~ubuntu-branches/ubuntu/hardy/exim4/hardy-security : changes

~ubuntu-branches/ubuntu/hardy/exim4/hardy-security » Changes from revision 24

From Revision 24 to 5

Rev	Summary	Authors	Tags	Date
24	* SECURITY UPDATE: local privilege escalation via alternate ... * SECURITY UPDATE: local privilege escalation via alternate config file (LP: #697934) - debian/patches/80_CVE-2010-4345.dpatch: backport massive behaviour- altering changes from upstream git to fix issue. - debian/patches/81_CVE-2010-4345-docs.dpatch: backport documentation changes. - debian/patches/67_unnecessaryCopt.dpatch: Do not use exim's -C option in utility scripts. This would not work with ALT_CONFIG_PREFIX. Patch obtained from Debian's 4.69-9+lenny2. - Build with WHITELIST_D_MACROS=OUTGOING. After this security update, exim will not regain root privileges (usually necessary for local delivery) if the -D option was used. Macro identifiers listed in WHITELIST_D_MACROS are exempted from this restriction. mailscanner (4.79.11-2.2) uses -DOUTGOING. - Build with TRUSTED_CONFIG_LIST=/etc/exim4/trusted_configs. After this security update, exim will not re-gain root privileges (usually necessary for local delivery) if the -C option was used. This makes it impossible to start a fully functional damon with an alternate configuration file. /etc/exim4/trusted_configs (can) contain a list of filenames (one per line, full path given) to which this restriction does not apply. - debian/exim4-daemon-.NEWS: Add description of changes. Thanks to Debian and Andreas Metzler for the text. - CVE-2010-4345 SECURITY UPDATE: arbitrary file append via symlink attack (LP: #708023) - debian/patches/82_CVE-2011-0017.dpatch: check setuid and setgid return codes in src/exim.c, src/log.c. - CVE-2011-0017 * SECURITY UPDATE: denial of service and possible arbitrary code execution via hard link to another user's file (LP: #609620) - debian/patches/CVE-2010-2023.dpatch: check for links in src/transports/appendfile.c. - CVE-2010-2023 * SECURITY UPDATE: denial of service and possible arbitrary code execution via symlink on a lock file (LP: #609620) - debian/patches/CVE-2010-2024.dpatch: improve lock file handling in src/exim_lock.c, src/transports/appendfile.c. - CVE-2010-2024 * debian/rules: disable debconf-updatepo so the security update doesn't alter translations.	Marc Deslauriers	4.69-2ubuntu0.3	13 years ago
23	* SECURITY UPDATE: remote code execution via buffer overflow * SECURITY UPDATE: remote code execution via buffer overflow - debian/patches/72_CVE-2010-4344.dpatch: validate lengths in src/string.c. - CVE-2010-4344	Marc Deslauriers	4.69-2ubuntu0.2	13 years ago
22	[ Marc Haber ] [ Marc Haber ] * update-exim4.conf: fix bashism echo -n in preprocess_macro. Thanks to Michal Politowski. Closes: #462173 [ Christian Perrier ] * Debconf translations updates: - German. Thanks to Eric Schanze. Closes: #462673 [Andreas Metzler] * Add missing .P to exim_db.8 to fix indenting. (Thanks, David L. Anselmi) Closes: #462712 * Add (disabled) patch to save random seed to a file	Marc Haber	4.69-2	16 years ago
21	No-change rebuild against libldap-2.4-2. No-change rebuild against libldap-2.4-2.	Steve Langasek	4.68-2build1	16 years ago
20	[ Marc Haber ] [ Marc Haber ] * Fix changelog: lowuid router does not close #420217. Closes: #440217 [ Andreas Metzler ] * Mention /etc/exim4/exim4.conf in FILES section of update-exim4.conf.8. * Fix syntax error in real-local router. Closes: #446346 * Configuring exim as configtype="internet host" asks a different set of questions than e.g. satellite. However some of the settings controlled by these hidden questions still have effects on exim's behavior. Change exim4-config to ask these hidden questions if they have been set to a non-default value. (Either manually, or by switching configtype after setting the values.) Closes: #443210 These questions have been added conditionally: - internet site with smarthost: + dc_relay_domains - satellite + dc_relay_domains + dc_localdelivery	Marc Haber	4.68-2	16 years ago
