17713383a5
This is a SECURITY release, addressing a CRITICAL remote code execution flaw in Exim version 4.82 (only) when built with DMARC support (an experimental feature, not on by default). This release is identical to 4.82 except for the small change needed to plug the security hole. The next release of Exim will, eventually, be 4.83, which will include the many improvements we've made since 4.82, but which will require the normal release candidate baking process before release. You are not vulnerable unless you built Exim with EXPERIMENTAL_DMARC. This issue is known by the CVE ID of CVE-2014-2957, was reported directly to the Exim development team by a company which uses Exim for its mail server. An Exim developer constructed a small patch which altered the way the contents of the From header is parsed by converting it to use safer and better internal functions. It was applied and tested on a production server for correctness. We were notified of the vulnerability Friday night, created a patch on Saturday, applied and tested it on Sunday, notified OS packagers on Monday/Tuesday, and are releasing on the next available work day, which is Wednesday. This is why we have made the smallest feasible changes to prevent exploit: we want this chagne to be as safe as possible to expedite into production (if the packages were built with DMARC).
10 lines
551 B
Text
10 lines
551 B
Text
$NetBSD: distinfo,v 1.58 2014/05/29 09:27:37 adam Exp $
|
|
|
|
SHA1 (exim-4.82.1.tar.bz2) = bfb5ae3ab2444d494cdee650983a35dcc10243f5
|
|
RMD160 (exim-4.82.1.tar.bz2) = 2caa80ed8b5fef07fd0449dc5ac7958681466a2d
|
|
Size (exim-4.82.1.tar.bz2) = 1722912 bytes
|
|
SHA1 (patch-aa) = 24a12631b7df17930349b8a0d03adc80d27efbe2
|
|
SHA1 (patch-ab) = 6af17f036ed02a3bc37c1f303269eea447fcb691
|
|
SHA1 (patch-ae) = 7daf63727e222bbaa7e5b8289c4fcb6a8c0272cf
|
|
SHA1 (patch-ag) = dd93bb718c996f18b4e985806eb6d4ff5f25a67f
|
|
SHA1 (patch-lookups_Makefile) = 57a8ab00e5f3c6891c74fdfe457adc1d73bc06ce
|