Fix input handling for file data sets for the macro case.
Ensure NULL-termination of macro value tests.
STATS: Fix hang bug in opendkim-reportstats.
STATS: Fix bug #SF3547363: Fix "Top 10" and DNSSEC trend reports.
2.6.6 2012/07/18
LIBAR: Fix bug #SF3544522: Not all systems define a "_len" member for
the sockaddr structures.
LIBOPENDKIM: Fix bug #SF3545490: If the body handed to the library was
missing a trailing line terminator, then dkim_canon_closebody()
would end the hashes with some data not included. Now, if
DKIM_LIBFLAGS_FIXCRLF is set, it will detect this condition
and correct it; if not, an error is returned.
LIBOPENDKIM: If the job ID passed in during handle creation includes
slashes and temporary file creation is enabled, convert the
slashes to dots in the temporary file template.
2.6.5 2012/07/14
Swap order of "header.d" and "header.i" values in
Authentication-Results fields.
BUILD: Fix bug #SF3543282: Corrections to Darwin/libar build adjustment
made in 2.6.3.
2.6.4 2012/07/12
Feature request #SF3542099: Include "header.d" in all
Authentication-Results fields, not just "header.i". This
makes life easier for users of OpenDMARC.
BUILD: Fix SHA256 test on some systems.
2.6.3 2012/07/11
Add "ResolvConf" setting, allowing the ability to pass a
resolv.conf-like file to unbound to allow specific nameservers
to be used instead of the default.
LIBOPENDKIM: Return the correct error code when a SHA1-only library
encounters a SHA1 signature that references a SHA256-only key.
LIBAR: Add ar_resolvconf().
BUILD: Fix bug #SF3538676: Build with -DDARWIN on MacOSX, and default
to arlib if unbound isn't selected.
2.6.2 2012/07/02
Fix build confusion between _FFR_RATE_LIMIT and _FFR_RESIGN.
Fix bug #SF3538639: Fix error when --domain is not provided to
opendkim-genrates. Problem noted by Andreas Schulze.
Fix bug #SF3539449: Clarify legal "Socket" values.
Fix bug #SF3539493: Handle certain cases of data set names that
appear to be comma-separated lists which include IPv6
addresses.
2.6.1 2012/06/25
Restore and activate _FFR_SELECT_CANONICALIZATION. Also adds a
SelectCanonicalizationHeader configuration option.
Remove _FFR_SELECTOR_HEADER.
Update Authentication-Results parsing to understand "dkim-atps"
(RFC6541) and no longer understand "hardfail" (RFC6577).
LIBAR: Fix bug #SF3309946: Ensure the dispatcher doesn't hold the
master lock when it might enter a read wait.
STATS: Add a database index on messages.msgtime to aid with
expiration performance.
TOOLS: Feature request #SF3536385: Add "-a" to opendkim-genkey to
include a domain name in the generated TXT record.
2.6.0 2012/06/07
Feature request #SF3502777: Log all authentication results rather than
relying on logging of Authentication-Results header fields.
Feature request #SF3512286: Add "LDAPSoftStart" flag so the filter
doesn't abort on startup when LDAP is not available.
Feature request #SF3512836: Add _FFR_SOCKETDB, which enables support
for a generic socket data set.
Feature request #SF3514982: Add Erlang data set support.
Feature request #SF3516253: Update to newest "repute" working group
documents, which mainly means adding JSON support and
promoting application-specific extensions to the top level
in the reputon structure.
Feature request #SF3518593: Add support for OpenLDAP's MDB as a
data set backend.
Feature request #SF3519002: Put reason information inside a "reason"
tag in Authentication-Results header fields rather than in
comments.
Feature request #SF3521000: Log hostname and daemon name (taken from
macros) when logging "no MTA name match".
Feature request #SF3524756: Add ability to request TCP keepalive
features via the OpenLDAP client library.
Feature request #SF3529233: Add odkim.get_envfrom() to all Lua scripts.
Fix bug #SF3518877: Separate variable expansion from literal text in
opendkim-genkey.
Fix bug #SF3522883: Allow TLS for ldapi URIs. Problem noted by
Quanah Gibson-Mount.
Fix bug #SF3527428: Construct the LDAP URI list properly, rather than
only keeping the last one, and add failover code.
