Bug 274235
| Summary: | mail/exim: update 4.96 -> 4.96.1 to fix several CVEs | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Ports & Packages | Reporter: | Kurt Jaeger <pi> | ||||||
| Component: | Individual Port(s) | Assignee: | Dima Panov <fluffy> | ||||||
| Status: | Closed FIXED | ||||||||
| Severity: | Affects Many People | CC: | grahamperrin, pi, ports-secteam, tom | ||||||
| Priority: | Normal | Keywords: | security | ||||||
| Version: | Latest | Flags: | bugzilla:
maintainer-feedback?
(fluffy) grahamperrin: merge-quarterly? |
||||||
| Hardware: | Any | ||||||||
| OS: | Any | ||||||||
| URL: | https://www.exim.org/static/doc/security/CVE-2023-zdi.txt | ||||||||
| Attachments: |
|
||||||||
(In reply to Kurt Jaeger from comment #0) Patch is not correct. Some patches from debian were not imported because of minor issue. fix@work Created attachment 245412 [details]
patch-v2
This has the debian patches without the changelogs.
(In reply to Kurt Jaeger from comment #2) Testrun looks fine. A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=36fcd7174d1651f557875c1b57255faca3d27914 commit 36fcd7174d1651f557875c1b57255faca3d27914 Author: Kurt Jaeger <pi@FreeBSD.org> AuthorDate: 2023-10-03 20:27:51 +0000 Commit: Dima Panov <fluffy@FreeBSD.org> CommitDate: 2023-10-03 20:30:04 +0000 mail/exim: update 4.96 -> 4.96.1 to fix several CVEs PR: 274235 MFH: 2023Q4 mail/exim/Makefile | 4 ++-- mail/exim/distinfo | 6 ++--- ...-attempt-to-rewrite-a-malformed-address.-.patch | 18 --------------- ...5_08-Fix-regex-n-use-after-free.-Bug-2915.patch | 26 ---------------------- ...ix-for-clients-offering-no-TLS-extensions.patch | 18 --------------- ...-Build-with-libopendmarc-1.4.x-fixes-2728.patch | 17 -------------- .../75_22-Fix-daemon-startup.-Bug-2930.patch | 18 --------------- ..._23-Fix-reccipients-after-run.-.-Bug-2929.patch | 17 -------------- ...substring-capture-variables-for-null-matc.patch | 19 ---------------- .../75_50-Fix-logging-of-max-size-log-line.patch | 19 ---------------- ...ion-on-dns_again_means_nonexist.-Bug-2911.patch | 22 ------------------ ...-tls_eccurve-setting-explicit-curve-group.patch | 18 --------------- ...-check-dns_again_means_nonexist-for-TLSA-.patch | 20 +---------------- .../debian/75_66-Fix-crash-in-expansions.patch | 18 --------------- 14 files changed, 6 insertions(+), 234 deletions(-) A commit in branch 2023Q4 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=2e772d250e21beea9db7a23a2d04df59aa2a709b commit 2e772d250e21beea9db7a23a2d04df59aa2a709b Author: Kurt Jaeger <pi@FreeBSD.org> AuthorDate: 2023-10-03 20:27:51 +0000 Commit: Dima Panov <fluffy@FreeBSD.org> CommitDate: 2023-10-03 20:31:33 +0000 mail/exim: update 4.96 -> 4.96.1 to fix several CVEs PR: 274235 MFH: 2023Q4 (cherry picked from commit 36fcd7174d1651f557875c1b57255faca3d27914) mail/exim/Makefile | 4 ++-- mail/exim/distinfo | 6 ++--- ...-attempt-to-rewrite-a-malformed-address.-.patch | 18 --------------- ...5_08-Fix-regex-n-use-after-free.-Bug-2915.patch | 26 ---------------------- ...ix-for-clients-offering-no-TLS-extensions.patch | 18 --------------- ...-Build-with-libopendmarc-1.4.x-fixes-2728.patch | 17 -------------- .../75_22-Fix-daemon-startup.-Bug-2930.patch | 18 --------------- ..._23-Fix-reccipients-after-run.-.-Bug-2929.patch | 17 -------------- ...substring-capture-variables-for-null-matc.patch | 19 ---------------- .../75_50-Fix-logging-of-max-size-log-line.patch | 19 ---------------- ...ion-on-dns_again_means_nonexist.-Bug-2911.patch | 22 ------------------ ...-tls_eccurve-setting-explicit-curve-group.patch | 18 --------------- ...-check-dns_again_means_nonexist-for-TLSA-.patch | 20 +---------------- .../debian/75_66-Fix-crash-in-expansions.patch | 18 --------------- 14 files changed, 6 insertions(+), 234 deletions(-) Landed, thanks |
Created attachment 245401 [details] patch testbuilds fine. TODO: test-run