pkgsrc-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

pkg/43269: fetchmail should be bumped up to version 6.3.17



>Number:         43269
>Category:       pkg
>Synopsis:       fetchmail should be bumped up to version 6.3.17
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Thu May 06 11:45:00 +0000 2010
>Originator:     Michael Vergallen
>Release:        PKGSRC-2010Q1
>Organization:
>Environment:
all
>Description:
Can you please update the version from 6.3.14 to version 6.3.17 because of a 
bug in 6.3.14 that affects UTF-8. see below from the release notes.

CVE-2010-1167: Fetchmail before release 6.3.17 did not properly sanitize
  external input (mail headers and UID). When a multi-character locale (such as 
UTF-8) was in use, this could cause memory exhaustion and thus a denial of 
service, because fetchmail's report.c functions assumed that non-success of 
[v]snprintf was due to insufficient buffer size allocation. It would then 
repeatedly reallocate a larger buffer and fail formatting again. See 
fetchmail-SA-2010-02.txt.
 
>How-To-Repeat:

>Fix:
update to latest version



Home | Main Index | Thread Index | Old Index