Patch #SF3522895: Add contrib/ldap/opendkim.ldif.
Activate _FFR_XTAGS.
Remove _FFR_SELECT_CANONICALIZATION.
LIBAR: Fix bug #SF3444318: Do proper buffer size calculations to
avoid valgrind warnings about references to unaddressable
space.
LIBOPENDKIM: Fix bug #SF3496041: Remove _FFR_PARSETIME.
LIBOPENDKIM: Fix bug #SF3516653: By default, treat a syntax error
in an ADSP record as an NXDOMAIN. Add new library flag
DKIM_LIBFLAGS_REPORTBADADSP to restore the original
behaviour.
LIBOPENDKIM: Fix bug #SF3524865: Disallow generation of signatures
where signer and signing domain don't match per the DKIM
specification. Add DKIM_LIBFLAGS_DROPSIGNER which, if set,
will still generate signatures in that case, but with the
signer omitted so the signature is still compliant.
BUILD: Fix bug #SF3425384: Add missing support for compiling
against libevent2, which is an option for unbound.
BUILD: Fix bug #SF3475799: Don't do a manual check for libdb.a.
Use the AC_CHECK_* macros instead.
DOCS: Fix bug #SF3518864: The license for IETF documents is not
compatible with free software licensing, which makes packaging
a bit of a chore. Replace all the text files in the "docs"
directory with a single HTML page that includes links to
all the things we used to include here.
STATS: Feature request #SF3110059: Move opendkim-reportstats from
contrib/stats to stats, making it fully supported.
STATS: Feature request #SF3525786: Add opendkim-expire script.
STATS: Feature request #SF3528652: Allow a specific list of domains,
possibly read from a file, for opendkim-gengraphs and
opendkim-genrates.
mailsort is a perl script that sorts mbox format (single file) mail
folders by the dates in the `From ' lines that separate mail messages
in each folder.
to fix the build. As the "fetchmail" package doesn't provide any
shared libraries this shouldn't cause problems caused by mixing two
versions of OpenSSL.
Changelog:
Fixed in Thunderbird 16.0.2
MFSA 2012-90 Fixes for Location object issues
MFSA 2012-67 Installer will launch incorrect executable following new installation
# SECURITY FIXES
* for CVE-2012-3482:
NTLM: fetchmail mistook an error message that the server sent in response to
an NTLM request for protocol exchange, tried to decode it, and crashed while
reading from a bad memory location.
Also, with a carefully crafted NTLM challenge packet sent from the server, it
would be possible that fetchmail conveyed confidential data not meant for the
server through the NTLM response packet.
Fix: Detect base64 decoding errors, validate the NTLM challenge, and abort
NTLM authentication in case of error.
See fetchmail-SA-2012-02.txt for further details.
Reported by J. Porter Clark.
* for CVE-2011-3389:
SSL/TLS (wrapped and STARTTLS): fetchmail used to disable a countermeasure
against a certain kind of attack against cipher block chaining initialization
vectors (SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS).
Whether this creates an exploitable situation, depends on the server and the
negotiated ciphers.
As a precaution, fetchmail 6.3.22 enables the countermeasure, by clearing
SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS.
NOTE that this can cause connections to certain non-conforming servers to
fail, in which case you can set the environment variable
FETCHMAIL_DISABLE_CBC_IV_COUNTERMEASURE to any non-empty value when starting
fetchmail to re-instate the compatibility option at the expense of security.
Reported by Apple Product Security.
For technical details, refer to <http://www.openssl.org/~bodo/tls-cbc.txt>.
See fetchmail-SA-2012-01.txt for further details.
# BUG FIX
* The Server certificate: message in verbose mode now appears on stdout like the
remainder of the output. Reported by Henry Jensen, to fix Debian Bug #639807.
* The GSSAPI-related autoconf code now matches gssapi.c better, and uses
a different check to look for GSS_C_NT_HOSTBASED_SERVICE.
This fixes the GSSAPI-enabled build on NetBSD 6 Beta.
# CHANGES
* On systems where SSLv2_client_method isn't defined in OpenSSL (such as
newer Debian, and Ubuntu starting with 11.10 oneiric ocelot), don't
reference it (to fix the build) and if configured, print a run-time error
that the OS does not support SSLv2. Fixes Debian Bug #622054,
but note that that bug report has a more thorough patch that does away with
SSLv2 altogether.
