diffstat for exim4-4.89 exim4-4.89 changelog | 472 ++++++++++++++++++++++++++++++++++++++++++ control | 5 patches/CVE-2017-16943.patch | 37 +++ patches/CVE-2017-16944.patch | 78 ++++++ patches/CVE-2018-6789.patch | 56 ++++ patches/fix_smtp_banner.patch | 52 ++++ patches/series | 4 7 files changed, 702 insertions(+), 2 deletions(-) diff -Nru exim4-4.89/debian/changelog exim4-4.89/debian/changelog --- exim4-4.89/debian/changelog 2017-08-10 08:17:05.000000000 +0000 +++ exim4-4.89/debian/changelog 2018-02-10 19:12:27.000000000 +0000 @@ -1,3 +1,39 @@ +exim4 (4.89-5ubuntu1.3) artful-security; urgency=medium + + * SECURITY UPDATE: Buffer overflow in base64d() + - debian/patches/CVE-2018-6789.patch: fix overflow in src/base64.c. + - CVE-2018-6789 + + -- Marc Deslauriers Sat, 10 Feb 2018 14:12:27 -0500 + +exim4 (4.89-5ubuntu1.2) artful-security; urgency=medium + + * SECURITY UPDATE: stack-exhaustion remote DoS + - debian/patches/CVE-2017-16944.patch: do not treat the first lonely + dot special in src/receive.c, src/smtp_in.c. + - CVE-2017-16944 + + -- Marc Deslauriers Wed, 29 Nov 2017 08:59:31 -0500 + +exim4 (4.89-5ubuntu1.1) artful-security; urgency=medium + + * SECURITY UPDATE: remote code execution via use-after-free + - debian/patches/CVE-2017-16943.patch: avoid release of store if there + have been later allocations in src/receive.c. + - CVE-2017-16943 + + -- Marc Deslauriers Mon, 27 Nov 2017 07:37:47 -0500 + +exim4 (4.89-5ubuntu1) artful; urgency=medium + + * Merge from Debian testing. + Remaining changes: + - Show Ubuntu distribution in SMTP banner + - Build-Depends on lsb-release to detect Distribution. + - d/p/fix_smtp_banner.patch: Show Ubuntu distribution in SMTP banner. + + -- Christian Ehrhardt Wed, 16 Aug 2017 15:42:47 +0200 + exim4 (4.89-5) unstable; urgency=medium * Update to exim-4_89+fixes branch: @@ -41,6 +77,20 @@ -- Andreas Metzler Sat, 15 Jul 2017 12:46:16 +0200 +exim4 (4.89-3ubuntu2) artful; urgency=medium + + * No-change rebuild for perl 5.26.0. + + -- Matthias Klose Wed, 26 Jul 2017 20:02:24 +0000 + +exim4 (4.89-3ubuntu1) artful; urgency=medium + + * Merge from Debian. Remaining changes: + - Show Ubuntu distribution in SMTP banner. + - Build-Depends on lsb-release (needed for the Ubuntu SMTP banner patch) + + -- Marc Deslauriers Tue, 27 Jun 2017 10:20:42 -0400 + exim4 (4.89-3) unstable; urgency=high * Re-upload to unstable. @@ -53,6 +103,15 @@ -- Wed, 14 Jun 2017 07:03:07 +0200 +exim4 (4.89-2ubuntu1) artful; urgency=medium + + * Merge from Debian testing. + Remaining changes: + + Show Ubuntu distribution in SMTP banner. + + Build-Depends on lsb-release (needed for the Ubuntu SMTP banner patch) + + -- Christian Ehrhardt Thu, 01 Jun 2017 11:58:00 +0200 + exim4 (4.89-2) unstable; urgency=medium * Revert addition of header "# pidfile: /var/run/exim4/exim.pid" to @@ -144,6 +203,17 @@ -- Andreas Metzler Tue, 31 Jan 2017 19:52:50 +0100 +exim4 (4.88-5ubuntu1) zesty; urgency=medium + + * Merge from Debian unstable. + Version 4.88 fixes CVE-2016-9963 (LP: #1654750) and symlink + local root escalation (LP: #1580454) + Remaining changes: + + Show Ubuntu distribution in SMTP banner. + + Build-Depends on lsb-release (needed for the Ubuntu SMTP banner patch) + + -- Christian Ehrhardt Tue, 24 Jan 2017 10:15:09 +0100 + exim4 (4.88-5) unstable; urgency=medium * 78_Disable-chunking-BDAT-by-default.patch: Change default value of main @@ -296,6 +366,20 @@ -- Andreas Metzler Sun, 25 Sep 2016 15:44:00 +0200 +exim4 (4.87-3ubuntu2) zesty; urgency=medium + + * No-change rebuild for perl 5.24 transition + + -- Iain Lane Mon, 24 Oct 2016 10:08:10 +0100 + +exim4 (4.87-3ubuntu1) yakkety; urgency=medium + + * Merge from Debian unstable. Remaining changes: + + Show Ubuntu distribution in SMTP banner. + + Build-Depends on lsb-release (needed for the Ubuntu SMTP banner patch) + + -- Christian Ehrhardt Tue, 26 Jul 2016 13:30:09 +0200 + exim4 (4.87-3) unstable; urgency=medium * Pull