- exim4 (4.92-8+deb10u4~hcoop1) unstable; urgency=medium
++exim4 (4.92-8+deb10u6~hcoop1) unstable; urgency=medium
+
+ * HCoop build
+
- -- Clinton Ebadi <clinton@unknownlamer.org> Sat, 20 Jun 2020 16:32:29 -0400
++ -- Clinton Ebadi <clinton@unknownlamer.org> Sat, 07 Aug 2021 14:56:12 -0400
++
+ exim4 (4.92-8+deb10u6) buster-security; urgency=high
+
+ * Fix several security vulnerabilities reported by Qualys and add related
+ robustness improvements. (Originally fixed in upstream release 4.94.3 and
+ in upstream GIT branch exim-4.92.3+fixes. (Special thanks to Heiko)
+ + CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
+ + CVE-2020-28018: Use-after-free in tls-openssl.c
+ + CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
+ + CVE-2020-28010: Heap out-of-bounds write in main()
+ + CVE-2020-28011: Heap buffer overflow in queue_run()
+ + CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
+ + CVE-2020-28017: Integer overflow in receive_add_recipient()
+ + CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
+ + CVE-2020-28026: Line truncation and injection in spool_read_header()
+ + CVE-2020-28015 and CVE-2020-28021: New-line injection into spool header
+ file.
+ + CVE-2020-28009: Integer overflow in get_stdinput()
+ + CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
+ + CVE-2020-28012: Missing close-on-exec flag for privileged pipe
+ + CVE-2020-28019: Failure to reset function pointer after BDAT error
+ + CVE-2020-28007: Link attack in Exim's log directory
+ + CVE-2020-28008: Assorted attacks in Exim's spool directory
+ + CVE-2020-28014, CVE-2021-27216: Arbitrary PID file creation, clobbering,
+ and deletion.
+
+ -- Andreas Metzler <ametzler@debian.org> Sat, 01 May 2021 11:42:39 +0200
+
+ exim4 (4.92-8+deb10u5) buster; urgency=medium
+
+ * Fix use of concurrent TLS connections under GnuTLS:
+ 80_01-GnuTLS-fix-hanging-callout-connections.patch
+ 80_02-GnuTLS-tls_write-wait-after-uncorking-the-session.patch
+ 80_03-GnuTLS-Do-not-care-about-corked-data-when-uncorking.patch
+ (Thanks, Heiko Schlittermann for the backport)
+ * Pull 82_TLS-use-RFC-6125-rules-for-certifucate-name-checks-w.patch from
+ upstream git (already included in 4.94), on TLS connections to a CNAME
+ verify the certificate against the original CNAME instead of against
+ the A record. Closes: #985243
+ * In README.Debian explicitly document the limitation/extent of server
+ certificate checking (authenticity not enforced) in the default
+ configuration (Thanks, Jö Fahlke). This Closes: #985244 (improved
+ documentation and Closes: #985344 (Yes, without required cert
+ checking MitM attacks are possible, but for a stable update documenting
+ this is the best compromise.)
+
+ -- Andreas Metzler <ametzler@debian.org> Thu, 18 Mar 2021 09:10:15 +0100
exim4 (4.92-8+deb10u4) buster-security; urgency=high
-- Andreas Metzler <ametzler@debian.org> Tue, 18 Nov 2014 19:28:20 +0100
+exim4 (4.84-8+hcoop4) unstable; urgency=medium
+
+ * Missed another chown that needs skipping
+
+ -- Clinton Ebadi <clinton@unknownlamer.org> Thu, 14 May 2015 01:35:09 -0400
+
+exim4 (4.84-8+hcoop3) unstable; urgency=medium
+
+ * Patch the right thing.