19	* new upstream version. Closes: #444195 * new upstream version. Closes: #444195 * Documents tls_verify_hosts during TLS sessions. Closes: #422419 * new example.conf md5 sum * Move lowuid router to a later place, handle real- only for locally generated messages. Thanks to Andreas Metzler and others on pkg-exim4-devel. Closes: #420217 * /etc/init.d/exim4: * Use start_daemon and killproc from lsb-base as a new plunge at #396944 * Do not clean the environment as severly as before (functions need to survive). * README.Debian: * Document that using client certificates needs extra configuration. Thanks to John Goerzen. Closes: #440663 * conf.d/main/03_exim4-config_tlsoptions: Make it clear that this file only concerns exim as an SMTP server. * exim4-config.preinst: Add EX4DEBUG facility, add rm_conffile function * Rename acl_whitelist_local_deny to acl_local_deny_exceptions as suggested by Ross Boylan. Closes: #387078. * Switch Build-Depends to db4.6. Closes: #442645 * Debconf translations updates: - Portuguese. Thanks to Miguel Figueiredo. Closes: #441895, #445494 - Norwegian Nynorsk. Thanks to Håvard Korsvoll. * exim4-config.NEWS: Explicitly mention that .dpkg-old and .dpkg-dist files are included in the DEBCONFsomethingDEBCONF check to allow lazy people to only grep the docs instead of actually reading them. This was requested by Hamish Moffatt in #445327.	Marc Haber	4.68-1	16 years ago
18	Trigger rebuild for hppa Trigger rebuild for hppa	LaMont Jones	4.67-5build1	16 years ago
17	* the "verderben viele Koeche den Brei?" release * the "verderben viele Koeche den Brei?" release [ Andreas Metzler ] * Point to exim4_passwd(5) instead of non-existing exim_passwd(5) in AUTH section of configuration. (Thanks Arkadiusz Dykiel, #430149) * update-exim4.conf check_ascii_pipe(): Accept < since we use it for list construction. Closes: #430391 * Anchor UPEX4CmacrosUPEX4C in update-exim4.conf [ Robert Millan ] * Update informational message in SPF ACL to use the latest http://www.openspf.org/Why API. [ Debconf translations ] * French completed and converted to UTF-8 * All remaining non UTF-8 translation switched to UTF-8 [ Marc Haber ] * do not quote error message in lowuid router * replace commented UPEX4CmacrosUPEX4C with UPEX4CmacrosUPEX4C exim configuration macro definition as placeholder for ue4c-generated macros. [ Christian Perrier ] * Correct the invalid ${fqdn} variable in exim4-config.templates	Marc Haber	4.67-5	16 years ago
16	[ Andreas Metzler ] [ Andreas Metzler ] * Initialize permissions of bug-script and exim-adduser as 755, since diff does not preserve permissions. Both were shipped as 644 in binary packages not built with svn-buildpackage. Closes: #420446 [ Marc Haber ] * Merge experimental changes from revision 2018:2073 * Fix "Zahlendreher" in closure of #427690. Closes: #427690 * update-exim4.conf: * finally get rid of the DEBCONFfooDEBCONF stuff. That information is now passed to the configuration by ue4c by directly setting exim macros in the configuration. This has caused both the configuration and ue4c to be much shorter. * run with -e, -C and -u. * convert input read from update-exim4.conf.conf to lower case * barf if strange characters are found in ue4cc. Closes: #400294 * Remove superfluous "x$foo" = "xbar" constructs from scripts * Add routers to reject mail to accounts with low UID. Closes: #400790. * Make