It looks like QP core uses gethostbyaddr() but not gethostbyname(). the fcrdns plugin uses Net::DNS, and as far as I can tell Net::DNS never calls gethostbyname() either. So I *think* we're good.
-Jared ________________________________________ From: Charlie Brady <charlieb-qpsm...@budge.apana.org.au> Sent: Wednesday, January 28, 2015 7:24 AM To: qpsmtpd@perl.org Subject: CVE-2015-0235 exposure via qpsmtpd? As you can see in the advisory: http://www.openwall.com/lists/oss-security/2015/01/27/9 exim allows remote exploit of a buffer overflow in glibc. Has anybody done an analysis of qpsmtpd to see whether there is a code path via qpsmtpd (and plugins) and perl which allows the same exploit?
