Fixes:
2012-10-24
* Update configure.ac to avoid autoconf 2.68 warnings, by
(a) quoting the first AC_RUN_IFELSE argument, an
AC_LANG_PROGRAM(), with [ ], and
(b) providing an explicit "true" assumption for Berkeley DB
capabilities to avoid cross-compilation warnings.
2012-10-22
* Security bugfix for CVE-2012-5468 (bogofilter-SA-2012-01):
Fix a heap corruption in base64 decoder on invalid input.
Analysis and patch by Julius Plenz <plenz@cis.fu-berlin.de>.
2011-01-02
* Added bogofilter-faq-bg.html, a Bulgarian translation of the FAQ.
(thanks to Albert Ward)
2010-10-29
* Mark "Berkeley DB 5.1.19: (August 27, 2010)" supported.
Changes of Sylpheed
* 3.3.0
* 3.3.0rc (release candidate)
* The Japanese manual was updated.
* The bug that hyperlinks did not respond when 'Show attached files
first on message view' option was set was fixed.
* Some compilation fixes were made.
* Win32: .eml file association was added to installer.
* Win32: mailto and .eml association are automatically set to default
on Windows 7 on installation.
* Win32: included libtiff library was updated to 3.9.7 (security fix).
* 3.3.0beta2 (development)
* The ability of opening external rfc822 format message files (.eml) was
added.
* Sylpheed now accepts mailto: and file: URL without command-line option.
(sylpheed file:///path/to/file.eml)
* The option to specify the position of the attach tool button was added.
* The header labels on the header view now have tooltips.
* A minor memory leak related to tooltips was fixed.
* The long-standing drag-without-button-press bug on IMAP folders (since
3.0) was fixed (#93).
* The sylpheed.desktop file was modified so that desktop shells can
recognize Sylpheed as rfc822 and mailto handler.
* The sylpheed.spec file was fixed so that it builds on x86_64 platform,
and also builds sylpheed-plugins package.
* 3.3.0beta1 (development)
* Attached files are now placed first on the message view.
* Attached files can be opened from the attachment tool menu.
* The attachment tool menu was moved to the left of the header view.
* The option 'Toggle attachment list view with tab' and 'Show attached
files first on message view' were added at 'Common preferences -
Display - Attachment'.
* 'Export only selected messages' option was added to the message export
dialog.
* The import/export of messages became cancellable.
* config.rpath and install-sh script in the tarball were updated.
* IMAP FETCH command response parser was fixed.
Changes to the Cyrus IMAP Server since 2.4.16
* A bunch of cleanups and fixes to compiling
* A bunch of sieve cleanups
* Fixed bug #3691: unixhierarchysep is now obeyed when printing the
mailbox name in unexpunge
* Fixed bug #3718: crashes fetching message parts
* Fixed bug #3719: pop3 seen update of final message in a mailbox
* Improved documentation of "proxyservers" option
* Fixed bug #3737: lost emails in XFER delivery race
* Fixed bug #3725: inefficient statuscache use in some cases
* Fixed bug #3484: use of sasl property types (compile fix)
* Fixed bug #3754: failure to support binary append. This was found
by a popular library switching to using binary appends
* Fixed bug #3735: user prefix searching now works with fulldirhash
* Fixed bug #3696: can no longer rename the same mailbox twice, which
left things in a corrupted state if you caught the race.
* Fixed bug #3715: using berkeley for mailboxes.db was very broken.
It now works.
* Fixed bug #3733: reconstruct with missing cyrus.index will use file
timestamps for internaldate rather than setting it to NOW if
internaldate_heuristic is set to standard
* Fixed bug #3729: better documentation for xlist-* in 2.4.
* Fixed bug #2717: fetches of individual messages or short ranges no
longer need to parse over the entire index.
* Fixed bug #3742: reconstruct can now fix multiple folders with the
same uniqueid again (regression from 2.3) and also sync_client
avoids a crash in that broken case.
* Fixed bug #3711: detect the buggy /usr/bin/compile_et shipped on
MacOS X and fall back to our bundled copy.
Postfix 2.8 and later:
* The postscreen_access_list feature failed to ignore case in the
first character of a command (e.g., permit, reject, etc.).
Reported by Francis Picabia. (This fix is incorrectly listed
in the HISTORY files of earlier releases, and will be removed
with a future patch.)
All supported releases:
* Strip the datalink suffix (e.g., %eth0) from IPv6 addresses
returned by the system getaddrinfo() routine. Such suffixes
break the default mynetworks value, the Postfix SMTP server's
reverse/forward DNS name/address mapping check, and possibly
more.