daily cron job barf if /usr/bin/mail is not found. Have exim4-base recommend mailx. Closes: #427690 * Have all -daemon packages provide exim4-localscanapi-1.0 and exim4-localscanapi-1.1 as requested by Magnus Holmgren while fixing #426425. Also include exim4-localscan-plugin-config script with exim4-dev. Thanks to Magnus for helping with this. Closes: #428274 * remove /etc/exim4/email-addresses symlink and document this. Thanks to Josip Rodin. Closes: #420578 * introduce conf.d/250_exim4-config_lowuid which optionally allows to reject (or alias away) mail to low-uid accounts that are not listed in an exception list. Thanks to Dominic Hargreaves, Marc Sherman and Ross Boylan. Closes: #400790, #307768, #331716 * remove versioned depends on cron, since the version we need is well before sarge. * Add cron \| fcron dependency. Fcron is going to be removed again at the first sign of trouble. Closes: #381806 * remove move_exim3_spool debconf template. Closes: #391762 * replace openssl gendh with openssl dhparam. Closes: #413235 * adapt docs, README and manpages * have Hilko fix the lynx-dump postprocessing to repair generating README.Debian text version. Thanks! * increase README.Debian generation robustness. Thanks to Hilko. * debconf: * Partly apply Christian Perrier's patch for reviewed templates and control file. Closes: #426980 * Other minor template changes. * get rid of "mails" in debconf templates, use "messages" instead. Re-word local_interface debconf template. Other minor changes. Thanks to Jens Seidel and Christian Perrrier. Closes: #394976 * re-work exim4-config.config logic to have split/non-split config asked last instead of first. This partly addresses #410756. * Add exim4-daemon-heavy.templates, exim4-daemon-light.templates and exim4.templates to POTFILES.in * Re-Word dc_other_hostnames debconf template. Thanks to Hans G. Ehrbar. Closes: #421860 [ Christian Perrier ] * Debconf translation updates: - French - Ukrainian. Closes: #427793 - Bulgarian. - Thai. - Galician. - Swedish. - Punjabi. - Indonesian. - Italian. - Khmer. - Traditional Chinese. Closes: #428072, #428069. - Portuguese. - Simplified Chinese. Closes: #428072, #428069. - Marathi - Romanian. Closes: #429242 - Russian. Closes: #429352	Marc Haber	4.67-3	16 years ago
15	[ Marc Haber ] [ Marc Haber ] * new upstream version * remove 37_upstream-patch-384015-add_headers * remove 80_disable_rsa_export * remove 80_upstream_408174_4-64-PH18 * EDITME patch changes to allow for 4.67 * enable dovecot authentication * Upstream patch from Magnus Holmgren included upstream. Thanks to Simon Walter. Closes: #407957 * Upstream patch PH/18 included upstream. Thanks to Marc Schiffbauer. Closes: #408174 * merge experimental changes * exim man page patch changes for 4.67 * robustness patches for * create-custom-package * exim-gencert * exim4-base.config * exim4-base.postinst * exim4-config.config * exim4-config.postinst * exim4-daemon-light.postinst * update-exim4defaults * replace backticks with $() notation * Add patch to 50_localscan_dlopen to reduce dynamic symbol table. Thanks to Magnus Holmgren. Closes: #413602 * remove woody compatibility hacks from * exim4-daemon-light.postinst * exim4-config.postinst * Fix eximnext => exinext in man page. * README.Debian: * add warning to "IP addresses for incoming connections" section. * add new chapter about how to influence exim's behavior. * add missing closing bracket. Thanks to Martin Schwarz. Closes: #419700 * update-exim4.conf(8): * clarify update-exim4.conf about how ue4cc and exim configuration interface * remote_smtp_smarthost transport: make hosts_try_auth host list semicolon-separated to correctly handle IPv6 * multiple minor changes to lintian overrides * debian/control: have exim4 depend on debconf (>= 1.4.69) \| cdebconf (>= 0.39) explicitly to allow usage of debconf error template type. [ Christian Perrier ] * Esperanto debconf translation update (Serge Leblanc). Closes: #415590 * Marathi debconf translation added (Priti Pathil). Closes: #416801	Marc Haber	4.67-1	17 years ago
