Detections
Analytics

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : Exim vulnerabilities (USN-8382-1)

critical Nessus Plugin ID 318625

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8382-1 advisory.

 Timo Longin discovered that Exim incorrectly handled certain SMTP messages in PIPELINING/CHUNKING configurations. A remote attacker could possibly use this issue to perform SMTP smuggling. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-51766)

 It was discovered that Exim incorrectly handled certain malformed JSON data in headers. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or execute arbitrary code.
 This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40685)

 It was discovered that Exim incorrectly handled certain malformed UTF-8 headers. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS.
 (CVE-2026-40686)

 It was discovered that Exim incorrectly handled certain SPA resources. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40687)

 It was discovered that Exim incorrectly handled certain CHUNKING transfers in some GnuTLS configurations.
 A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-45185)

 Warisjeet Singh discovered that Exim incorrectly handled certain proxy connections in builds with proxy support enabled. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-48840)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-8382-1

Plugin Details

Severity: Critical

ID: 318625

File Name: ubuntu_USN-8382-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 6/4/2026

Updated: 6/4/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-40685

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:18.04:-:lts, cpe:/o:canonical:ubuntu_linux:16.04:-:lts, cpe:/o:canonical:ubuntu_linux:20.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:exim4, p-cpe:/a:canonical:ubuntu_linux:exim4-base, p-cpe:/a:canonical:ubuntu_linux:exim4-config, p-cpe:/a:canonical:ubuntu_linux:exim4-daemon-heavy, p-cpe:/a:canonical:ubuntu_linux:exim4-daemon-light, p-cpe:/a:canonical:ubuntu_linux:exim4-dev, p-cpe:/a:canonical:ubuntu_linux:eximon4, cpe:/o:canonical:ubuntu_linux:14.04:-:lts

Required KB Items: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/3/2026

Vulnerability Publication Date: 12/24/2023

Reference Information

CVE: CVE-2023-51766, CVE-2026-40685, CVE-2026-40686, CVE-2026-40687, CVE-2026-45185, CVE-2026-48840

IAVA: 2024-A-0002-S, 2026-A-0417-S, 2026-A-0478

USN: 8382-1