* To eliminate the possibility of collisions with connection cache
lookup keys, the Postfix LDAP client now computes those lookup
keys by joining the number-valued connection properties with
ASCII null, just like it already did with the string-valued
connection properties.
* There was a memory leak during one-time TLS library initialization
(introduced with Postfix 2.5). Reported by Coverity.
* There was a memory leak in the unused oqmgr(8) program (introduced
with Postfix 2.3). Reported by Coverity.
26/12/2008 0.2.9
- src/lua/hotmail.lua, src/lua/juno.lua: Fixed login issues (russell822)
- src/lua/supereva.lua: added patch by la scimmia to fix To: problem (gareuselesinge)
- updater-ui/dialog/freepops-updater-dialog, updater-ui/zenity/freepops-updater-zenity: use mktem if tempfile not available (gareuselesinge), thanks Vito De Tullio
- buildfactory/Makefile, buildfactory/debian-ubuntu/control, buildfactory/debian-ubuntu/freepops.postinst, buildfactory/debian-ubuntu/rules: patch by blackmoon for ubuntu (gareuselesinge)
- buildfactory/Makefile, buildfactory/osx/Info.plist, buildfactory/osx/Info.plist.in: osx version will be reported correctly from now on (gareuselesinge)
- buildfactory/debian-ubuntu-dapper/control, buildfactory/debian-ubuntu-dapper/rules: added dapper stuff (gareuselesinge)
- buildfactory/debian-ubuntu/freepops-updater-gnome.desktop: minor fix (gareuselesinge)
- buildfactory/debian/changelog, buildfactory/debian/control, buildfactory/debian/freepops.cron.hourly, buildfactory/debian/rules, scripts/create_jail.sh: approaching 2.9.0 (gareuselesinge)
- buildfactory/debian/changelog, buildfactory/debian/freepops.postinst, buildfactory/debian/rules: some debian fixes (gareuselesinge)
- buildfactory/osx/Install_resources/English.lproj/ReadMe.txt, buildfactory/osx/Install_resources/Italian.lproj/ReadMe.txt, buildfactory/osx/iceberg/FreePOPs/FreePOPs.packproj, scripts/compile-gettext-universal.sh, src/Makefile: added gettext library, fixed installer (gareuselesinge)
- buildfactory/osx/Install_resources/English.lproj/ReadMe.txt, buildfactory/osx/Install_resources/Italian.lproj/ReadMe.txt, configure.sh, scripts/compile-curl-universal.sh, src/Makefile: use of an embedded version of libcurl for osx to avoid the old and crappy 10.4 version (gareuselesinge)
- src/lua/davmail.lua: fixed metadata (gareuselesinge)
- src/lua/hotmail.lua: new version by russell (gareuselesinge)
- src/lua/mailcom.lua: Fixed issues with india.com (russell822)
- src/lua/yahoo.lua: Minor tweaks to fix issues reported in threads. (russell822)
- osx uses a custom version of curl, since osx 10.4 has an old version
- osx package will report the correct version
Too many changes to note, but this works with PostgreSQL-9.1.5 without
spitting out any warnings which is my reason for updating it.
A few of prior pkgsrc patches have been merged upstream now.
A little improvement to MESSAGE about upgrading.