multiple patches from upstream GIT: @@ -469,6 +553,21 @@ -- Andreas Metzler Fri, 11 Dec 2015 20:15:30 +0100 +exim4 (4.86.2-2ubuntu2) xenial; urgency=medium + + * Rebuild against libmysqlclient20. + + -- Robie Basak Tue, 05 Apr 2016 12:21:41 +0000 + +exim4 (4.86.2-2ubuntu1) xenial; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - debian.control, debian/patches/fix_smtp_banner.patch + + Show Ubuntu distribution in SMTP banner. + + Build-Depends on lsb-release. + + -- Marc Deslauriers Tue, 15 Mar 2016 11:56:18 -0400 + exim4 (4.86.2-2) unstable; urgency=high * Bump exim4-config Breaks to exim4-daemon-* (<< 4.86.2). Closes: #816790 @@ -490,6 +589,27 @@ -- Andreas Metzler Tue, 01 Mar 2016 19:34:39 +0100 +exim4 (4.86-7ubuntu3) xenial; urgency=medium + + * No-change rebuild for gnutls transition. + + -- Matthias Klose Wed, 17 Feb 2016 22:40:56 +0000 + +exim4 (4.86-7ubuntu2) xenial; urgency=medium + + * Rebuild for Perl 5.22.1. + + -- Colin Watson Fri, 18 Dec 2015 10:30:54 +0000 + +exim4 (4.86-7ubuntu1) xenial; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - debian.control, debian/patches/fix_smtp_banner.patch + + Show Ubuntu distribution in SMTP banner. + + Build-Depends on lsb-release. + + -- Pierre-André MOREY Mon, 14 Dec 2015 14:23:51 +0100 + exim4 (4.86-7) unstable; urgency=medium * Allow arch-indep build (dpkg-buildpackage -A). Closes: #806023 @@ -540,6 +660,15 @@ -- Andreas Metzler Sat, 17 Oct 2015 15:01:01 +0200 +exim4 (4.86-3ubuntu1) wily; urgency=medium + + * Merge from Debian unstable. (LP: #1485369) Remaining changes: + - debian/control, debian/patches/fix_smtp_banner.patch: + + Show Ubuntu distribution in SMTP banner. + + Build-Depends on lsb-release. + + -- Artur Rona Thu, 17 Sep 2015 13:18:20 +0100 + exim4 (4.86-3) unstable; urgency=medium * Pull three patches from upstream git: @@ -580,6 +709,15 @@ -- Andreas Metzler Sat, 18 Jul 2015 11:46:11 +0200 +exim4 (4.86~RC4-2ubuntu1) wily; urgency=low + + * Merge from Debian unstable. (LP: #1166671) Remaining changes: + - debian/control, debian/patches/fix_smtp_banner.patch: + + Show Ubuntu distribution in SMTP banner. + + Build-Depends on lsb-release. + + -- Artur Rona Mon, 06 Jul 2015 12:09:36 +0200 + exim4 (4.86~RC4-2) unstable; urgency=medium * Drop libmysqlclient15-dev alternative build-dependency. Closes: #790463 @@ -744,6 +882,18 @@ -- Andreas Metzler Tue, 18 Nov 2014 19:28:20 +0100 +exim4 (4.84-8ubuntu1) vivid; urgency=low + + * Merge from Debian unstable. (LP: #1434300) Remaining changes: + - debian/control, debian/patches/fix_smtp_banner.patch: + + Show Ubuntu distribution in SMTP banner. + + Build-Depends on lsb-release. + - debian/control: + + Don't provide default-mta; in Ubuntu, + we want postfix to be the default. + + -- Artur Rona Thu, 19 Mar 2015 00:15:40 +0100 + exim4 (4.84-8) unstable; urgency=medium * Pull 83_Remove-limit-on-remove_headers-item-size.-Bug-1533.patch and @@ -761,6 +911,15 @@ -- Andreas Metzler Sat, 07 Feb 2015 15:12:33 +0100 +exim4 (4.84-6ubuntu1) vivid; urgency=medium + + * Resynchronise with Debian. Remaining changes: + - Show Ubuntu distribution in SMTP banner. + - Don't provide default-mta; in Ubuntu, we want postfix to be the + default. + + -- Colin Watson Wed, 14 Jan 2015 11:26:29 +0000 + exim4 (4.84-6) unstable; urgency=medium * Revert init script's restart order change in 4.84-4 for the time being. @@ -769,6 +928,15 @@ -- Andreas Metzler Sun, 21 Dec 2014 14:07:12 +0100 +exim4 (4.84-5ubuntu1) vivid; urgency=medium + + * Resynchronise with Debian. Remaining changes: + - Show Ubuntu distribution in SMTP banner. + - Don't provide default-mta; in Ubuntu, we want postfix to be the + default. + + -- Colin Watson Thu, 18 Dec 2014 15:26:17 +0000 + exim4 (4.84-5) unstable; urgency=medium * 82_quoted-or-r-2047-encoded.diff pulled from upstream git (sans @@ -776,6 +944,15 @@ -- Andreas Metzler Wed, 17 Dec 2014 19:03:39 +0100 +exim4 (4.84-4ubuntu1) vivid; urgency=medium + + * Resynchronise