+
+ -- Clinton Ebadi <clinton@unknownlamer.org> Thu, 14 May 2015 00:34:14 -0400
+
+exim4 (4.84-8+hcoop2) unstable; urgency=medium
+
+ * Change message in chown failure for sanity check
+
+ -- Clinton Ebadi <clinton@unknownlamer.org> Wed, 13 May 2015 23:47:18 -0400
+
+exim4 (4.84-8+hcoop1) unstable; urgency=medium
+
+ * Relax chown requirement for delivery into afs
+
+ -- Clinton Ebadi <clinton@unknownlamer.org> Wed, 13 May 2015 23:26:54 -0400
+
exim4 (4.84-8) unstable; urgency=medium
* Pull 83_Remove-limit-on-remove_headers-item-size.-Bug-1533.patch and
33_eximon.binary.dpatch
34_eximstatsmanpage.dpatch
35_install.dpatch
+50-relax-appendfile-chown-openafs.patch
60_convert4r4.dpatch
67_unnecessaryCopt.diff
70_remove_exim-users_references.dpatch
78_02-Fix-buffer-overflow-in-string_vformat.-Bug-2449.patch
79_01-Fix-SPA-authenticator-checking-client-supplied-data-.patch
79_02-Rework-SPA-fix-to-avoid-overflows.-Bug-2571.patch
+ 80_01-GnuTLS-fix-hanging-callout-connections.patch
+ 80_02-GnuTLS-tls_write-wait-after-uncorking-the-session.patch
+ 80_03-GnuTLS-Do-not-care-about-corked-data-when-uncorking.patch
+ 82_TLS-use-RFC-6125-rules-for-certifucate-name-checks-w.patch
+ 84_01-CVE-2020-28025-Heap-out-of-bounds-read-in-pdkim_fini.patch
+ 84_02-CVE-2020-28018-Use-after-free-in-tls-openssl.c.patch
+ 84_03-CVE-2020-28023-Out-of-bounds-read-in-smtp_setup_msg.patch
+ 84_04-CVE-2020-28010-Heap-out-of-bounds-write-in-main.patch
+ 84_05-CVE-2020-28011-Heap-buffer-overflow-in-queue_run.patch
+ 84_06-CVE-2020-28013-Heap-buffer-overflow-in-parse_fix_phr.patch
+ 84_07-Security-Refuse-negative-and-large-store-allocations.patch
+ 84_08-CVE-2020-28017-Integer-overflow-in-receive_add_recip.patch
+ 84_09-CVE-2020-28022-Heap-out-of-bounds-read-and-write-in-.patch
+ 84_10-CVE-2020-28026-Line-truncation-and-injection-in-spoo.patch
+ 84_11-CVE-2020-28015-28021-New-line-injection-into-spool-h.patch
+ 84_12-CVE-2020-28009-Integer-overflow-in-get_stdinput.patch
+ 84_13-CVE-2020-28024-Heap-buffer-underflow-in-smtp_ungetc.patch
+ 84_14-CVE-2020-28012-Missing-close-on-exec-flag-for-privil.patch
+ 84_15-Security-Safeguard-against-relative-names-for-msglog.patch
+ 84_16-Security-Check-overrun-rcpt_count-integer.patch
+ 84_17-Security-Always-exit-when-LOG_PANIC_DIE-is-set.patch
+ 84_18-Security-Fix-off-by-one-in-smtp-transport-read-respo.patch
+ 84_19-Security-Avoid-decrement-of-dkim_collect_input-if-al.patch
+ 84_20-Security-Leave-a-clean-smtp_out-input-buffer-even-in.patch
+ 84_21-Security-Avoid-modification-of-constant-data-in-dkim.patch
+ 84_22-CVE-2020-28019-Failure-to-reset-function-pointer-aft.patch
+ 84_23-CVE-2020-28007-Link-attack-in-Exim-s-log-directory.patch
+ 84_24-CVE-2020-28008-Assorted-attacks-in-Exim-s-spool-dire.patch
+ 84_26-CVE-2020-28014-CVE-2021-27216-Arbitrary-PID-file-cre.patch
+ 84_27-testsuite-adjustments-for-CVE-2020-28014-CVE-2021-27.patch
+ 84_29-Fix-BDAT-issue-for-body-w-o-trailing-CRLF-again-Bug-.patch
90_localscan_dlopen.dpatch
HCoop / hcoop / debian / exim4.git / commitdiff