{"id":172666,"date":"2026-05-19T00:24:49","date_gmt":"2026-05-18T22:24:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls"},"modified":"2026-05-19T00:24:49","modified_gmt":"2026-05-18T22:24:49","slug":"v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls","title":{"rendered":"N\u00eb Exim 4.99.3 \u00ebsht\u00eb eliminuar nj\u00eb vulnerabilitet q\u00eb mund\u00ebson ekzekutimin e kodit n\u00eb distanc\u00eb kur p\u00ebrdoret GnuTLS.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zhvilluesit e serverit t\u00eb post\u00ebs Exim l\u00ebshuan nj\u00eb version korrigjues Exim 4.99.3<\/strong>, q\u00eb adreson nj\u00eb vulnerabilitet n\u00eb disa konfiguracione t\u00eb agjentit t\u00eb post\u00ebs. Problemi kalon n\u00ebn identifikuesin e brendsh\u00ebm EXIM-Security-2026-05-01.1<\/strong>; n\u00eb njoftimin zyrtar gjithashtu figuron si CVE-TBD<\/strong>.<\/p>\n

Vulnerabiliteti i p\u00ebrket klas\u00ebs Remote Use-After-Free<\/strong> dhe shfaqet gjat\u00eb analiz\u00ebs s\u00eb trupit t\u00eb mesazhit BDAT<\/strong> kur punon me TLS p\u00ebrmes GnuTLS<\/strong>. BDAT p\u00ebrdoret n\u00eb zgjerimin SMTP CHUNKING<\/strong> p\u00ebr t\u00eb transferuar trupin e mesazhit n\u00eb blloqe. Sipas p\u00ebrshkrimit t\u00eb Exim, gabimi mund t\u00eb shkaktohet kur klienti gjat\u00eb transferimit BDAT d\u00ebrgon njoftimin TLS close_notify para p\u00ebrfundimit t\u00eb transferimit t\u00eb trupit, dhe pastaj shton nj\u00eb bajt t\u00eb shtuar n\u00eb t\u00eb nj\u00ebjtin lidhje TCP.<\/p>\n

N\u00eb k\u00ebt\u00eb renditje, Exim mund t\u00eb shkruaj\u00eb t\u00eb dh\u00ebnat n\u00eb nj\u00eb tampon t\u00eb memories q\u00eb tashm\u00eb \u00ebsht\u00eb \u00e7liruar pas p\u00ebrfundimit t\u00eb sesionit TLS. Kjo \u00e7on n\u00eb d\u00ebm t\u00eb heap-it dhe potencialisht mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb ekzekutuar kod. N\u00eb njoftim theksohet se sulmuesi thjesht ka nevoj\u00eb t\u00eb ket\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb vendosur nj\u00eb lidhje TLS dhe t\u00eb p\u00ebrdor\u00eb zgjerimin SMTP CHUNKING \/ BDAT<\/strong>.<\/p>\n

Problemi p\u00ebrfshin Exim 4.97, 4.98, 4.99, 4.99.1 dhe 4.99.2<\/strong>, por vet\u00ebm nd\u00ebrtimet e nd\u00ebrtuara me mb\u00ebshtetje GnuTLS<\/strong>. N\u00eb dokumentacionin zyrtar, kjo formulohet si konfigurime me USE_GNUTLS=yes; nd\u00ebrtimet q\u00eb p\u00ebrdorin OpenSSL<\/strong> ose biblioteka t\u00eb tjera TLS nuk preken nga ky vulnerabilitet. Gjithashtu, n\u00eb njoftimin e Exim-it theksohet se jan\u00eb t\u00eb ekspozuara konfigurimet ku shpallen STARTTLS<\/strong> dhe CHUNKING<\/strong>.<\/p>\n

Korrigjimi \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb Exim 4.99.3<\/strong>. Sipas p\u00ebrshkrimit t\u00eb zhvilluesve, patchi garanton nj\u00eb pastrim t\u00eb past\u00ebr t\u00eb stack-ut t\u00eb trajtimit t\u00eb hyrjeve kur merr close_notify TLS gjat\u00eb transferimit aktiv t\u00eb BDAT, q\u00eb parandalon p\u00ebrdorimin e m\u00ebtejsh\u00ebm t\u00eb treguesve t\u00eb vjetruar. Nj\u00eb m\u00ebnyr\u00eb tjet\u00ebr t\u00eb njohur p\u00ebr ta mbyllur plot\u00ebsisht problemin, p\u00ebrve\u00e7 p\u00ebrdit\u00ebsimit, nuk \u00ebsht\u00eb p\u00ebrmendur n\u00eb rekomandime.<\/p>\n