with Debian. Remaining changes: + - Show Ubuntu distribution in SMTP banner. + - Don't provide default-mta; in Ubuntu, we want postfix to be the + default. + + -- Colin Watson Tue, 02 Dec 2014 15:28:46 +0000 + exim4 (4.84-4) unstable; urgency=medium * Unset message_prefix/message_sufix in maildrop_pipe transport. Maildrop @@ -790,6 +967,15 @@ -- Andreas Metzler Sun, 30 Nov 2014 08:24:04 +0100 +exim4 (4.84-3ubuntu1) vivid; urgency=medium + + * Resynchronise with Debian. Remaining changes: + - Show Ubuntu distribution in SMTP banner. + - Don't provide default-mta; in Ubuntu, we want postfix to be the + default. + + -- Colin Watson Tue, 11 Nov 2014 13:43:35 +0000 + exim4 (4.84-3) unstable; urgency=medium * Apply patch to Italian (it) debconf template translation, thanks to @@ -819,6 +1005,24 @@ -- Andreas Metzler Sat, 09 Aug 2014 07:42:00 +0200 +exim4 (4.84~RC1-3ubuntu2) utopic; urgency=medium + + * Rebuild for Perl 5.20.0. + + -- Colin Watson Thu, 21 Aug 2014 12:18:13 +0100 + +exim4 (4.84~RC1-3ubuntu1) utopic; urgency=low + + * Merge from Debian unstable (LP: #1351470). Remaining changes: + - Show Ubuntu distribution on smtp: + + debian/patches/fix_smtp_banner.patch: updated SMTP banner + with Ubuntu distribution + + debian/control: added lsb-release build dependency + - Don't provide default-mta; in Ubuntu, we want postfix to be the + default. + + -- Corey Bryant Mon, 04 Aug 2014 11:48:39 -0400 + exim4 (4.84~RC1-3) unstable; urgency=medium * Third try. Simply comment *custom* in debian/control. @@ -887,6 +1091,18 @@ -- Andreas Metzler Thu, 29 May 2014 13:09:04 +0200 +exim4 (4.82.1-2ubuntu1) utopic; urgency=low + + * Merge from Debian unstable (LP: #1348074). Remaining changes: + - Show Ubuntu distribution on smtp: + + debian/patches/fix_smtp_banner.patch: updated SMTP banner + with Ubuntu distribution + + debian/control: added lsb-release build dependency + - Don't provide default-mta; in Ubuntu, we want postfix to be the + default. + + -- Robie Basak Fri, 25 Jul 2014 15:53:09 +0000 + exim4 (4.82.1-2) unstable; urgency=high * [87_double_expansion.diff] from upstream. Stop unwanted double expansion @@ -904,6 +1120,18 @@ -- Andreas Metzler Wed, 28 May 2014 19:01:43 +0200 +exim4 (4.82-8ubuntu1) utopic; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - Show Ubuntu distribution on smtp: + + debian/patches/fix_smtp_banner.patch: updated SMTP banner + with Ubuntu distribution + + debian/control: added lsb-release build dependency + - Don't provide default-mta; in Ubuntu, we want postfix to be the + default. + + -- Dimitri John Ledkov Sat, 17 May 2014 01:50:20 +0100 + exim4 (4.82-8) unstable; urgency=medium * Now that GMP has been relicensed to LGPLv3+/GPLv2+ build exim against @@ -967,6 +1195,26 @@ -- Andreas Metzler Sun, 09 Feb 2014 19:41:34 +0100 +exim4 (4.82-3ubuntu2) trusty; urgency=medium + + * debian/tests/control: Add missing python test dependency, as + debian/tests/security calls python. + + -- Martin Pitt Tue, 25 Feb 2014 17:33:13 +0100 + +exim4 (4.82-3ubuntu1) trusty; urgency=low + + * Merge from Debian unstable (LP: #1259620). Remaining changes: + - Show Ubuntu distribution on smtp: + + debian/patches/fix_smtp_banner.patch: updated SMTP banner + with Ubuntu distribution + + debian/control: added lsb-release build dependency + - Don't provide default-mta; in Ubuntu, we want postfix to be the + default. + - Build-depend on db5.3. + + -- Yolanda Robla Tue, 10 Dec 2013 17:07:20 +0000 + exim4 (4.82-3) unstable; urgency=low * Upload to unstable. @@ -1047,6 +1295,21 @@ -- Andreas Metzler Sun, 29 Sep 2013 14:43:25 +0200 +exim4 (4.80-9ubuntu2) trusty; urgency=low + + * Build-depend on libdb5.3-dev, instead of libdb5.1-dev. + + -- Dmitrijs Ledkovs Mon, 04 Nov 2013 12:14:54 +0000 + +exim4 (4.80-9ubuntu1) trusty; urgency=low + + * Resynchronise with Debian. Remaining changes: + - Don't provide default-mta; in Ubuntu, we want postfix to be the + default. + - Add "Ubuntu" to SMTP banner. + + -- Colin Watson Mon, 28 Oct 2013 11:55:21 -0700 + exim4 (4.80-9) unstable; urgency=low * Upload to unstable. @@ -1093,6 +1356,34 @@ -- Andreas Metzler Sun, 01 Sep 2013 15:58:49 +0200 +exim4 (4.80-7ubuntu4) trusty; urgency=low + + * Rebuild for Perl 5.18. + + -- Colin Watson Wed, 23 Oct 2013 10:24:08 +0100 + +exim4 (4.80-7ubuntu3) saucy; urgency=low + + * debian/patches/fix_smtp_banner.patch: updated SMTP banner + with Ubuntu distribution + * debian/control: added lsb-release build dependency + + -- Yolanda Robla Tue, 18 Jun 2013 19:17:43 +0200 + +exim4 (4.80-7ubuntu2) saucy; urgency=low + + * debian/tests: Add autopkgtest. + + -- Yolanda Mon, 27 May 2013 11:31:35 +0200 + +exim4 (4.80-7ubuntu1) raring; urgency=low + + * Merge from Debian unstable (LP: #1166383). Remaining changes: + - debian/control: Don't declare a Provides: default-mta; in Ubuntu, + we want postfix to be the default. + + -- Robie Basak Mon, 08 Apr 2013 18:13:15 +0100 + exim4 (4.80-7) unstable; urgency=low * Use exim's ${quote:xxx} operator when invoking spfquery to disallow @@ -1112,6 +1403,14 @@ -- Andreas Metzler Wed, 21 Nov 2012 19:08:53 +0100 +exim4 (4.80-5.1ubuntu1) raring; urgency=low + + * Merge from Debian. Remaining changes: + - debian/control: Don't declare a Provides: default-mta; in Ubuntu, + we want postfix to be the default. + + -- Oussama Bounaim Sun, 11 Nov 2012 07:11:06 +0100 + exim4 (4.80-5.1) unstable; urgency=high * Non-maintainer upload by the Security Team. @@ -1139,6 +1438,23 @@ -- Andreas Metzler Sat, 23 Jun 2012 18:35:03 +0200 +exim4 (4.80-3ubuntu1.1) quantal-security; urgency=low + + * SECURITY UPDATE: arbitrary code execution via dns decode logic + - debian/patches/CVE-2012-5671.patch: adjust max length and validate + against it in src/pdkim/pdkim.h, src/dkim.c. + - CVE-2012-5671 + + -- Marc Deslauriers Thu, 25 Oct 2012 08:22:46 -0400 + +exim4 (4.80-3ubuntu1) quantal; urgency=low + + * Merge from Debian unstable. Remaining changes: + - debian/control: Don't declare a Provides: default-mta; in Ubuntu, + we want postfix to be the default. + + -- Clint Byrum Thu, 14 Jun 2012 15:28:08 -0700 + exim4 (4.80-3) unstable; urgency=low * Pull 75_openssl_sni.diff from upstream. - Segfault caused by NULL @@ -1286,6 +1602,26 @@ -- Andreas Metzler Sat, 24 Sep 2011 18:36:08 +0200 +exim4 (4.76-3ubuntu3) precise; urgency=low + + * Rebuild for libmysqlclient transition + + -- Clint Byrum Wed, 23 Nov 2011 23:29:35 -0800 + +exim4 (4.76-3ubuntu2) precise; urgency=low + + * Rebuild for Perl 5.14. + + -- Colin Watson Wed, 16 Nov 2011 01:22:39 +0000 + +exim4 (4.76-3ubuntu1) precise; urgency=low + + * Merge from debian unstable. Remaining changes: + - debian/control: Don't declare a Provides: default-mta; in Ubuntu, + we want postfix to be the default. + + -- Stéphane Graber Thu, 20 Oct 2011 11:29:07 -0400 + exim4 (4.76-3) unstable; urgency=low * [exim4-base.cron.daily] Correct invocation of mail(1), options need to be @@ -1306,6 +1642,14 @@ -- Andreas Metzler Sun, 18 Sep 2011 11:49:13 +0200 +exim4 (4.76-2ubuntu1) oneiric; urgency=low + + * Merge from debian unstable. Remaining changes: + - debian/control: Don't declare a Provides: default-mta; in Ubuntu, + we want postfix to be the default. + + -- Stéphane Graber Mon, 30 May 2011 17:48:56 -0400 + exim4 (4.76-2) unstable; urgency=low * debian/rules: Remove test/ and test-stamp on clean. @@ -1318,6 +1662,14 @@ -- Andreas Metzler Sun, 29 May 2011 18:21:03 +0200 +exim4 (4.76-1ubuntu1) oneiric; urgency=low + + * Merge from debian unstable. Remaining changes (LP: #779391): + - debian/control: Don't declare a Provides: default-mta; in Ubuntu, + we want postfix to be the default. + + -- Stéphane Graber Mon, 23 May 2011 12:37:30 -0400 + exim4 (4.76-1) unstable; urgency=low * New upstream version. @@ -1364,6 +1716,14 @@ -- Andreas Metzler Fri, 06 May 2011 20:08:51 +0200 +exim4 (4.75-2ubuntu1) oneiric; urgency=low + + * Merge from