* The security and errata notices fetchmail-{EN,SA}-20??-??.txt are now
under the more relaxed CC BY-ND 3.0 license (the noncommercial clause
was dropped). The Creative Commons address was updated.
* The Python-related Makefile.am parts were simplified to avoid an automake
1.11.X bug around noinst_PYTHON, Automake Bug #10995.
* Configuring fetchmail without SSL now triggers a configure warning,
and asks the user to consider running configure --with-ssl.
# WORKAROUNDS
* Some servers, notably Zimbra, return A1234 987 FETCH () in response to
a header request, in the face of message corruption. fetchmail now treats
these as temporary errors. Report and Patch by Mikulas Patocka, Red Hat.
* Some servers, notably Microsoft Exchange, return "A0009 OK FETCH completed."
without any header in response to a header request for meeting reminder
messages (with a "meeting.ics" attachment). fetchmail now treats these as
transient errors. Report by John Connett, Patch by Sunil Shetye.
# TRANSLATION UPDATES
* [cs] Czech, by Petr Pisar
* [de] German
* [fr] French, by Frédéric Marchal
* [ja] Japanese, by Takeshi Hamasaki
* [pl] Polish, by Jakub Bogusz
* [sv] Swedish, by Göran Uddeborg --- NEW TRANSLATION - Thank you!
* [vi] Vietnamese, by Trần Ngọc Quân
Exim version 4.80.1
-------------------
PP/01 SECURITY: protect DKIM DNS decoding from remote exploit.
CVE-2012-5671
This, or similar/improved, will also be change PP/11 of 4.81.
See: https://secunia.com/advisories/51098/
1.00 Sat Apr 16 13:10:16 UTC 2011
- Avoid infinite loop: signal handler modifies errno
- Added support for SMFIC_UNKNOWN
0.99 Sun Feb 6 21:32:30 UTC 2011
- RT#65499: Handle IPv6 addresses in SMFIC_CONNECT in
Sendmail::PMilter::Context
0.98 Fri Mar 12 21:36:18 GMT 2010
- RT#51759: added child_init and child_exit parameters to prefork
dispatcher -Michael Schout
- RT#51713: fixed POD errors for embedded '>' -Michael Schout
- Note in the POD that the module is orphaned and is looking for a
proper maintainer.
0.97 Mon Feb 23 23:39:15 2009 UTC
- RT#43327: Changed protocol testing condition from ($ver == 2) to ($ver >= 2 && $ver <= 6)
to make the milter work with Sendmail 8.14
- Removed CVS Id from Changes file
0.96 Sat Jul 07 18:27:25 2007 UTC
- Changed threads::shared::share(\$nchildren) to
threads::shared::share($nchildren), this should fix some failing smokes
- fix From_ quoting in mbox delivery; use of the Python stdlib
function meant getmail was incorrectly using mboxo-style quoting
instead of mboxrd quoting, probably since early in the v4 series.
Thanks: Christoph Mitterer.
libXext/buildlink3.mk, now that it is included there.
Leave the places where its API version is set or variables from it
are used directly (about 3 packages).
version 1.35:
- added video/webm and audio/webm, although not (yet) IANA registered.
[Kurian Jose Aerthail]
version 1.34: Thu Jan 12 11:16:07 CET 2012
- subType() did not handle subType's with '+' in them.
[Roman V. Nikolaev]
version 1.33: Thu Jan 12 08:46:05 CET 2012
- all openxmlformats are binary [Beverly Wang]
- mediaType() and subType() did not handle subType's with dots
in them correctly. [Roman V. Nikolaev]
version 1.32: Thu Aug 18 23:30:25 CEST 2011
- explain how to use MIME::Types in mod_perl, after complains
from [Steve Simms], [Nicolas Mendoza], [Yves Orton] and
[Hans Dieter Pearcey]
- when you do not read the documentation about mod_perl/fork,
then it will work as ever but still inefficient.
