X-Git-Url: http://pileus.org/git/?a=blobdiff_plain;f=website%2Fsecurity.html;h=2b8cc1b78fe4a603416b0ffc81932c7a5143b5ef;hb=bc92e40ab0f174062f4e11cfdf12aa7b68ba325c;hp=6825ee225ff2fb79d40356d09f0609c423146590;hpb=3d6557294f6324efcf4daaeb060c8e97112c9e91;p=~andy%2Ffetchmail

diff --git a/website/security.html b/website/security.html
index 6825ee22..2b8cc1b7 100644
--- a/website/security.html
+++ b/website/security.html
@@ -14,7 +14,7 @@
 <table width="100%" cellpadding="0" summary="Canned page header">
 <tr>
 <td>Fetchmail</td>
-<td align="right"><!-- update date -->2010-02-05</td>
+<td align="right"><!-- update date -->2012-08-30</td>
 </tr>
 </table>
 </div>
@@ -28,21 +28,55 @@
 	<a href="fetchmail-FAQ.pdf" title="Fetchmail FAQ as PDF">FAQ (PDF)</a><br>
 	<a href="design-notes.html">Design Notes</a><br>
 	<a href="http://developer.berlios.de/project/showfiles.php?group_id=1824">Download</a><br>
-	<a href="http://gitorious.org/fetchmail/fetchmail/">Development Code</a><br>
+	Security/Errata<br>
+	<a href="http://gitorious.org/fetchmail/fetchmail/">Development</a><br>
 	<a href="http://developer.berlios.de/projects/fetchmail/">Project Page</a><br>
 	<hr>
 </div>
 
 <div id="Content">
 
-    <h1>Fetchmail Security Information</h1>
-    <p>These security issues (listed immediately below) have become
-    known to the fetchmail maintainer to the date mentioned above. Note
-    that fetchmail 6.2.X and older are no longer supported and contain
+    <h1>Fetchmail Security and Errata Information</h1>
+    <p>These security issues (listed immediately below) and critical
+    issues have become
+    known to the fetchmail maintainer to the date mentioned above.</p>
+
+    <p>Note that fetchmail 6.2.X and older are no longer supported and contain
     some of the problems mentioned below, even if they aren't mentioned
     in the security announcements:</p>
     <ul>
-	<li>CVE-XXXX-XXXX: Fetchmail <a href="fetchmail-SA-2010-01.txt">would overrun the heap when displaying X.509 TLS/SSL certificates with characters with high bit set in verbose mode on platforms where char is a signed type.</a> This bug was introduced in release 6.3.11 and has been fixed in release 6.3.14.</li>
+	<li><a name="cve-2012-3482"
+	    href="http://web.nvd.nist.gov/view/vuln/Detail?vulnId=CVE-2012-3482">CVE-2012-3482:</a>
+	Fetchmail could <a href="fetchmail-SA-2012-02.txt">crash and
+	    possibly reveal fragments of confidential data</a> during
+	NTLM authentication.</li>
+	<li><a name="cve-2011-3389"
+	    href="http://web.nvd.nist.gov/view/vuln/Detail?vulnId=CVE-2011-3389">CVE-2011-3389:</a>
+	    <a href="fetchmail-SA-2012-01.txt">Fetchmail was vulnerable
+		to chosen-plaintext attacks against cipher block
+		chaining initialization vectors because it disabled an
+		OpenSSL countermeasure against this attack.</a>
+	</li>
+	<li><a name="cve-2011-1947"
+	    href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1947">CVE-2011-1947:</a>
+	Fetchmail <a href="fetchmail-SA-2011-01.txt"> could hang for
+	    indefinite amounts of time during STARTTLS negotiations</a>,
+	causing mail fetches to stall. This was a long-standing bug
+	fixed in release 6.3.20.</li>
+	<li><a name="fetchmail-EN-2010-03">EN-2010-03</a>: Fetchmail <a href="fetchmail-EN-2010-03.txt">fails
+	    POP3/IMAP authentication by not performing SASL AUTH
+	    properly.</a> This was a long-standing bug fixed in release
+	6.3.18.</li>
+	<li><a name="cve-2010-1167"
+	    href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1167">CVE-2010-1167:</a>
+	Fetchmail <a href="fetchmail-SA-2010-02.txt">could exhaust all
+	    available memory and abort on certain computers (for
+	    instance Linux) in multibyte locales (for instance UTF-8)
+	    when dumping malformed headers in debug (-v -v) mode.</a>
+	This bug was introduced long before 6.0.0 and has been fixed in
+	release 6.3.17.</li>
+	<li><a name="cve-2010-0562"
+	    href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0562">CVE-2010-0562:</a> Fetchmail <a href="fetchmail-SA-2010-01.txt">would overrun the heap when displaying X.509 TLS/SSL certificates with characters with high bit set in verbose mode on platforms where char is a signed type.</a> This bug was introduced in release 6.3.11 and has been fixed in release 6.3.14.</li>
 	<li><a name="cve-2009-2666" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2666">CVE-2009-2666:</a> Fetchmail <a href="fetchmail-SA-2009-01.txt">was found to validate SSL/TLS X.509 certificates improperly and allow man-in-the-middle-attacks to go undetected.</a> This bug has been fixed in release 6.3.11. For previous versions, use the <a href="fetchmail-SA-2009-01.txt">patch contained in the security announcement.</a></li>
 	<li><a name="cve-2008-2711" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2711">CVE-2008-2711:</a> Fetchmail can <a href="fetchmail-SA-2008-01.txt">crash in verbose mode when logging long message headers.</a> This bug has been fixed in release 6.3.9. For 6.3.8, use the <a href="fetchmail-SA-2008-01.txt">patch contained in the security announcement.</a></li>
 	<li><a name="cve-2007-4565" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4565">CVE-2007-4565:</a> Fetchmail can <a href="fetchmail-SA-2007-02.txt">crash when the SMTP server refuses a warning message generated by fetchmail.</a> This bug was introduced in fetchmail 4.6.8 and has been fixed in release 6.3.9. For 6.3.8, use the <a href="fetchmail-SA-2007-02.txt">patch contained in this security announcement.</a></li>