Zhvilluesit e Exim mor\u00ebn nj\u00eb raport p\u00ebr gabimin m\u00eb 1 maj 2026<\/strong> nga Federico Kirschbaum nga XBOW Security<\/strong>. Pas verifikimit t\u00eb raporteve, korrigjimi \u00ebsht\u00eb p\u00ebrgatitur n\u00eb depo t\u00eb mbyllura, m\u00eb 7 maj problemin e njoftuan distribucionet p\u00ebrmes nj\u00eb liste mbyllur t\u00eb shp\u00ebrndarjes, m\u00eb 10 maj ata iu ofruan nj\u00eb qasje t\u00eb kufizuar n\u00eb korrigjime, dhe m\u00eb 12 maj 2026<\/strong> u publikuan rekomandimet dhe vet\u00eb l\u00ebshimi me korrigjimin.<\/p>\n

Administratoret e server\u00ebve t\u00eb post\u00ebs rekomandojn\u00eb t\u00eb kontrollojn\u00eb versionin e p\u00ebrdorur t\u00eb Exim dhe backend-in e nd\u00ebrtimit TLS. N\u00ebse server<\/a> punon n\u00eb Exim nga 4.97 deri n\u00eb 4.99.2 p\u00ebrfshir\u00eb, e nd\u00ebrtuar me GnuTLS dhe shpall STARTTLS s\u00eb bashku me CHUNKING, projekti Exim rekomandon t\u00eb kaloni sa m\u00eb shpejt n\u00eb Exim 4.99.3<\/strong> ose nj\u00eb version m\u00eb t\u00eb ri. Tekstet burimore t\u00eb korrigjuara jan\u00eb n\u00eb deg\u00ebn exim-4.99+fixes dhe etiket\u00ebn exim-4.99.3, si dhe n\u00eb form\u00ebn e arkivave tarball n\u00eb platformat e zakonshme t\u00eb shkarkimit t\u00eb Exim.<\/p>\n

Burimi: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0440\u0435\u043b\u0438\u0437 Exim 4.99.3, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0430\u0433\u0435\u043d\u0442\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u043f\u043e\u0434 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c EXIM-Security-2026-05-01.1; \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 \u0442\u0430\u043a\u0436\u0435 \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u0442 \u043a\u0430\u043a CVE-TBD. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043a\u043b\u0430\u0441\u0441\u0443 Remote Use-After-Free \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0442\u0435\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f BDAT \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 TLS \u0447\u0435\u0440\u0435\u0437 GnuTLS. BDAT \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 SMTP-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 CHUNKING \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0442\u0435\u043b\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172666","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb Exim 4.99.3 \u00ebsht\u00eb eliminuar dob\u00ebsia q\u00eb lejon ekzekutimin e kodit n\u00eb distanc\u00eb gjat\u00eb p\u00ebrdorimit t\u00eb GnuTLS | ProHoster","description":"Zhvilluesit e serverit t\u00eb post\u00ebs Exim l\u00ebshuan nj\u00eb version korrigjues Exim 4.99.3, i cili riparon nj\u00eb dob\u00ebsi n\u00eb disa konfigurime t\u00eb agjentit t\u00eb post\u00ebs.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Exim 4.99.3 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 GnuTLS | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0440\u0435\u043b\u0438\u0437 Exim 4.99.3, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0430\u0433\u0435\u043d\u0442\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-exim-4-99-3-ustranena-uyazvimost-pozvolyayushhaya-udalyonnoe-vypolnenie-koda-pri-ispolzovanii-gnutls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T22:24:49+00:00","article:modified_time":"2026-05-18T22:24:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/172666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=172666"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/172666\/revisions"}],"predecessor-version":[{"id":173168,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/172666\/revisions\/173168"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=172666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=172666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=172666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}