CHANGELOG Roundcube Webmail
===========================
- Fix XSS vulnerability in handling of text/enriched messages (#1488806)
- Fix handling of 'media' attribute on linked css (#1488789)
- Fix regression where unintentional page reload was done after request abort (#1488802)
- Fix excessive LFs at the end of composed message with top_posting=true (#1488797)
- Fix bug where leading blanks were stripped from quoted lines (#1488795)
RELEASE 0.8.3
-------------
- Fix AREA links handling (#1488792)
- Fix possible HTTP DoS on error in keep-alive requests (#1488782)
- Fix compatybility with MDB2 2.5.0b4 (#1488779)
- Fix a bug where saving a message in INBOX wasn't possible
- Fix HTML part detection in messages with attachments (#1488769)
- Fix bug where wrong words were highlighted on spell-before-send check
- Fix scrolling quirk in email preview frame using Opera 12 (#1488763)
- Fix displaying of multipart/alternative messages with empty parts (#1488750)
- Fix Warning: htmlspecialchars(): charset `RCMAIL_CHARSET' not supported warning in Installer (#1488744)
- Fix threaded list sorting on PHP < 5.2.9 (#1488748)
RELEASE 0.8.2
-------------
- Fix XSS vulnerability from HTTP User-Agent header (#1488737)
- Force fonts in compose fields to be all the same (#1488690)
- Add full headers view in message preview window (#1488538)
- Fix message display page issues (#1488590, #1488642)
- Fix handling vCard entries with TEL;TYPE=CELL (#1488728)
- Fix error where session wasn't updated after folder rename/delete (#1488692)
- Fix PLAIN authentication for some IMAP servers (#1488674)
- Fix encoding vCard file when contains PHOTO;ENCODING=b (#1488683)
- Fix focus issue in IE when selecting message row (#1488620)
- Fix displaying all headers when they contain malformed characters (#1488666)
- Fix decoding of HTML messages with UTF-16 charset specified (#1488654)
- Fix quota capability detection so it can be overwritten by a plugin (#1488655)
- Fix identity selection on reply (#1488101)
- Fix Larry's messages list filter in IE (#1488632)
- Fix more IE issues by disabling Compat. mode with X-UA-Compatible meta tag (#1488626)
- Fix setting locales under Solaris - use additional .UTF-8 suffix (#1488628)
- Fix email address validation for addresses with IP address in domain part
- Fix Larry skin issues in IE7 compat. mode (#1488618)
- Fix so subscribed non-existing/non-accessible shared folder can be unsubscribed
- lmtp/lda: dovecot.index.cache file is no longer fully mapped to
memory, allowing mail deliveries to work even if the file is huge.
- auth: userdb passwd lookups are now done by auth worker processes
instead of auth master process (as it was documented, but
accidentally didn't work that way).
- lmtp: lmtp_rcpt_check_quota=yes setting checks quota on RCPT TO.
- lmtp: After successful proxying RCPT TO, the next one to a
nonexistent user gave tempfail error instead of "user not found".
- lmtp proxy: Fixed hanging if remote server was down.
- imap: Fixed crash when SEARCH contained multiple KEYWORD parameters.
- doveadm: Various fixes to handling doveadm-server connections.
- -i <instance name> parameter for Dovecot tools didn't work correctly.
- director was somewhat broken in v2.1.10. This version also includes
various reliability enhancements.
- auth: passdb imap was broken in v2.1.10.
Changelog:
NEW
A Menu Button is now shown to new users by default
NEW
Tabs are now drawn in the title bar on Windows
FIXED
An issue causing spell-checking only parts of words in Thunderbird 16 is now fixed (790475)
FIXED
An issue causing Thunderbird 16 to repeatedly download emails is now fixed (806760)
FIXED
RSS feeds can now be viewed in the Wide View Layout (531397)
FIXED
Various fixes and performance improvements
FIXED
Various security fixes
CHANGED
Mac OS X 10.5 is no longer supported
Security fixes:
Fixed in Thunderbird 17
MFSA 2012-106 Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer
MFSA 2012-105 Use-after-free and buffer overflow issues found using Address Sanitizer
MFSA 2012-103 Frames can shadow top.location
MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset
MFSA 2012-100 Improper security filtering for cross-origin wrappers
MFSA 2012-99 XrayWrappers exposes chrome-only properties when not in chrome compartment
MFSA 2012-97 XMLHttpRequest inherits incorrect principal within sandbox
MFSA 2012-96 Memory corruption in str_unescape
MFSA 2012-94 Crash when combining SVG text on path with CSS
MFSA 2012-93 evalInSanbox location context incorrectly applied
MFSA 2012-92 Buffer overflow while rendering GIF images
MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/ rv:10.0.11)
Fix input handling for file data sets for the macro case.
Ensure NULL-termination of macro value tests.
STATS: Fix hang bug in opendkim-reportstats.
STATS: Fix bug #SF3547363: Fix "Top 10" and DNSSEC trend reports.
2.6.6 2012/07/18
LIBAR: Fix bug #SF3544522: Not all systems define a "_len" member for
the sockaddr structures.
LIBOPENDKIM: Fix bug #SF3545490: If the body handed to the library was
missing a trailing line terminator, then dkim_canon_closebody()
would end the hashes with some data not included. Now, if
DKIM_LIBFLAGS_FIXCRLF is set, it will detect this condition
and correct it; if not, an error is returned.
LIBOPENDKIM: If the job ID passed in during handle creation includes
slashes and temporary file creation is enabled, convert the
slashes to dots in the temporary file template.
2.6.5 2012/07/14
Swap order of "header.d" and "header.i" values in
Authentication-Results fields.
BUILD: Fix bug #SF3543282: Corrections to Darwin/libar build adjustment
made in 2.6.3.