debian unstable. Remaining changes: + - debian/control: Don't declare a Provides: default-mta; in Ubuntu, + we want postfix to be the default. + + -- Stéphane Graber Fri, 06 May 2011 14:51:28 -0400 + exim4 (4.75-2) unstable; urgency=low * clamav socket on Debian is clamd:/var/run/clamav/clamd.ctl, fix @@ -1406,6 +1766,24 @@ -- Andreas Metzler Thu, 24 Feb 2011 19:02:07 +0100 +exim4 (4.74-1ubuntu1) natty; urgency=low + + * Merge from debian experimental. Remaining changes: (LP: #713855) + - debian/patches/71_exiq_grep_error_on_messages_without_size.patch: + + Improve handling of broken messages when "exim4 -bp" (mailq) + reports lines without size info. (Closes: #528625) + - debian/control: Don't declare a Provides: default-mta; in Ubuntu, + we want postfix to be the default. + - debian/{control,rules}: Add and enable hardened build for PIE. + (Closes: #542726) + * Update 71_exiq_grep_error_on_messages_without_size.patch to get way + which upstream has fixed it. Probably it can be dropped with next + upstream release. + * This upload fixes CVE: (LP: #708023) + - CVE-2011-0017 + + -- Artur Rona Wed, 09 Feb 2011 21:31:35 +0100 + exim4 (4.74-1) experimental; urgency=low * 4.74 release, should build on hurd again. @@ -1431,6 +1809,20 @@ -- Andreas Metzler Sun, 23 Jan 2011 14:02:36 +0100 +exim4 (4.73~rc1-1ubuntu1) natty; urgency=low + + * Merge from debian unstable. Remaining changes: (LP: #697934) + - debian/patches/71_exiq_grep_error_on_messages_without_size.patch: + + Improve handling of broken messages when "exim4 -bp" (mailq) + reports lines without size info. + - debian/control: Don't declare a Provides: default-mta; in Ubuntu, + we want postfix to be the default. + - debian/{control,rules}: Add and enable hardened build for PIE. + (Closes: #542726) + * Drop B-D on libmysqlclient15-dev, resolved in Debian. + + -- Artur Rona Tue, 28 Dec 2010 22:20:17 +0100 + exim4 (4.73~rc1-1) experimental; urgency=low * New upstream release candidate. @@ -1526,6 +1918,20 @@ -- Andreas Metzler Sun, 26 Dec 2010 15:13:08 +0100 +exim4 (4.72-2ubuntu1) natty; urgency=low + + * Merge from debian unstable. Remaining changes: (LP: #671615) + - debian/patches/71_exiq_grep_error_on_messages_without_size.dpatch: + Improve handling of broken messages when "exim4 -bp" (mailq) reports + lines without size info. + - Don't declare a Provides: default-mta; in Ubuntu, we want postfix to be + the default. + - debian/control: Change build dependencies to MySQL 5.1. + - debian/{control,rules}: add and enable hardened build for PIE + (Closes: #542726). + + -- Artur Rona Fri, 05 Nov 2010 21:05:47 +0100 + exim4 (4.72-2) unstable; urgency=low [ Marc Haber ] @@ -1549,6 +1955,20 @@ -- Andreas Metzler Sat, 30 Oct 2010 13:38:26 +0200 +exim4 (4.72-1ubuntu1) maverick; urgency=low + + * Merge with Debian unstable (LP: #609620). Remaining changes: + + debian/patches/71_exiq_grep_error_on_messages_without_size.dpatch: + Improve handling of broken messages when "exim4 -bp" (mailq) reports + lines without size info. + + Don't declare a Provides: default-mta; in Ubuntu, we want postfix to be + the default. + + debian/control: Change build dependencies to MySQL 5.1. + + debian/{control,rules}: add and enable hardened build for PIE + (Closes: #542726). + + -- Artur Rona Sun, 25 Jul 2010 02:00:42 +0200 + exim4 (4.72-1) unstable; urgency=low * New upstream release. (Identical to the git snapshot previously @@ -1600,6 +2020,20 @@ -- Andreas Metzler Thu, 25 Mar 2010 17:34:30 +0100 +exim4 (4.71-3ubuntu1) lucid; urgency=low + + * Merge with Debian unstable (lp: #501657). Remaining changes: + + debian/patches/71_exiq_grep_error_on_messages_without_size.dpatch: + Improve handling of broken messages when "exim4 -bp" (mailq) reports + lines without size info. + + Don't declare a Provides: default-mta; in Ubuntu, we want postfix to be + the default. + + debian/control: Change build dependencies to MySQL 5.1. + + debian/{control,rules}: