exim4 4.71-3ubuntu1.1 source package in Ubuntu
Changelog
exim4 (4.71-3ubuntu1.1) lucid-security; urgency=low * SECURITY UPDATE: local privilege escalation via alternate config file (LP: #697934) - debian/patches/80_CVE-2010-4345.patch: backport massive behaviour- altering changes from upstream git to fix issue. - debian/patches/81_CVE-2010-4345-docs.patch: backport documentation changes. - debian/patches/67_unnecessaryCopt.dpatch: Do not use exim's -C option in utility scripts. This would not work with ALT_CONFIG_PREFIX. Patch obtained from Debian's 4.69-9+lenny2. - Build with WHITELIST_D_MACROS=OUTGOING. After this security update, exim will not regain root privileges (usually necessary for local delivery) if the -D option was used. Macro identifiers listed in WHITELIST_D_MACROS are exempted from this restriction. mailscanner (4.79.11-2.2) uses -DOUTGOING. - Build with TRUSTED_CONFIG_LIST=/etc/exim4/trusted_configs. After this security update, exim will not re-gain root privileges (usually necessary for local delivery) if the -C option was used. This makes it impossible to start a fully functional damon with an alternate configuration file. /etc/exim4/trusted_configs (can) contain a list of filenames (one per line, full path given) to which this restriction does not apply. - debian/exim4-daemon-*.NEWS: Add description of changes. Thanks to Debian and Andreas Metzler for the text. - CVE-2010-4345 * SECURITY UPDATE: arbitrary file append via symlink attack (LP: #708023) - debian/patches/82_CVE-2011-0017.patch: check setuid and setgid return codes in src/exim.c, src/log.c. - CVE-2011-0017 * SECURITY UPDATE: denial of service and possible arbitrary code execution via hard link to another user's file (LP: #609620) - debian/patches/CVE-2010-2023.patch: check for links in src/transports/appendfile.c. - CVE-2010-2023 * SECURITY UPDATE: denial of service and possible arbitrary code execution via symlink on a lock file (LP: #609620) - debian/patches/CVE-2010-2024.patch: improve lock file handling in src/exim_lock.c, src/transports/appendfile.c. - CVE-2010-2024 * debian/rules: disable debconf-updatepo so the security update doesn't alter translations. -- Marc Deslauriers <email address hidden> Tue, 08 Feb 2011 11:31:29 -0500
Upload details
- Uploaded by:
- Marc Deslauriers
- Uploaded to:
- Lucid
- Original maintainer:
- Ubuntu Developers
- Architectures:
- any
- Section:
- Urgency:
- Low Urgency
See full publishing history Publishing
Series | Published | Component | Section |
---|
Downloads
File | Size | SHA-256 Checksum |
---|---|---|
exim4_4.71.orig.tar.gz | 1.9 MiB | 36f76944a9f898fad2c64e268d54bd765e619be060cdb0320553fc2a1f4bf2fe |
exim4_4.71-3ubuntu1.1.debian.tar.gz | 577.9 KiB | 092f4dd0b96219763f7852a8ef2542824b78063acff18491487ade1da0a45ad5 |
exim4_4.71-3ubuntu1.1.dsc | 2.3 KiB | b35a317f7f99ae63e7b7add8a00d78e406a93ba4547686ccc9d4e975710172be |
Available diffs
Binary packages built by this source
- exim4: No summary available for exim4 in ubuntu lucid.
No description available for exim4 in ubuntu lucid.
- exim4-base: No summary available for exim4-base in ubuntu lucid.
No description available for exim4-base in ubuntu lucid.
- exim4-config: No summary available for exim4-config in ubuntu lucid.
No description available for exim4-config in ubuntu lucid.
- exim4-daemon-heavy: No summary available for exim4-daemon-heavy in ubuntu lucid.
No description available for exim4-daemon-heavy in ubuntu lucid.
- exim4-daemon-heavy-dbg: No summary available for exim4-daemon-heavy-dbg in ubuntu lucid.
No description available for exim4-daemon-
heavy-dbg in ubuntu lucid.
- exim4-daemon-light: No summary available for exim4-daemon-light in ubuntu lucid.
No description available for exim4-daemon-light in ubuntu lucid.
- exim4-daemon-light-dbg: No summary available for exim4-daemon-light-dbg in ubuntu lucid.
No description available for exim4-daemon-
light-dbg in ubuntu lucid.
- exim4-dbg: No summary available for exim4-dbg in ubuntu lucid.
No description available for exim4-dbg in ubuntu lucid.
- exim4-dev: No summary available for exim4-dev in ubuntu lucid.
No description available for exim4-dev in ubuntu lucid.
- eximon4: No summary available for eximon4 in ubuntu lucid.
No description available for eximon4 in ubuntu lucid.