2.6.4 2012/07/12
Feature request #SF3542099: Include "header.d" in all
Authentication-Results fields, not just "header.i". This
makes life easier for users of OpenDMARC.
BUILD: Fix SHA256 test on some systems.
2.6.3 2012/07/11
Add "ResolvConf" setting, allowing the ability to pass a
resolv.conf-like file to unbound to allow specific nameservers
to be used instead of the default.
LIBOPENDKIM: Return the correct error code when a SHA1-only library
encounters a SHA1 signature that references a SHA256-only key.
LIBAR: Add ar_resolvconf().
BUILD: Fix bug #SF3538676: Build with -DDARWIN on MacOSX, and default
to arlib if unbound isn't selected.
2.6.2 2012/07/02
Fix build confusion between _FFR_RATE_LIMIT and _FFR_RESIGN.
Fix bug #SF3538639: Fix error when --domain is not provided to
opendkim-genrates. Problem noted by Andreas Schulze.
Fix bug #SF3539449: Clarify legal "Socket" values.
Fix bug #SF3539493: Handle certain cases of data set names that
appear to be comma-separated lists which include IPv6
addresses.
2.6.1 2012/06/25
Restore and activate _FFR_SELECT_CANONICALIZATION. Also adds a
SelectCanonicalizationHeader configuration option.
Remove _FFR_SELECTOR_HEADER.
Update Authentication-Results parsing to understand "dkim-atps"
(RFC6541) and no longer understand "hardfail" (RFC6577).
LIBAR: Fix bug #SF3309946: Ensure the dispatcher doesn't hold the
master lock when it might enter a read wait.
STATS: Add a database index on messages.msgtime to aid with
expiration performance.
TOOLS: Feature request #SF3536385: Add "-a" to opendkim-genkey to
include a domain name in the generated TXT record.
2.6.0 2012/06/07
Feature request #SF3502777: Log all authentication results rather than
relying on logging of Authentication-Results header fields.
Feature request #SF3512286: Add "LDAPSoftStart" flag so the filter
doesn't abort on startup when LDAP is not available.
Feature request #SF3512836: Add _FFR_SOCKETDB, which enables support
for a generic socket data set.
Feature request #SF3514982: Add Erlang data set support.
Feature request #SF3516253: Update to newest "repute" working group
documents, which mainly means adding JSON support and
promoting application-specific extensions to the top level
in the reputon structure.
Feature request #SF3518593: Add support for OpenLDAP's MDB as a
data set backend.
Feature request #SF3519002: Put reason information inside a "reason"
tag in Authentication-Results header fields rather than in
comments.
Feature request #SF3521000: Log hostname and daemon name (taken from
macros) when logging "no MTA name match".
Feature request #SF3524756: Add ability to request TCP keepalive
features via the OpenLDAP client library.
Feature request #SF3529233: Add odkim.get_envfrom() to all Lua scripts.
Fix bug #SF3518877: Separate variable expansion from literal text in
opendkim-genkey.
Fix bug #SF3522883: Allow TLS for ldapi URIs. Problem noted by
Quanah Gibson-Mount.
Fix bug #SF3527428: Construct the LDAP URI list properly, rather than
only keeping the last one, and add failover code.
Patch #SF3522895: Add contrib/ldap/opendkim.ldif.
Activate _FFR_XTAGS.
Remove _FFR_SELECT_CANONICALIZATION.
LIBAR: Fix bug #SF3444318: Do proper buffer size calculations to
avoid valgrind warnings about references to unaddressable
space.
LIBOPENDKIM: Fix bug #SF3496041: Remove _FFR_PARSETIME.
LIBOPENDKIM: Fix bug #SF3516653: By default, treat a syntax error
in an ADSP record as an NXDOMAIN. Add new library flag
DKIM_LIBFLAGS_REPORTBADADSP to restore the original
behaviour.
LIBOPENDKIM: Fix bug #SF3524865: Disallow generation of signatures
where signer and signing domain don't match per the DKIM
specification. Add DKIM_LIBFLAGS_DROPSIGNER which, if set,
will still generate signatures in that case, but with the
signer omitted so the signature is still compliant.
BUILD: Fix bug #SF3425384: Add missing support for compiling
against libevent2, which is an option for unbound.
BUILD: Fix bug #SF3475799: Don't do a manual check for libdb.a.
Use the AC_CHECK_* macros instead.
DOCS: Fix bug #SF3518864: The license for IETF documents is not
compatible with free software licensing, which makes packaging
a bit of a chore. Replace all the text files in the "docs"
directory with a single HTML page that includes links to
all the things we used to include here.