add and enable hardened build for PIE + (Debian bug 542726). + + -- Michael Bienia Fri, 01 Jan 2010 16:28:19 +0100 + exim4 (4.71-3) unstable; urgency=low * exim4-base.cron.daily: Do not run exim_tidydb on Berkeley DB logfiles. @@ -1714,6 +2148,35 @@ -- Andreas Metzler Sat, 17 Oct 2009 14:26:54 +0200 +exim4 (4.69-11ubuntu4) karmic; urgency=low + + * debian/{control,rules}: add and enable hardened build for PIE + (Debian bug 542726). + + -- Kees Cook Thu, 20 Aug 2009 17:33:26 -0700 + +exim4 (4.69-11ubuntu3) karmic; urgency=low + + * debian/control: Change build dependencies to MySQL 5.1. + + -- Mathias Gug Mon, 17 Aug 2009 17:57:26 -0400 + +exim4 (4.69-11ubuntu2) karmic; urgency=low + + * Don't declare a Provides: default-mta; in Ubuntu, we want postfix to be + the default. + + -- Steve Langasek Wed, 03 Jun 2009 15:39:14 +0000 + +exim4 (4.69-11ubuntu1) karmic; urgency=low + + * Merge from debian unstable (LP: #375923), remaining changes: + - debian/patches/71_exiq_grep_error_on_messages_without_size.dpatch: + Improve handling of broken messages when "exim4 -bp" (mailq) reports + lines without size info + + -- Thierry Carrez Wed, 13 May 2009 12:15:29 +0200 + exim4 (4.69-11) unstable; urgency=medium * Build-Depend on lynx-cur|lynx instead of lynx. (lynx is just a dummy @@ -1771,6 +2234,15 @@ -- Andreas Metzler Sat, 02 May 2009 09:05:56 +0200 +exim4 (4.69-9ubuntu1) jaunty; urgency=low + + [ Daniel van Eeden ] + * debian/patches/71_exiq_grep_error_on_messages_without_size.dpatch: + Improve handling of broken messages when "exim4 -bp" (mailq) reports lines + w/o size info, LP: #18194 + + -- Dustin Kirkland Wed, 11 Feb 2009 06:43:52 -0600 + exim4 (4.69-9) unstable; urgency=medium * [update-exim4.conf]: Use POSIX character classes [:alnum:] or explicit diff -Nru exim4-4.89/debian/control exim4-4.89/debian/control --- exim4-4.89/debian/control 2017-07-15 09:46:40.000000000 +0000 +++ exim4-4.89/debian/control 2017-08-16 13:39:28.000000000 +0000 @@ -1,7 +1,8 @@ Source: exim4 Section: mail Priority: standard -Maintainer: Exim4 Maintainers +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Exim4 Maintainers Uploaders: Andreas Metzler ,Marc Haber Homepage: http://www.exim.org/ Standards-Version: 4.0.0 @@ -11,7 +12,7 @@ lynx-cur | lynx, docbook-xml, libpcre3-dev, libldap2-dev, libpam0g-dev, libident-dev, libdb5.3-dev, libxmu-dev, libxt-dev, libxext-dev, libx11-dev, libxaw7-dev, libpq-dev, default-libmysqlclient-dev, - libsqlite3-dev, libperl-dev, libgnutls28-dev, libsasl2-dev + libsqlite3-dev, libperl-dev, libgnutls28-dev, libsasl2-dev, lsb-release Package: exim4-base Architecture: any diff -Nru exim4-4.89/debian/patches/CVE-2017-16943.patch exim4-4.89/debian/patches/CVE-2017-16943.patch --- exim4-4.89/debian/patches/CVE-2017-16943.patch 1970-01-01 00:00:00.000000000 +0000 +++ exim4-4.89/debian/patches/CVE-2017-16943.patch 2017-11-27 12:37:42.000000000 +0000 @@ -0,0 +1,37 @@ +From 4e6ae6235c68de243b1c2419027472d7659aa2b4 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris +Date: Fri, 24 Nov 2017 20:22:33 +0000 +Subject: [PATCH] Avoid release of store if there have been later allocations. + Bug 2199 + +--- + src/src/receive.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +Index: exim4-4.89/src/receive.c +=================================================================== +--- exim4-4.89.orig/src/receive.c 2017-11-27 07:35:48.670440635 -0500 ++++ exim4-4.89/src/receive.c 2017-11-27 07:35:48.670440635 -0500 +@@ -1772,8 +1772,8 @@ for (;;) + (and sometimes lunatic messages can have ones that are 100s of K long) we + call store_release() for strings that have been copied - if the string is at + the start of a block (and therefore the only thing in it, because we aren't +- doing any other gets), the block gets freed. We can only do this because we +- know there are no other calls to store_get() going on. */ ++ doing any other gets), the block gets freed. We can only do this