}} expansion.
     * A non-SMTP authenticator using information from TLS client
       certificates.
     * Main option "tls_eccurve" for selecting an Elliptic Curve for TLS.
     * Main option "dns_trust_aa" for trusting your local nameserver at the
       same level as DNSSEC.


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.1:

      zypper in -t patch openSUSE-2016-326=1

   - openSUSE 13.2:

      zypper in -t patch openSUSE-2016-326=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE Leap 42.1 (i586 x86_64):

      exim-4.86.2-8.1
      exim-debuginfo-4.86.2-8.1
      exim-debugsource-4.86.2-8.1
      eximon-4.86.2-8.1
      eximon-debuginfo-4.86.2-8.1
      eximstats-html-4.86.2-8.1

   - openSUSE 13.2 (i586 x86_64):

      exim-4.86.2-3.10.1
      exim-debuginfo-4.86.2-3.10.1
      exim-debugsource-4.86.2-3.10.1
      eximon-4.86.2-3.10.1
      eximon-debuginfo-4.86.2-3.10.1
      eximstats-html-4.86.2-3.10.1


References:

   https://www.suse.com/security/cve/CVE-2016-1531.html
   https://bugzilla.suse.com/968844

--