14	No-change upload for the libpq4->libpq5 transition. No-change upload for the libpq4->libpq5 transition.	Martin Pitt	4.63-11build1	17 years ago
13	* Remove patch to spec.txt for pkg-exim4-users, it is includ... * Remove patch to spec.txt for pkg-exim4-users, it is included upstream. No idea why this patch even applied correctly. * README.Debian: * Fix wrong pidfile name * Move FAQ to the Wiki * Adapt "Using completely different configuration scheme" to also mention /etc/exim4/exim4.conf. * Move titles in the same line as the section statement, making it easier to work with a code folding editor. * exim4_files(5): fix recommended permissions for passwd[.client]. Thanks to Georg Neis. Closes: #398365 * Remove temporary gnutls parameters file if neither certtool nor openssl are installed. Closes: #399023 * Fix path to gnutls-params file in exim4-base.postinst. Thanks to J.L. Fernandez. Closes: #400794 * Translation updates (see Last-Translator for rewards). - Punjabi (not yet complete) - Hebrew (not yet complete) - Portuguese. Closes: #399242 * merge changes from experimental: * enable sqlite for exim4-daemon-heavy. Thanks to Adrian Phillips. Closes: #398718 * Add Build-Dependency on libsqlite3-dev. Thanks to Frank Lichtenheld. Closes: #398880 * Build-Depends * add po-debconf * add bzip2 * debian/rules: * run debconf-updatepo in clean targets * adapt build system to allow direct building from an upstream tarball * needs tardy at build time on sarge, but not on newer distributions * use dpatch-run for patches instead of locally programmed handling * add lintian overrides: * partially-translated-question exim4/dc_eximconfig_configtype for cy, eo, et, he, mk, nn, pa, pl, sl, tl, uk - translators, move! * possible-debconf-note-abuse config:15 /drec remove gratuitous exim4-daemon-heavy.postinst (it is symlinked at build time)	Marc Haber	4.63-11	17 years ago
12	* The "praise Osamu Aoki" release. * The "praise Osamu Aoki" release. * Translation updates (see Last-Translator for rewards). - Dutch. Closes: #396725 * README.Debian: * Add information about how to obtain reportbug information for mailing list questions. * Point people directly to passwd.client man page instead of the file itself. Thanks to Osamu Aoki. * Re-work the /etc/aliases section. * Improve smarthost description in update-exim4.conf(8) man page. Give examples. Thanks to Osamu Aoki. * include documentation for /etc/aliases in exim4-config_files(5) man page. Symlink to etc-aliases(5). Thanks to Osamu Aoki. Closes: #397042 * Change symlink of exim4-config_files(5) to email-addresses(5) to point to etc-email-addresses(5) for consistency. * Use nwildlsearch to index into passwd.client to allow wildcards here. Thanks to Osamu Aoki. This is another pain relief for #244724. * use printf instead of echo in daily cron job. Thanks to Ming Hua. Closes: #395448 * Add de-uglyfication request to man pages.	Marc Haber	4.63-10	17 years ago
11	* Fix a spelling error in templates: s/adviseable/advisable * Fix a spelling error in templates: s/adviseable/advisable Thanks to Jens Seidel for spotting it * Translation updates (see Last-Translator for rewards). - Bosnian. Closes: #396592 - Bulgarian. Closes: #396558 - Greek. - Lithuanian. Closes: #396478 - Norwegian Bokmål. Closes: #391768 - Wolof. Closes: #395944 * Have ue4c barf on more lookup types found in more ue4cc fields, courtesy to regexp from hell.	Marc Haber	4.63-9	17 years ago
