clear statement on CVE-2023-42118

[exim-website.git] / templates / static / doc / security / CVE-2023-zdi.txt

diff --git a/templates/static/doc/security/CVE-2023-zdi.txt b/templates/static/doc/security/CVE-2023-zdi.txt
index ceb4313983f9c1e29b2df96d1c81c45ffc4700e3..3b45efd74aef496f368e82dcd8bd5245a936fd3e 100644 (file)
--- a/templates/static/doc/security/CVE-2023-zdi.txt
+++ b/templates/static/doc/security/CVE-2023-zdi.txt
@@ -20,10 +20,15 @@ on or off.
   resolver (which does validation of the data it receives), you're not
   affected. We're working on a fix.
 
-Schedule
+Timeline
 --------
-The available fixes will be published on Monday, Oct 2nd, 12:00 UTC.
-A security release exim-4.96.1 will be published at the same time.
+- 2023-10-03 12:00 UTC 
+  - The available fixes are published.
+  - A security release exim-4.96.1 is published.
+  - The major distributions follow.
+
+More patches will follow (coordinated with the major distros) as soon as
+they're available.
 
 Distribution points:
 --------------------
@@ -82,12 +87,10 @@ Subject:    libspf2 Integer Underflow
 CVSS Score: 7.5
 Mitigation: Do not use the `spf` condition in your ACL
 Subsystem:  spf
-Remark:     It is debatable if this should be filed against
-            libspf2. There are hints (simon, #Exim IRC) that this
-           is related to
-           https://github.com/shevek/libspf2/pull/44
+Remark:     This CVE should be filed against libspf2.
+            See: https://github.com/shevek/libspf2/issues/45
 
-ZDI-23-1473 | ZDI-CAN-17643 | CVE-2023-42219 | Exim Bug 3033
+ZDI-23-1473 | ZDI-CAN-17643 | CVE-2023-42119 | Exim Bug 3033
 ------------------------------------------------------------
 Subject:    dnsdb Out-Of-Bounds Read
 CVSS Score: 3.1