Let distcheck call configure --with-ssl.

[~andy/fetchmail] / fetchmail-SA-2006-01.txt

diff --git a/fetchmail-SA-2006-01.txt b/fetchmail-SA-2006-01.txt
index d929c6b5077fa5ffa7f16f24de850a999f8430e5..672b5510b24e1d60993fe924afbb8a27e46d04a5 100644 (file)
--- a/fetchmail-SA-2006-01.txt
+++ b/fetchmail-SA-2006-01.txt
@@ -1,35 +1,43 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+

 fetchmail-SA-2006-01: crash when bouncing messages.
 
 Topics:                #1 crash when bouncing a message
                #2 fetchmail 6.2.5.X end of life
 
 Author:                Matthias Andree
 fetchmail-SA-2006-01: crash when bouncing messages.
 
 Topics:                #1 crash when bouncing a message
                #2 fetchmail 6.2.5.X end of life
 
 Author:                Matthias Andree

-Version:       XXX
-Announced:     XXX
+Version:       1.1
+Announced:     2006-01-22

 Type:          free() with bogus pointer
 Impact:                fetchmail crashes
 Danger:                low
 Credits:       Nathaniel W. Turner (bug report)
 Type:          free() with bogus pointer
 Impact:                fetchmail crashes
 Danger:                low
 Credits:       Nathaniel W. Turner (bug report)

-CVE Name:      XXX
+CVE Name:      CVE-2006-0321

 URL:           http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt
                http://bugs.debian.org/348747
 Project URL:   http://fetchmail.berlios.de/
 
 URL:           http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt
                http://bugs.debian.org/348747
 Project URL:   http://fetchmail.berlios.de/
 

-Affects:       fetchmail version 6.3.0
-               fetchmail version 6.3.1
+Affects:       fetchmail release >= 6.3.0
+               fetchmail release <  6.3.2
+               fetchmail release candidates 6.3.2-rc1, -rc2 and -rc3

 
 

-Not affected:  fetchmail 6.3.2
-               fetchmail 6.2.5.5
+Not affected:  fetchmail release candidate 6.3.2-rc4
+               fetchmail release 6.3.2

                other versions not mentioned here or in the previous
                sections have not been checked
 
                other versions not mentioned here or in the previous
                sections have not been checked
 

-Corrected:     XXX
+Corrected:     2006-01-19 fetchmail 6.3.2-rc4
+               2006-01-22 fetchmail 6.3.2

 
 
 0. Release history
 ==================
 
 2006-01-19     internal review draft
 
 
 0. Release history
 ==================
 
 2006-01-19     internal review draft

+2006-01-20     add CVE ID
+2006-01-22     release 1.0
+2006-01-25     release 1.1, add fetchmail 6.3.2 to "Not affected" above.

 
 
 1. Background
 
 
 1. Background


@@ -48,12 +56,11 @@ control) files for fetchmail.
 =================================
 
 Fetchmail contains a bug that causes itself to crash when bouncing a
 =================================
 
 Fetchmail contains a bug that causes itself to crash when bouncing a

-message to the originator or to the local postmaster. Fetchmail crashes
-when trying to free the dynamic array of failed addresses, and calls the
-free() function with an invalid pointer.
-
-Note that such messages are not RFC-822 conformant, so if the server has
-not been tampered with, the server software is faulty.
+message to the originator or to the local postmaster. The crash happens
+after the bounce message has been sent, when fetchmail tries to free the
+dynamic array of failed addresses, and calls the free() function with an
+invalid pointer.  This bug was introduced short before fetchmail 6.3.0
+and is not present in the now discontinued 6.2.X series (see below).

 
 
 3. Workaround
 
 
 3. Workaround


@@ -77,7 +84,8 @@ The aged fetchmail 6.2.5.X branch is discontinued effective immediately.
 No further releases from the 6.2.5.X branch will be made.
 
 The new 6.3.X stable branch has been available since 2005-11-30
 No further releases from the 6.2.5.X branch will be made.
 
 The new 6.3.X stable branch has been available since 2005-11-30

-and will not change except for bugfixes, documentation and translations.
+and will not change except for bugfixes, documentation and message
+translations.

 
 
 A. Copyright, License and Warranty
 
 
 A. Copyright, License and Warranty


@@ -86,13 +94,28 @@ A. Copyright, License and Warranty
 (C) Copyright 2006 by Matthias Andree, <matthias.andree@gmx.de>.
 Some rights reserved.
 
 (C) Copyright 2006 by Matthias Andree, <matthias.andree@gmx.de>.
 Some rights reserved.
 

-This work is licensed under the Creative Commons
-Attribution-NonCommercial-NoDerivs German License. To view a copy of
-this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
-or send a letter to Creative Commons; 559 Nathan Abbott Way;
-Stanford, California 94305; USA.
+This work is licensed under the
+Creative Commons Attribution-NoDerivs 3.0 Germany License (CC BY-ND 3.0).
+
+To view a copy of this license, visit
+http://creativecommons.org/licenses/by-nd/3.0/de/deed.en
+or send a letter to:
+
+Creative Commons
+444 Castro Street
+Suite 900
+MOUNTAIN VIEW, CALIFORNIA 94041
+USA

 
 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
 Use the information herein at your own risk.
 
 END OF fetchmail-SA-2006-01.txt
 
 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
 Use the information herein at your own risk.
 
 END OF fetchmail-SA-2006-01.txt

+
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.11 (GNU/Linux)
+
+iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZVnOgCfVyOBUSVgRSjBtqzjaLwKEg0K
+30YAoJiFeNUcNBO3oKfq5rMdSEeNAfGP
+=Gvze
+-----END PGP SIGNATURE-----