10	* Move explanation about using ";" as separator in lists fro... * Move explanation about using ";" as separator in lists from debian/NEWS to debian/exim4-config.NEWS. (The former ends up as /usr/share/doc/eximon4/NEWS.Debian.gz.) Also fix version-number of entry. (am) * have ue4.conf --verbose print split or non-split config. Thanks to Florian Laws. (mh) * Mention http://pkg-exim4.alioth.debian.org/ in package description. Thanks to Florian Laws. (mh) * Mention in package description that README.Debian has information about how to configure the Debian packages. * /etc/init.d/exim4: parse extended inetd.conf syntax from openbsd-inetd. (mh) Closes: #365928 * New th (thai) translation. Thanks to Theppitak Karoonboonyanan. (mh) Closes: #367351 * New dz (Dzongkha) translation. Thanks to Pema Geyleg. (am) Closes: #368593 * New ne (Nepali) translation. Thanks to Paras pradhan. (am) Closes: #369526 * New eo (Esperanto) translation. Thanks to Serge Leblanc. (am) Closes: #369241 * Updated hu (hungarian) translation. Thanks to Attila Szervac. (am) Closes: #374616 * Make documentation of CHECK_RCPT_LOCAL_LOCALPARTS and CHECK_RCPT_REMOTE_LOCALPARTS more verbose and concentrate it in the ACL file. Thanks to Klaus Muth. (mh) Closes: #366491 * README.Debian.xml (mh) * Add new section documenting where to find documentation. * Move misplaced sentence. * Fix spelling errors in README.Debian. Thanks to Salvatore Bonaccorso. Closes: #366003 Thanks to Ross Boylan. Closes: #374216 * remove "you can stop reading now" sentence. Thanks to David Lawyer. Closes: #370790 * Mention Debian-specific man pages * Give instructions about how to use apropos to find out about man pages. * Documentation changes inspired by Ross Boylan. Closes: #369126 * Add exim4-config_files(5) man page to aid as repository for file explanations. * /etc/email-addresses * /etc/exim4/local_host_blacklist * /etc/exim4/local_host_whitelist * /etc/exim4/local_sender_blacklist * /etc/exim4/local_sender_whitelist * /etc/exim4/local_sender_callout * /etc/exim4/local_rcpt_callout * /etc/exim4/local_domain_dnsbl_whitelist * /etc/exim4/hubbed_hosts * /etc/exim4/passwd * /etc/exim4/passwd.client * /etc/exim4/exim.crt * /etc/exim4/exim.key If you find any files that might be missing in the man page, please report a bug. * mention exim4-config_files(5) in update-exim4.conf.8 * Explicitly mention README.Debian in exim man page. * Remove /usr/share/doc/exim4-config/default_acl, move contents to README.Debian and exim4-config_files. * remove empty /usr/share/doc/exim4-config/examples. * clarify docs in RCPT ACL. * streamline docs: * hubbed_hosts router. * passwd.client. * server side authentication examples * Standard-Version: 3.7.2, no changes necessary.	Marc Haber	4.62-2	17 years ago
9	Replace 37_dns_disable_additional_section with the upstream Replace 37_dns_disable_additional_section with the upstream sanctioned patch for this behaviour and turn it on. Closes: launchpad #26820	Daniel Silverstone	4.60-3ubuntu3	18 years ago
8	Rebuild against the new libmysqlclient15off with correct sym... Rebuild against the new libmysqlclient15off with correct symbols.	Adam Conrad	4.60-3ubuntu2	18 years ago
7	debian/control: Build against libdb4.3. debian/control: Build against libdb4.3.	Martin Pitt	4.60-3ubuntu1	18 years ago