release if ++ there were no allocations since the once that we want to free. */ + + if (ptr >= header_size - 4) + { +@@ -1782,9 +1782,10 @@ for (;;) + header_size *= 2; + if (!store_extend(next->text, oldsize, header_size)) + { ++ BOOL release_ok = store_last_get[store_pool] == next->text; + uschar *newtext = store_get(header_size); + memcpy(newtext, next->text, ptr); +- store_release(next->text); ++ if (release_ok) store_release(next->text); + next->text = newtext; + } + } diff -Nru exim4-4.89/debian/patches/CVE-2017-16944.patch exim4-4.89/debian/patches/CVE-2017-16944.patch --- exim4-4.89/debian/patches/CVE-2017-16944.patch 1970-01-01 00:00:00.000000000 +0000 +++ exim4-4.89/debian/patches/CVE-2017-16944.patch 2017-11-29 13:59:27.000000000 +0000 @@ -0,0 +1,78 @@ +From 4804c62909a62a3ac12ec4777ebd48c541028965 Mon Sep 17 00:00:00 2001 +From: "Heiko Schlittermann (HS12-RIPE)" +Date: Mon, 27 Nov 2017 22:42:33 +0100 +Subject: [PATCH] Chunking: do not treat the first lonely dot special. + CVE-2017-16944, Bug 2201 + +(cherry picked from commit 178ecb70987f024f0e775d87c2f8b2cf587dd542) + +Change log update + +(cherry picked from commit b488395f4d99d44a950073a64b35ec8729102782) +--- + doc/doc-txt/ChangeLog | 6 +++++- + src/src/receive.c | 2 +- + src/src/smtp_in.c | 7 +++++++ + 3 files changed, 13 insertions(+), 2 deletions(-) + +#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog +#index a2d9339..541ebaf 100644 +#--- a/doc/doc-txt/ChangeLog +#+++ b/doc/doc-txt/ChangeLog +#@@ -61,7 +61,11 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for +# +# JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines. +# A crafted sequence of BDAT commands could result in in-use memory beeing +#- freed. +#+ freed. CVE-2017-16943. +#+ +#+HS/03 Bug 2201: Fix checking for leading-dot on a line during headers reading +#+ from SMTP input. Previously it was always done; now only done for DATA +#+ and not BDAT commands. CVE-2017-16944. +# +# +# Exim version 4.89 +diff --git a/src/receive.c b/src/receive.c +index 20672db..2812ea2 100644 +--- a/src/receive.c ++++ b/src/receive.c +@@ -1827,7 +1827,7 @@ for (;;) + prevent further reading), and break out of the loop, having freed the + empty header, and set next = NULL to indicate no data line. */ + +- if (ptr == 0 && ch == '.' && (smtp_input || dot_ends)) ++ if (ptr == 0 && ch == '.' && dot_ends) + { + ch = (receive_getc)(GETC_BUFFER_UNLIMITED); + if (ch == '\r') +diff --git a/src/smtp_in.c b/src/smtp_in.c +index 1b45f84..0207540 100644 +--- a/src/smtp_in.c ++++ b/src/smtp_in.c +@@ -4955,16 +4955,23 @@ while (done <= 0) + DEBUG(D_receive) debug_printf("chunking state %d, %d bytes\n", + (int)chunking_state, chunking_data_left); + ++ /* push the current receive_* function on the "stack", and ++ replace them by bdat_getc(), which in turn will use the lwr_receive_* ++ functions to do the dirty work. */ + lwr_receive_getc = receive_getc; + lwr_receive_ungetc = receive_ungetc; ++ + receive_getc = bdat_getc; + receive_ungetc = bdat_ungetc; + ++ dot_ends = FALSE; ++ + goto DATA_BDAT; + } + + case DATA_CMD: + HAD(SCH_DATA); ++ dot_ends = TRUE; + + DATA_BDAT: /* Common code for DATA and BDAT */ + if (!discarded && recipients_count <= 0) +-- +1.9.1 + diff -Nru exim4-4.89/debian/patches/CVE-2018-6789.patch exim4-4.89/debian/patches/CVE-2018-6789.patch --- exim4-4.89/debian/patches/CVE-2018-6789.patch 1970-01-01 00:00:00.000000000 +0000 +++ exim4-4.89/debian/patches/CVE-2018-6789.patch 2018-02-10 19:11:46.000000000 +0000 @@ -0,0 +1,56 @@ +From 062990cc1b2f9e5d82a413b53c8f0569075de700 Mon Sep 17 00:00:00 2001 +From: "Heiko Schlittermann (HS12-RIPE)" +Date: Mon, 5 Feb 2018 22:23:32 +0100 +Subject: [PATCH] Fix base64d() buffer size (CVE-2018-6789) + +Credits for discovering this bug: Meh Chang +--- + doc/doc-txt/ChangeLog | 6 ++++-- + src/src/base64.c | 8 ++++++-- + 2 files changed, 10 insertions(+), 4 deletions(-) + +#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog +#index 6e71f1fbb..970ec0732 100644 +#--- a/doc/doc-txt/ChangeLog +#+++ b/doc/doc-txt/ChangeLog +#@@ -5,8 +5,8 @@ affect Exim's operation, with an unchanged configuration file. For new +# options, and new features, see the NewStuff file next to this ChangeLog. +# +# +#-Since Exim version 4.90 +#------------------ +#+Exim version 4.90.1 +#+------------------- +# +# JH/03 Fix pgsql lookup for multiple result-tuples with a single column. +# Previously only the last row was returned. +#@@ -58,6 +58,8 @@ JH/14 Bug 2174: A timeout on connect for a callout was also erroneously seen as +# was marked defer_ok. Fix to keep the two timeout-detection methods +# separate. +# +#+HS/01 Fix Buffer overflow in base64d() (CVE-2018-6789) +#+ +# JH/16 Fix bug in DKIM verify: a buffer overflow could corrupt the malloc +# metadata, resulting in a crash in free(). +# +Index: exim4-4.89/src/base64.c +=================================================================== +--- exim4-4.89.orig/src/base64.c 2018-02-10 14:11:44.197870477 -0500 ++++ exim4-4.89/src/base64.c 2018-02-10 14:11:44.193870471 -0500 +@@ -152,10 +152,14 @@ static uschar dec64table[] = { + int + b64decode(uschar *code, uschar **ptr) + { ++ + int x, y; +-uschar *result = store_get(3*(Ustrlen(code)/4) + 1); ++uschar *result; + +-*ptr = result; ++{ ++ int l = Ustrlen(code); ++ *ptr = result = store_get(1 + l/4 * 3 + l%4); ++} + + /* Each cycle of the loop handles a quantum of 4 input bytes. For the last + quantum this may decode to 1, 2, or 3 output bytes. */ diff -Nru exim4-4.89/debian/patches/fix_smtp_banner.patch exim4-4.89/debian/patches/fix_smtp_banner.patch --- exim4-4.89/debian/patches/fix_smtp_banner.patch 1970-01-01 00:00:00.000000000 +0000 +++ exim4-4.89/debian/patches/fix_smtp_banner.patch 2017-08-16 13:39:04.000000000 +0000 @@ -0,0 +1,52 @@ +Description: Add EXIM_DISTRIBUTION var to display it on the SMTP banner +Origin: https://blueprints.launchpad.net/ubuntu/+spec/servercloud-s-server-app-banner-updates +Author: Yolanda Robla +Last-Update: 2015-07-06 + +--- a/src/globals.c ++++ b/src/globals.c +@@ -1295,7 +1295,7 @@ + uschar *smtp_active_hostname = NULL; + BOOL smtp_authenticated = FALSE; + uschar *smtp_banner = US"$smtp_active_hostname ESMTP " +- "Exim $version_number $tod_full" ++ "Exim $version_number " EXIM_DISTRIBUTION " $tod_full" + "\0<---------------Space to patch smtp_banner->"; + BOOL smtp_batched_input = FALSE; + BOOL smtp_check_spool_space = TRUE; +--- a/src/config.h.defaults ++++ b/src/config.h.defaults +@@ -204,4 +204,6 @@ + #define SC_EXIM_ARITH "%" SCNi64 /* scanf incl. 0x prefix */ + #define SC_EXIM_DEC "%" SCNd64 /* scanf decimal */ + ++#define EXIM_DISTRIBUTION ++ + /* End of config.h.defaults */ +--- a/scripts/Configure-config.h ++++ b/scripts/Configure-config.h +@@ -23,6 +23,12 @@ + if [ "$1" != "" ] ; then MAKE=$1 ; fi + if [ "$MAKE" = "" ] ; then MAKE=make ; fi + ++# exporting distribution to use it in smtp banner ++if test -x /usr/bin/lsb_release && lsb_release -si; then ++ export EXIM_DISTRIBUTION=\"$(lsb_release -si)\" ++else ++ export EXIM_DISTRIBUTION=\"\" ++fi + $MAKE buildconfig || exit 1 + + # BEWARE: tab characters needed in the following sed command. They have had +--- a/src/exim.h ++++ b/src/exim.h +@@ -596,5 +596,9 @@ + # undef DISABLE_DNSSEC + #endif + ++#ifndef EXIM_DISTRIBUTION ++ #define EXIM_DISTRIBUTION "" ++#endif ++ + #endif + /* End of exim.h */ diff -Nru exim4-4.89/debian/patches/series exim4-4.89/debian/patches/series --- exim4-4.89/debian/patches/series 2017-08-10 06:32:27.000000000 +0000 +++ exim4-4.89/debian/patches/series 2018-02-10 19:11:02.000000000 +0000 @@ -20,3 +20,7 @@ 75_fixes_11-On-callout-avoid-SIZE-every-time-but-noncacheable-rc.patch 75_fixes_12-Fix-build-for-earlier-version-Berkeley-DB.patch 80_Repair-manualroute-transport-name-not-last-option.patch +fix_smtp_banner.patch +CVE-2017-16943.patch +CVE-2017-16944.patch +CVE-2018-6789.patch