2010年5月 7日

[installer 2356] fetchmail-6.3.17

fetchmail-6.3.17 出ています。

セキュリティホールの修正が含まれています。
http://www.fetchmail.info/fetchmail-SA-2010-02.txt
参照のこと。

☆ fetchmail-6.3.17
http://www.fetchmail.info/

http://developer.berlios.de/project/showfiles.php?group_id=1824
http://download.berlios.de/fetchmail/fetchmail-6.3.17.tar.bz2

fetchmail-6.3.17 (released 2010-05-06, 25767 LoC):

# SECURITY FIX
* CVE-2010-1167: Fetchmail before release 6.3.17 did not properly sanitize
external input (mail headers and UID). When a multi-character locale (such as
UTF-8) was in use, this could cause memory exhaustion and thus a denial of
service, because fetchmail's report.c functions assumed that non-success of
[v]snprintf was due to insufficient buffer size allocation. It would then
repeatedly reallocate a larger buffer and fail formatting again.
See fetchmail-SA-2010-02.txt.

# FEATURES
* Fetchmail now supports a --sslcertfile <file> option to specify a "CA bundle"
file (a file that contains trusted CA certificates). Since these bundled CA
files do not require c_rehash to be run, they are easier to use and immune to
OpenSSL library updates that affect the hash function.
* Fetchmail now supports a FETCHMAIL_INCLUDE_DEFAULT_X509_CA_CERTS
environment variable to force loading the default SSL CA certificate
locations even if --sslcertfile or --sslcertpath is used.
If neither option is in effect, fetchmail loads the default locations.

# REGRESSION FIX
* Fix string handling in rcfile scanner, which caused fetchmail to misparse a
run control file in certain circumstances. Fixes BerliOS bug #14257.
Patch by Michael Banack. This fixes a regression introduced before 6.3.0.

# BUG FIXES
* Plug memory leak when using a "defaults" entry in the run control file.
* Do not print SSL certificate mismatches unless verbose or --sslcertck is
enabled.
* Do not lose "set invisible" in fetchmailconf. (Michael Barnack)

# CHANGES
* Usability: SSL certificate chains are fully printed in -v -v mode, and there
are now helpful pointers to --sslcertpath and c_rehash for "unable to get
local issuer certificate" and self-signed certificates -- these usually hint
to missing root signing CAs in the certs directory.
* Several fixes for compiler (GCC, Intel C++, CLang) and autotools warnings
* Memory allocation failures will now cause abnormal program abort (SIGABRT),
no longer an exit with unspecified code.

# DOCUMENTATION
* Fix table of global option to read "set softbounce" where there used to be a
2nd copy of "set spambounce". Patch by Michael Banack, BerliOS Bug #17067.
* In the --sslcertpath description, mention that OpenSSL upgrade (and a 0.9.X
to 1.0.0 upgrade in particular) may require running c_rehash.

# TRANSLATION UPDATES
[zh_CN] Chinese/simplified (Ji Zheng-Yu)
[cs] Czech (Petr Pisar)
[nl] Dutch (Erwin Poeze)

投稿者 xml-rpc : 2010年5月 7日 10:12
役に立ちました?:
過去のフィードバック 平均:(0) 総合:(0) 投票回数:(0)
本記事へのTrackback: http://hoop.euqset.org/blog/mt-tb2006.cgi/95578
トラックバック
コメント
コメントする




画像の中に見える文字を入力してください。