| non port: mail/dovecot/files/patch-src_lib-auth_auth-client-request.c |
|
SVNWeb
|
Number of commits found: 3 |
|
Wed, 28 Feb 2018
|
[ 23:12 adamw  ]  
Update dovecot to 2.2.34, and bump pigeonhole.
* CVE-2017-15130: TLS SNI config lookups may lead to excessive
memory usage, causing imap-login/pop3-login VSZ limit to be reached
and the process restarted. This happens only if Dovecot config has
local_name { } or local { } configuration blocks and attacker uses
randomly generated SNI servernames.
* CVE-2017-14461: Parsing invalid email addresses may cause a crash or
leak memory contents to attacker. For example, these memory contents
might contain parts of an email from another user if the same imap
process is reused for multiple users. First discovered by Aleksandar
Nikolic of Cisco Talos. Independently also discovered by "flxflndy"
via HackerOne.
* CVE-2017-15132: Aborted SASL authentication leaks memory in login
process.(Only the first 15 lines of the commit message are shown above  )
|
|
Thu, 1 Feb 2018
|
[ 13:23 zeising ]
Complete fix for CVE-2017-15132
Complete fix for CVE-2017-15132, the previous fix was not enough, and caused
the request to remain after an abort, causing a use-after-free later on.
PR: 225585
Submitted by: Vladimir Krstulja
Approved by: adamw (maintainer)
MFH: 2018Q1
|
|
Mon, 29 Jan 2018
|
[ 20:59 zeising ]
Add patch and fix CVE-2017-15132
Add upstream patch to fix CVE-2017-15132, memory leak in the log in process
that can cause memory exhaustion.
PR: 225446
Submitted by: Vladimir Krstulja
Approved by: adamw (maintainer), swills (ports-secteam)
MFH: 2018Q1
Security: 92b8b284-a3a2-41b1-956c-f9cf8b74f500
|
Number of commits found: 3 |
As an Amazon Associate I earn from qualifying purchases.