summaryrefslogtreecommitdiff
path: root/gnu/packages
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages')
-rw-r--r--gnu/packages/mail.scm7
-rw-r--r--gnu/packages/patches/exim-CVE-2017-1000369.patch59
-rw-r--r--gnu/packages/patches/exim-CVE-2017-16943.patch65
-rw-r--r--gnu/packages/patches/exim-CVE-2017-16944.patch87
4 files changed, 2 insertions, 216 deletions
diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index b9656c7dd8..114b1a21bb 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -1034,7 +1034,7 @@ delivery.")
(define-public exim
(package
(name "exim")
- (version "4.89")
+ (version "4.89.1")
(source
(origin
(method url-fetch)
@@ -1042,12 +1042,9 @@ delivery.")
version ".tar.bz2")
(string-append "ftp://ftp.exim.org/pub/exim/exim4/old/exim-"
version ".tar.bz2")))
- (patches (search-patches "exim-CVE-2017-16943.patch"
- "exim-CVE-2017-16944.patch"
- "exim-CVE-2017-1000369.patch"))
(sha256
(base32
- "1c0syp7yxngmq7y8vqsrvijinzin5m941vn0ljihdfld7kh2wbwi"))))
+ "133sjkcm9wlhpcxflr5v865varc1995bqa1y3vjs1w6zc34kp18w"))))
(build-system gnu-build-system)
(inputs
`(("bdb" ,bdb)
diff --git a/gnu/packages/patches/exim-CVE-2017-1000369.patch b/gnu/packages/patches/exim-CVE-2017-1000369.patch
deleted file mode 100644
index a67a8afb0e..0000000000
--- a/gnu/packages/patches/exim-CVE-2017-1000369.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-Fix CVE-2017-1000369:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369
-https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
-
-Patch adapted from upstream source repository:
-
-https://git.exim.org/exim.git/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21
-
-From 65e061b76867a9ea7aeeb535341b790b90ae6c21 Mon Sep 17 00:00:00 2001
-From: "Heiko Schlittermann (HS12-RIPE)" <hs@schlittermann.de>
-Date: Wed, 31 May 2017 23:08:56 +0200
-Subject: [PATCH] Cleanup (prevent repeated use of -p/-oMr to avoid mem leak)
-
----
- doc/doc-docbook/spec.xfpt | 3 ++-
- src/src/exim.c | 19 +++++++++++++++++--
- 2 files changed, 19 insertions(+), 3 deletions(-)
-
-diff --git a/src/src/exim.c b/src/src/exim.c
-index 67583e58..88e11977 100644
---- a/src/exim.c
-+++ b/src/exim.c
-@@ -3106,7 +3106,14 @@ for (i = 1; i < argc; i++)
-
- /* -oMr: Received protocol */
-
-- else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
-+ else if (Ustrcmp(argrest, "Mr") == 0)
-+
-+ if (received_protocol)
-+ {
-+ fprintf(stderr, "received_protocol is set already\n");
-+ exit(EXIT_FAILURE);
-+ }
-+ else received_protocol = argv[++i];
-
- /* -oMs: Set sender host name */
-
-@@ -3202,7 +3209,15 @@ for (i = 1; i < argc; i++)
-
- if (*argrest != 0)
- {
-- uschar *hn = Ustrchr(argrest, ':');
-+ uschar *hn;
-+
-+ if (received_protocol)
-+ {
-+ fprintf(stderr, "received_protocol is set already\n");
-+ exit(EXIT_FAILURE);
-+ }
-+
-+ hn = Ustrchr(argrest, ':');
- if (hn == NULL)
- {
- received_protocol = argrest;
---
-2.13.1
-
diff --git a/gnu/packages/patches/exim-CVE-2017-16943.patch b/gnu/packages/patches/exim-CVE-2017-16943.patch
deleted file mode 100644
index 3a3e5d27fa..0000000000
--- a/gnu/packages/patches/exim-CVE-2017-16943.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-Fix CVE-2017-16943:
-
-https://bugs.exim.org/show_bug.cgi?id=2199
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16943
-
-Patch copied from upstream source repository:
-
-https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde
-
-From 4090d62a4b25782129cc1643596dc2f6e8f63bde Mon Sep 17 00:00:00 2001
-From: Jeremy Harris <jgh146exb@wizmail.org>
-Date: Fri, 24 Nov 2017 20:22:33 +0000
-Subject: [PATCH] Avoid release of store if there have been later allocations.
- Bug 2199
-
----
- doc/doc-txt/ChangeLog | 4 ++++
- src/src/receive.c | 7 ++++---
- 2 files changed, 8 insertions(+), 3 deletions(-)
-
-#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
-#index e937ba2..a2d9339 100644
-#--- a/doc/doc-txt/ChangeLog
-#+++ b/doc/doc-txt/ChangeLog
-#@@ -59,6 +59,10 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for
-# connection in response to HELO" was logged instead of the actual 4xx
-# error for the HELO.
-#
-#+JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines.
-#+ A crafted sequence of BDAT commands could result in in-use memory beeing
-#+ freed.
