cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
f6137b44bd
openbsd-ports/mail
History
lebel f6137b44bd Added patch from Timo Sirainen <tss@iki.fi> to fix exploit. 
---cut---
Well, I was going to wait until 2.50 release, but it seems to be taking and
this likely affects only few installations. Besides, it's been in their
public bugzilla for over a month. So:

Attacker may be able to execute arbitrary code by sending a specially
crafted e-mail to a system using SpamAssassin's spamc program in BSMTP mode
(-B option). Versions from 2.40 to 2.43 are affected.

Exim users especially should check if they're affected, the -B option is
used in several Exim+SpamAssassin HOWTOs.

The problem is with escaping '.' characters at the beginning of lines.
Off-by-one bounds checking error allows writing '.' character past a
buffer, overwriting the stack frame address. Depending on system this may
be exploitable. Pre-built Debian unstable/x86 package wasn't vulnerable, my
self compiled was.
---cut---
2003-01-26 16:43:45 +00:00
..
abook and more. 2002-12-29 15:12:31 +00:00
adcomplain No regression tests available. 2002-10-27 17:21:39 +00:00
asmail No regression tests available. 2002-10-27 17:21:39 +00:00
bmf update to the bmf mini-howto; from MAINTAINER 2002-12-13 21:40:25 +00:00
bulk_mailer No regression tests available. 2002-10-27 17:21:39 +00:00
c-client update to c-client from pine 4.52 2003-01-10 08:24:52 +00:00
cmail Remove p5-libnet port dependency; it now comes stock with perl 2002-10-30 04:13:36 +00:00
courier-imap and more. 2002-12-29 15:12:31 +00:00
cucipop No regression tests available. 2002-10-27 17:21:39 +00:00
elm No regression tests available. 2002-10-27 17:21:39 +00:00
evolution Update to 1.2.1. 2003-01-03 21:53:07 +00:00
exim Fix a format string bug. The vulnerability can only be exploited by the 2002-12-07 16:34:57 +00:00
exmh and more. 2002-12-29 15:12:31 +00:00
exmh2 No regression tests available. 2002-10-27 17:21:39 +00:00
faces Remove Angelos from maintainer per his request 2002-12-23 00:37:49 +00:00
fetchmail SECURITY FIX: update to fetchmail 6.2.0. 2002-12-13 08:53:56 +00:00
getmail update to 2.3.10 2003-01-19 01:02:53 +00:00
grepmail grepmail-4.80 2002-11-01 02:57:55 +00:00
hypermail Change MAINTAINER address to margarida@openbsd.org ; 2002-11-22 02:37:36 +00:00
imap-uw update to version 2002.336, bugfix release 2003-01-10 08:36:10 +00:00
imp use MASTER_SITE_HORDE 2002-08-17 01:51:08 +00:00
isync * update MASTER_SITES and HOMEPAGE 2002-09-12 14:45:33 +00:00
kbiff update mail/kbiff to 3.6.3; use qt3-mt since kde now uses it 2003-01-08 16:59:16 +00:00
mailcrypt Enable regression test--which fails. 2002-10-27 16:59:48 +00:00
maildrop and more. 2002-12-29 15:12:31 +00:00
mailman use the actual homepage in HOMEPAGE 2003-01-18 18:25:10 +00:00
majordomo No regression tests available. 2002-10-27 17:21:39 +00:00
mboxgrep and more. 2002-12-29 15:12:31 +00:00
metamail No regression tests available. 2002-10-27 17:21:39 +00:00
mh Remove Angelos from maintainer per his request 2002-12-23 00:37:49 +00:00
mixmaster update to 2.9.0 2002-12-25 16:48:12 +00:00
movemail minor formatting 2002-12-23 08:27:36 +00:00
mutt update mutt/snapshot to 1.5.3i 2003-01-14 16:37:58 +00:00
