exim4 (4.76-3ubuntu3.3) precise-security; urgency=medium
* SECURITY UPDATE: privilege escalation via crafted lookup value
- debian/patches/CVE-2014-2972.patch: only expand integers for integer
math once.
- CVE-2014-2972
* SECURITY UPDATE: privilege escalation when used with perl_startup
- debian/patches/CVE-2016-1531.patch: add new add_environment and
keep_environment configuration options.
- debian/patches/CVE-2016-1531-2.patch: don't issue env warning if env
is empty.
- debian/patches/CVE-2016-1531-3.patch: store the initial working
directory, expand $initial_cwd.
- debian/patches/CVE-2016-1531-4.patch: delay chdir(/) until we opened
the main config.
- Add macros MAIN_KEEP_ENVIRONMENT and MAIN_ADD_ENVIRONMENT to set the
new options. Set "keep_environment =" by default to avoid a runtime
warning.
- Bump exim4-config Breaks to exim4-daemon-* (<< 4.76-3ubuntu3.3).
- debian/exim4-config.NEWS: Add entry to warn of potential breakage.
- CVE-2016-1531
* WARNING: This update may break existing installations.
exim4 (4.76-3ubuntu3.2) precise-proposed; urgency=low
* Increase smtp_cmd_buffer_size to 16384 (upstream bug #879, fixed in 4.77).
This allows using smtp kerberos/gssapi auth against AD/samba4 on windows.
(LP: #1088136)
Date: 2016-03-14 18:15:20.330125+00:00
Changed-By: Marc Deslauriers <[email protected]>
https://launchpad.net/ubuntu/+source/exim4/4.76-3ubuntu3.3
Sorry, changesfile not available.
--
Precise-changes mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/precise-changes