-#+
-#
- Exim version 4.89
- -----------------
-diff --git a/src/src/receive.c b/src/src/receive.c
-index 95cf13e..20672db 100644
---- a/src/receive.c
-+++ b/src/receive.c
-@@ -1772,8 +1772,8 @@ for (;;)
- (and sometimes lunatic messages can have ones that are 100s of K long) we
- call store_release() for strings that have been copied - if the string is at
- the start of a block (and therefore the only thing in it, because we aren't
-- doing any other gets), the block gets freed. We can only do this because we
-- know there are no other calls to store_get() going on. */
-+ doing any other gets), the block gets freed. We can only do this release if
-+ there were no allocations since the once that we want to free. */
-
- if (ptr >= header_size - 4)
- {
-@@ -1782,9 +1782,10 @@ for (;;)
- header_size *= 2;
- if (!store_extend(next->text, oldsize, header_size))
- {
-+ BOOL release_ok = store_last_get[store_pool] == next->text;
- uschar *newtext = store_get(header_size);
- memcpy(newtext, next->text, ptr);
-- store_release(next->text);
-+ if (release_ok) store_release(next->text);
- next->text = newtext;
- }
- }
---
-1.9.1
-
diff --git a/gnu/packages/patches/exim-CVE-2017-16944.patch b/gnu/packages/patches/exim-CVE-2017-16944.patch
deleted file mode 100644
index e4e8313c9c..0000000000
--- a/gnu/packages/patches/exim-CVE-2017-16944.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-Fix CVE-2017-16944:
-
-https://bugs.exim.org/show_bug.cgi?id=2201
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16944
-
-Patch copied from upstream source repository:
-
-https://git.exim.org/exim.git/commit/4804c62909a62a3ac12ec4777ebd48c541028965
-
-From 4804c62909a62a3ac12ec4777ebd48c541028965 Mon Sep 17 00:00:00 2001
-From: "Heiko Schlittermann (HS12-RIPE)" <hs@schlittermann.de>
-Date: Mon, 27 Nov 2017 22:42:33 +0100
-Subject: [PATCH] Chunking: do not treat the first lonely dot special.
- CVE-2017-16944, Bug 2201
-
-(cherry picked from commit 178ecb70987f024f0e775d87c2f8b2cf587dd542)
-
-Change log update
-
-(cherry picked from commit b488395f4d99d44a950073a64b35ec8729102782)
----
- doc/doc-txt/ChangeLog | 6 +++++-
- src/src/receive.c | 2 +-
- src/src/smtp_in.c | 7 +++++++
- 3 files changed, 13 insertions(+), 2 deletions(-)
-
-#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
-#index a2d9339..541ebaf 100644
-#--- a/doc/doc-txt/ChangeLog
-#+++ b/doc/doc-txt/ChangeLog
-#@@ -61,7 +61,11 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for
-#
-# JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines.
-# A crafted sequence of BDAT commands could result in in-use memory beeing
-#- freed.
-#+ freed. CVE-2017-16943.
-#+
-#+HS/03 Bug 2201: Fix checking for leading-dot on a line during headers reading
-#+ from SMTP input. Previously it was always done; now only done for DATA
-#+ and not BDAT commands. CVE-2017-16944.
-#
-#
-# Exim version 4.89
-diff --git a/src/src/receive.c b/src/src/receive.c
-index 20672db..2812ea2 100644
---- a/src/receive.c
-+++ b/src/receive.c
-@@ -1827,7 +1827,7 @@ for (;;)
- prevent further reading), and break out of the loop, having freed the
- empty header, and set next = NULL to indicate no data line. */
-
-- if (ptr == 0 && ch == '.' && (smtp_input || dot_ends))
-+ if (ptr == 0 && ch == '.' && dot_ends)
- {
- ch = (receive_getc)(GETC_BUFFER_UNLIMITED);
- if (ch == '\r')
-diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c
-index 1b45f84..0207540 100644
---- a/src/smtp_in.c
-+++ b/src/smtp_in.c
-@@ -4955,16 +4955,23 @@ while (done <= 0)
- DEBUG(D_receive) debug_printf("chunking state %d, %d bytes\n",
- (int)chunking_state, chunking_data_left);
-
-+ /* push the current receive_* function on the "stack", and
-+ replace them by bdat_getc(), which in turn will use the lwr_receive_*
-+ functions to do the dirty work. */
- lwr_receive_getc = receive_getc;
- lwr_receive_ungetc = receive_ungetc;
-+
- receive_getc = bdat_getc;
- receive_ungetc = bdat_ungetc;
-
-+ dot_ends = FALSE;
-+
- goto DATA_BDAT;
- }
-
- case DATA_CMD:
- HAD(SCH_DATA);
-+ dot_ends = TRUE;
-
- DATA_BDAT: /* Common code for DATA and BDAT */
- if (!discarded && recipients_count <= 0)
---
-1.9.1
-
generated by cgit v1.2.3 (git 2.46.2) at 2024-11-14 08:51:51 +0000