Changelog:
Fixed in Thunderbird ESR 10.0.9
MFSA 2012-89 defaultValue security checks not applied
Fixed in Thunderbird ESR 10.0.8
MFSA 2012-87 Use-after-free in the IME State Manager
MFSA 2012-86 Heap memory corruption issues found using Address Sanitizer
MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer
MFSA 2012-84 Spoofing and script injection through location.hash
MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties
MFSA 2012-82 top object and location property accessible by plugins
MFSA 2012-81 GetProperty function can bypass security checks
MFSA 2012-79 DOS and crash with full screen and history navigation
MFSA 2012-77 Some DOMWindowUtils methods bypass security checks
MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/ rv:10.0.8)
MFSA 2012-59 Location object can be shadowed using Object.defineProperty
Changelog:
FIXED
16.0.1: Vulnerability outlined here
https://blog.mozilla.org/security/2012/10/10/security-vulnerability-in-firefox-16/
NEW
We have now added box.com to the list of online storage services that are available for use with Thunderbird Filelink
NEW
Silent, background updates. Thunderbird will now download and apply updates in the background allowing you to start quickly the next time Thunderbird starts up.
FIXED
Various fixes and performance improvements
FIXED
Various security fixes
Fixed in Thunderbird 16.0.1
MFSA 2012-89 defaultValue security checks not applied
MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)
Fixed in Thunderbird 16
MFSA 2012-87 Use-after-free in the IME State Manager
MFSA 2012-86 Heap memory corruption issues found using Address Sanitizer
MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer
MFSA 2012-84 Spoofing and script injection through location.hash
MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties
MFSA 2012-82 top object and location property accessible by plugins
MFSA 2012-81 GetProperty function can bypass security checks
MFSA 2012-80 Crash with invalid cast when using instanceof operator
MFSA 2012-79 DOS and crash with full screen and history navigation
MFSA 2012-77 Some DOMWindowUtils methods bypass security checks
MFSA 2012-76 Continued access to initial origin after setting document.domain
MFSA 2012-75 select element persistance allows for attacks
MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/ rv:10.0.8)
Changelog v0.3.2:
+ sieve-refilter tool: improved man page documentation by explicitly specifying
the syntax used for mailbox arguments.
+ Sieve: spamtest and virustest extensions: improved trace debugging of score
calculation.
+ Sieve: made error messages about exceeding the maximum number of actions more
verbose.
- Sieve tools: fixed problems with running as root: sievec and sieve-dump now
ignore mail_uid and mail_gid settings when run as root.
- Sieve: fixed bug in action accounting (for limit checking): increase action
instance count only when an action is actually created.
- Sieve: include extension: fixed namespace separation of :global and :personal
scripts.
- ManageSieve: fixed segfault bug triggered by CHECKSCRIPT command.
- Fixed linking with ld.gold.
- Fixed several Clang compile warnings and a few potential bugs.
Changelog v0.3.3:
- Fixed compile against installed Dovecot headers. This was broken by the
ld.gold fix in the previous release.
+ imap: Implemented THREAD=ORDEREDSUBJECT extension.
+ Added "doveadm exec" command to easily execute commands from libexec_dir,
e.g. "doveadm exec imap -u user@domain"
+ Added "doveadm copy" command.
+ doveadm copy/move: Added optional user parameter to specify the source
username. This allows easily copying mails between different users.
+ Added namespace { disabled } setting to quickly enable/disable namespaces.
This is especially useful when its value is returned by userdb.
+ Added mailbox_alias plugin. It allows creating mailbox aliases using
symlinks.
+ imapc storage: Added imapc_max_idle_time setting to force activity on
connection.
+ fts-solr: Expunging multiple messages is now faster.
- director: In some conditions director may have disconnected from another
director (without logging about it), thinking it was sending invalid data.
- imap: Various fixes to listing mailboxes.
- pop3-migration plugin: Avoid disconnection from POP3 server due to idling.
- login processes crashed if there were a lot of local {} or remote {} settings
blocks.
Changelog:
FIXED Security fixes can be found here
Fixed in Thunderbird ESR 10.0.7
MFSA 2012-72 Web console eval capable of executing chrome-privileged code
MFSA 2012-70 Location object security checks bypassed by chrome code
MFSA 2012-67 Installer will launch incorrect executable following new installation
MFSA 2012-65 Out-of-bounds read in format-number in XSLT
MFSA 2012-63 SVG buffer overflow and use-after-free issues
MFSA 2012-62 WebGL use-after-free and memory corruption
MFSA 2012-61 Memory corruption with bitmap format images with negative height
MFSA 2012-58 Use-after-free issues found using Address Sanitizer
MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7)