6	* Have exim4-base replace exim4-daemon-light and -heavy. Thi... * Have exim4-base replace exim4-daemon-light and -heavy. This is a needed corollary to the movement of the man pages to -base. Let's hope that this change doesn't introduce too much breakage. Thanks to Hamish Moffatt for making me take a closer look at policy. (mh) Closes: #347908, #348067 * Introduce Makefile variable to build with OpenSSL instead of GnuTLS. This is a last minute maneuver to help sites suffering from the GnuTLS entropy issue (#338319, #343085) whose only other chance is disabling TLS completely. Please note that building exim4-daemon-heavy with OpenSSL is a GPL violation since OpenSSL's license clashes with the MySQL client library, which is GPL licensed without OpenSSL exception. (mh) * re-pack configuration diffs. (mh) Closes: #331698 * Fix wrong variable substitution in lt (Lithuanian) debconf translation. Thanks to Davide Viti and Gintautas Miliauskas. (mh) Closes: #342242 * Fix typo in exim.8 man page. Thanks to A Costa. (mh) Closes: #338579 * Honor dpkg-statoverride entries for run-time data in /var. Thanks to Peter Mottram. (mh) Closes: #269448	Marc Haber	4.60-3	18 years ago
5	* Add, but not enable, 37_dns_disable_additional_section.dpa... * Add, but not enable, 37_dns_disable_additional_section.dpatch, which might be a possible fix for #342619 * conf.d/auth/30_exim4-config_examples: add hint to adapt public_name string in support_broken_outlook_express_4_server authenticator if other authencators than LOGIN and PLAIN are offered. * Fix missing special characters in some debconf translations. Thanks to Davide Viti. (mh) Closes: #341442 * Fix broken README reference in system_aliases router docs. (mh) * remove references to alias files from the address_pipe transport. (mh) * remove "Some-State" default from exim-gencert. (mh) * Clarify split vs unsplit config in README.Debian. Thanks to Faheem Mitha and Ross Boylan for helping. (mh) * Update Build-Depends to libmysqlclient15-dev. (mh) Closes: #343767 * Fix wrong header in conf.d/routers/300_exim4-config_real_local. Thanks to Ross Boylan for spotting this. (mh) * Document headers_rewrite, return_path and dc_mailname_in_oh in update-exim4.conf man page. (mh) Closes: #332520, #342233 * Re-Instate debian/patches/31_eximmanpage which was erroneously removed in 4.60-1, we have local Debian patches in here. Thanks to Ross Boylan for spotting this. (mh) Closes: #330967 * Mention relay permission from localhost in update-exim4.conf(8). (mh) * Add more prose to relay control configuration. (mh) * Update Greek debconf translation (Thanks, Kostas Papadimas) (am) Closes: #344576 * Add cross-reference to README.Debian to better find macro docs. Thanks to Shyamal Prasad. (mh) Closes: #329988 * Fix incorrect variable substitution in pt_BR debconf translation. (Thanks, Felipe Augusto van de Wiel) (am) Closes: #345363 * [exim4-config.templates, po/po] Replace reference to README.SMTP-AUTH with one to its replacement README.Debian.html. (am) Closes: #344826 Re-work long package descriptions. Move reference to README.Debian in front, add hint to dpkg-reconfigure exim4-config, complete stub sentences, remove non-referenced acronym MTA from the long descriptions, move explanation what exim is to the very front. * README.Debian: Add section about changing the configuration, explain structure of conf.d and .conf.template, add hint that the SMTP AUTH examples are documented. * Introduce MAIN_TLS_CERTKEY to allow for single-file certificate/key storage. Thanks to John Goerzen. (mh) Closes: #315126 * Mention entropy issue in README.Debian. * Ship symlink to /usr/sbin/exim, see NEWS.Debian. (mh) Closes: 319316 * use dh_installinit -n instead of --noscripts to work around #347577. (mh) * use dh_installinit --name instead of --init-script, rename init script. (mh) * move man pages from daemon packages to exim4-base, add lintian and linda overrides to allow daemon packages not to contain man pages.	Marc Haber	4.60-2	18 years ago

Older »