dovecot 1:2.3.4.1-5ubuntu1 source package in Ubuntu

Changelog

dovecot (1:2.3.4.1-5ubuntu1) eoan; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - carry mail-stack-delivery as empty transitional package
  * Dropped:
    - SECURITY UPDATE: stack overflow when reading FTS or POP3-UIDL header
      + debian/patches/CVE-2019-7524-1.patch: fix buffer overflow when
        reading oversized hdr-pop3-uidl header in
        src/lib-storage/index/index-pop3-uidl.c.
      + debian/patches/CVE-2019-7524-2.patch: fix buffer overflow when
        reading oversized fts header in src/plugins/fts/fts-api.c.
      + CVE-2019-7524
      [Fixed in 1:2.3.4.1-3]
    - SECURITY UPDATE: JSON encoder assert DoS
      + debian/patches/CVE-2019-10691.patch: escape invalid UTF-8 as unicode
        bytes in src/lib/json-parser.c, src/lib/test-json-parser.c.
      + CVE-2019-10691
      [Fixed in 1:2.3.4.1-4]
    - SECURITY UPDATE: submission-login denial of service issues
      + debian/patches/CVE-2019-1149x-1.patch: remove unused
        client->pending_starttls in src/submission-login/client.h.
      + debian/patches/CVE-2019-1149x-2.patch: fix crash occurring when
        client disconnects during authentication in
        src/submission-login/client-authenticate.c,
        src/submission-login/client.c.
      + debian/patches/CVE-2019-1149x-3.patch: fix AUTH response error
        handling so that it stops reading more input in
        src/lib-smtp/smtp-server-cmd-auth.c.
      + CVE-2019-11494
      + CVE-2019-11499
      [Fixed in 1:2.3.4.1-5]

dovecot (1:2.3.4.1-5) unstable; urgency=medium

  * [bd00402] Fix CVE-2019-11494 and CVE-2019-11499 (Closes: #928235)
     - submission-login: fix null pointer dereference when client
       disconnects during authentication (CVE-2019-11494)
     - submission-login: fix assert-crash when receiving an invalid
       authentication message over TLS (CVE-2019-11499)

dovecot (1:2.3.4.1-4) unstable; urgency=high

  * [d04d4ba] Fix assert-crash in JSON encoder (CVE-2019-10691)

dovecot (1:2.3.4.1-3) unstable; urgency=high

  * [07c9212] Fix two buffer overflows when reading oversized FTS headers
    and/or oversized POP3-UIDL headers (CVE-2019-7524).

dovecot (1:2.3.4.1-2) unstable; urgency=medium

  [ Laurent Bigonville ]
  * [ac99918] Fix double-free crash in mysql driver
    Fix double closing of the connection in the mysql driver, this should
    fix the crash in the dovecot auth process, taken from upstream.
    (Closes: #918339)

  [ Apollon Oikonomopoulos ]
  * [8a30446] Bump Standards-Version to 4.3.0; no changes needed

 -- Bryce Harrington <email address hidden>  Fri, 03 May 2019 12:02:04 -0700