STATS: Feature request #SF3110059: Move opendkim-reportstats from
contrib/stats to stats, making it fully supported.
STATS: Feature request #SF3525786: Add opendkim-expire script.
STATS: Feature request #SF3528652: Allow a specific list of domains,
possibly read from a file, for opendkim-gengraphs and
opendkim-genrates.
mailsort is a perl script that sorts mbox format (single file) mail
folders by the dates in the `From ' lines that separate mail messages
in each folder.
to fix the build. As the "fetchmail" package doesn't provide any
shared libraries this shouldn't cause problems caused by mixing two
versions of OpenSSL.
Changelog:
Fixed in Thunderbird 16.0.2
MFSA 2012-90 Fixes for Location object issues
MFSA 2012-67 Installer will launch incorrect executable following new installation
# SECURITY FIXES
* for CVE-2012-3482:
NTLM: fetchmail mistook an error message that the server sent in response to
an NTLM request for protocol exchange, tried to decode it, and crashed while
reading from a bad memory location.
Also, with a carefully crafted NTLM challenge packet sent from the server, it
would be possible that fetchmail conveyed confidential data not meant for the
server through the NTLM response packet.
Fix: Detect base64 decoding errors, validate the NTLM challenge, and abort
NTLM authentication in case of error.
See fetchmail-SA-2012-02.txt for further details.
Reported by J. Porter Clark.
* for CVE-2011-3389:
SSL/TLS (wrapped and STARTTLS): fetchmail used to disable a countermeasure
against a certain kind of attack against cipher block chaining initialization
vectors (SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS).
Whether this creates an exploitable situation, depends on the server and the
negotiated ciphers.
As a precaution, fetchmail 6.3.22 enables the countermeasure, by clearing
SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS.
NOTE that this can cause connections to certain non-conforming servers to
fail, in which case you can set the environment variable
FETCHMAIL_DISABLE_CBC_IV_COUNTERMEASURE to any non-empty value when starting
fetchmail to re-instate the compatibility option at the expense of security.
Reported by Apple Product Security.
For technical details, refer to <http://www.openssl.org/~bodo/tls-cbc.txt>.
See fetchmail-SA-2012-01.txt for further details.
# BUG FIX
* The Server certificate: message in verbose mode now appears on stdout like the
remainder of the output. Reported by Henry Jensen, to fix Debian Bug #639807.
* The GSSAPI-related autoconf code now matches gssapi.c better, and uses
a different check to look for GSS_C_NT_HOSTBASED_SERVICE.
This fixes the GSSAPI-enabled build on NetBSD 6 Beta.
# CHANGES
* On systems where SSLv2_client_method isn't defined in OpenSSL (such as
newer Debian, and Ubuntu starting with 11.10 oneiric ocelot), don't
reference it (to fix the build) and if configured, print a run-time error
that the OS does not support SSLv2. Fixes Debian Bug #622054,
but note that that bug report has a more thorough patch that does away with
SSLv2 altogether.
* The security and errata notices fetchmail-{EN,SA}-20??-??.txt are now
under the more relaxed CC BY-ND 3.0 license (the noncommercial clause
was dropped). The Creative Commons address was updated.
* The Python-related Makefile.am parts were simplified to avoid an automake
1.11.X bug around noinst_PYTHON, Automake Bug #10995.
* Configuring fetchmail without SSL now triggers a configure warning,
and asks the user to consider running configure --with-ssl.
# WORKAROUNDS
* Some servers, notably Zimbra, return A1234 987 FETCH () in response to
a header request, in the face of message corruption. fetchmail now treats
these as temporary errors. Report and Patch by Mikulas Patocka, Red Hat.
* Some servers, notably Microsoft Exchange, return "A0009 OK FETCH completed."
without any header in response to a header request for meeting reminder
messages (with a "meeting.ics" attachment). fetchmail now treats these as
transient errors. Report by John Connett, Patch by Sunil Shetye.
# TRANSLATION UPDATES
* [cs] Czech, by Petr Pisar
* [de] German
* [fr] French, by Frédéric Marchal
* [ja] Japanese, by Takeshi Hamasaki
* [pl] Polish, by Jakub Bogusz
* [sv] Swedish, by Göran Uddeborg --- NEW TRANSLATION - Thank you!
* [vi] Vietnamese, by Trần Ngọc Quân
Exim version 4.80.1
-------------------
PP/01 SECURITY: protect DKIM DNS decoding from remote exploit.
CVE-2012-5671
This, or similar/improved, will also be change PP/11 of 4.81.
See: https://secunia.com/advisories/51098/