nail update to 10.3 2002-12-04 08:35:12 +00:00
nmh No regression tests available. 2002-10-27 17:21:39 +00:00
openwebmail Delete p5-CGI dependency from here, too ... 2002-11-29 05:43:17 +00:00
p5-Mail-Alias and more. 2002-12-29 15:12:31 +00:00
p5-Mail-Audit and more. 2002-12-29 15:12:31 +00:00
p5-Mail-Box p5-Locale-Maketext & p5-Scalar-Utils now come stock with perl; remove deps 2002-10-30 05:01:43 +00:00
p5-Mail-IMAPClient Update to version 2.2.5. 2002-11-30 19:54:11 +00:00
p5-Mail-POP3Client and more. 2002-12-29 15:12:31 +00:00
p5-Mail-SpamAssassin Added patch from Timo Sirainen <tss@iki.fi> to fix exploit. 2003-01-26 16:43:45 +00:00
p5-Mail-Tools Remove p5-libnet port dependency; it now comes stock with perl 2002-10-30 04:13:36 +00:00
p5-MIME-Lite Change MAINTAINER address to margarida@openbsd.org ; 2002-11-22 02:37:36 +00:00
p5-MIME-tools Remove p5-MIME-Base64 dependencies as it's stock with perl now 2002-11-27 06:49:42 +00:00
p5-MIME-Types Initial import of MIME-Types-1.001 2002-07-11 09:22:45 +00:00
p5-SMTP-Server initial import of mail/p5-SMTP-Server 1.1: 2002-09-11 18:42:30 +00:00
pflogsumm update to pflogsumm version 1.0.7 2002-12-31 18:46:42 +00:00
pgpsendmail No regression tests available. 2002-10-27 17:21:39 +00:00
pine Update to Pine 4.53, fixes filtering bug 2003-01-16 07:22:40 +00:00
popclient and more. 2002-12-29 15:12:31 +00:00
poppassd Remove Angelos from maintainer per his request 2002-12-23 00:37:49 +00:00
poppy No regression tests available. 2002-10-27 17:21:39 +00:00
postfix update to postfix v2.0.2, fixes broken 'sendmail -bs' 2003-01-15 16:46:40 +00:00
prepop No regression tests available. 2002-10-27 17:21:39 +00:00
procmail No regression tests available. 2002-10-27 17:21:39 +00:00
razor-agents Fix Perl 5.8.0 fallout. 2002-12-01 19:14:21 +00:00
relaydb initial import for mail/relaydb-1.0: 2003-01-24 21:07:05 +00:00
sma Fixed remaining gcc 2002-12-11 19:19:20 +00:00
smtpclient No regression tests available. 2002-10-27 17:21:39 +00:00
solid-pop3d these are not likely to change anytime soon, so drop NEED_VERSION now 2002-09-12 16:41:26 +00:00
sylpheed this does not need the pseudo FLAVORed no_gnome version of gdk-pixbuf. 2003-01-18 22:41:44 +00:00
teapop No regression tests available. 2002-10-27 17:21:39 +00:00
tkrat No regression tests available. 2002-10-27 17:21:39 +00:00
tmda Tweaks from new maintainer Jim Geovedi <jim@corebsd.or.id>. 2002-12-12 01:25:36 +00:00
tnef and more. 2002-12-29 15:12:31 +00:00
ttygrin Respect CC/CXX/CFLAGS/CXXFLAGS. 2002-09-28 23:12:31 +00:00
vrfy No regression tests available. 2002-10-27 17:21:39 +00:00
wmbiff No regression tests available. 2002-10-27 17:21:39 +00:00
wmmail remove NEED_VERSION from ports that haven't changed in a long while 2002-09-17 14:46:06 +00:00
wmmultipop3 Update maintainer email address per request 2002-08-23 08:51:57 +00:00
wmpop3 remove NEED_VERSION from ports that haven't changed in a long while 2002-09-17 14:46:06 +00:00
xfaces No regression tests available. 2002-10-27 17:21:39 +00:00
xfmail and more. 2002-12-29 15:12:31 +00:00
xlbiff No regression tests available. 2002-10-27 17:21:39 +00:00
Makefile +relaydb 2003-01-24 21:07:33 +00:00