diff options
| -rw-r--r-- | gnu/local.mk | 3 | ||||
| -rw-r--r-- | gnu/packages/mail.scm | 7 | ||||
| -rw-r--r-- | gnu/packages/patches/exim-CVE-2017-1000369.patch | 59 | ||||
| -rw-r--r-- | gnu/packages/patches/exim-CVE-2017-16943.patch | 65 | ||||
| -rw-r--r-- | gnu/packages/patches/exim-CVE-2017-16944.patch | 87 |
5 files changed, 2 insertions, 219 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 1dcebc9921..926f03ddba 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -615,9 +615,6 @@ dist_patch_DATA = \ %D%/packages/patches/erlang-man-path.patch \ %D%/packages/patches/eudev-rules-directory.patch \ %D%/packages/patches/evilwm-lost-focus-bug.patch \ - %D%/packages/patches/exim-CVE-2017-16943.patch \ - %D%/packages/patches/exim-CVE-2017-16944.patch \ - %D%/packages/patches/exim-CVE-2017-1000369.patch \ %D%/packages/patches/exiv2-CVE-2017-14860.patch \ %D%/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch \ %D%/packages/patches/fastcap-mulGlobal.patch \ diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm index b9656c7dd8..114b1a21bb 100644 --- a/gnu/packages/mail.scm +++ b/gnu/packages/mail.scm @@ -1034,7 +1034,7 @@ delivery.") (define-public exim (package (name "exim") - (version "4.89") + (version "4.89.1") (source (origin (method url-fetch) @@ -1042,12 +1042,9 @@ delivery.") version ".tar.bz2") (string-append "ftp://ftp.exim.org/pub/exim/exim4/old/exim-" version ".tar.bz2"))) - (patches (search-patches "exim-CVE-2017-16943.patch" - "exim-CVE-2017-16944.patch" - "exim-CVE-2017-1000369.patch")) (sha256 (base32 - "1c0syp7yxngmq7y8vqsrvijinzin5m941vn0ljihdfld7kh2wbwi")))) + "133sjkcm9wlhpcxflr5v865varc1995bqa1y3vjs1w6zc34kp18w")))) (build-system gnu-build-system) (inputs `(("bdb" ,bdb) diff --git a/gnu/packages/patches/exim-CVE-2017-1000369.patch b/gnu/packages/patches/exim-CVE-2017-1000369.patch deleted file mode 100644 index a67a8afb0e..0000000000 --- a/gnu/packages/patches/exim-CVE-2017-1000369.patch +++ /dev/null @@ -1,59 +0,0 @@ -Fix CVE-2017-1000369: - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369 -https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - -Patch adapted from upstream source repository: - -https://git.exim.org/exim.git/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21 - -From 65e061b76867a9ea7aeeb535341b790b90ae6c21 Mon Sep 17 00:00:00 2001 -From: "Heiko Schlittermann (HS12-RIPE)" <hs@schlittermann.de> -Date: Wed, 31 May 2017 23:08:56 +0200 -Subject: [PATCH] Cleanup (prevent repeated use of -p/-oMr to avoid mem leak) - ---- - doc/doc-docbook/spec.xfpt | 3 ++- - src/src/exim.c | 19 +++++++++++++++++-- - 2 files changed, 19 insertions(+), 3 deletions(-) - -diff --git a/src/src/exim.c b/src/src/exim.c -index 67583e58..88e11977 100644 ---- a/src/exim.c -+++ b/src/exim.c -@@ -3106,7 +3106,14 @@ for (i = 1; i < argc; i++) - - /* -oMr: Received protocol */ - -- else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i]; -+ else if (Ustrcmp(argrest, "Mr") == 0) -+ -+ if (received_protocol) -+ { -+ fprintf(stderr, "received_protocol is set already\n"); -+ exit(EXIT_FAILURE); -+ } -+ else received_protocol = argv[++i]; - - /* -oMs: Set sender host name */ - -@@ -3202,7 +3209,15 @@ for (i = 1; i < argc; i++) - - if (*argrest != 0) - { -- uschar *hn = Ustrchr(argrest, ':'); -+ uschar *hn; -+ -+ if (received_protocol) -+ { -+ fprintf(stderr, "received_protocol is set already\n"); -+ exit(EXIT_FAILURE); -+ } -+ -+ hn = Ustrchr(argrest, ':'); - if (hn == NULL) - { - received_protocol = argrest; --- -2.13.1 - diff --git a/gnu/packages/patches/exim-CVE-2017-16943.patch b/gnu/packages/patches/exim-CVE-2017-16943.patch deleted file mode 100644 index 3a3e5d27fa..0000000000 --- a/gnu/packages/patches/exim-CVE-2017-16943.patch +++ /dev/null @@ -1,65 +0,0 @@ -Fix CVE-2017-16943: - -https://bugs.exim.org/show_bug.cgi?id=2199 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16943 - -Patch copied from upstream source repository: - -https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde - -From 4090d62a4b25782129cc1643596dc2f6e8f63bde Mon Sep 17 00:00:00 2001 -From: Jeremy Harris <jgh146exb@wizmail.org> -Date: Fri, 24 Nov 2017 20:22:33 +0000 -Subject: [PATCH] Avoid release of store if there have been later allocations. - Bug 2199 - ---- - doc/doc-txt/ChangeLog | 4 ++++ - src/src/receive.c | 7 ++++--- - 2 files changed, 8 insertions(+), 3 deletions(-) - -#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog -#index e937ba2..a2d9339 100644 -#--- a/doc/doc-txt/ChangeLog -#+++ b/doc/doc-txt/ChangeLog -#@@ -59,6 +59,10 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for -# connection in response to HELO" was logged instead of the actual 4xx -# error for the HELO. -# -#+JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines. -#+ A crafted sequence of BDAT commands could result in in-use memory beeing -#+ freed. -#+ -# - Exim version 4.89 - ----------------- -diff --git a/src/src/receive.c b/src/src/receive.c -index 95cf13e..20672db 100644 ---- a/src/receive.c -+++ b/src/receive.c -@@ -1772,8 +1772,8 @@ for (;;) - (and sometimes lunatic messages can have ones that are 100s of K long) we - call store_release() for strings that have been copied - if the string is at - the start of a block (and therefore the only thing in it, because we aren't -- doing any other gets), the block gets freed. We can only do this because we -- know there are no other calls to store_get() going on. */ -+ doing any other gets), the block gets freed. We can only do this release if -+ there were no allocations since the once that we want to free. */ - - if (ptr >= header_size - 4) - { -@@ -1782,9 +1782,10 @@ for (;;) - header_size *= 2; - if (!store_extend(next->text, oldsize, header_size)) - { -+ BOOL release_ok = store_last_get[store_pool] == next->text; - uschar *newtext = store_get(header_size); - memcpy(newtext, next->text, ptr); -- store_release(next->text); -+ if (release_ok) store_release(next->text); - next->text = newtext; - } - } --- -1.9.1 - diff --git a/gnu/packages/patches/exim-CVE-2017-16944.patch b/gnu/packages/patches/exim-CVE-2017-16944.patch deleted file mode 100644 index e4e8313c9c..0000000000 --- a/gnu/packages/patches/exim-CVE-2017-16944.patch +++ /dev/null @@ -1,87 +0,0 @@ -Fix CVE-2017-16944: - -https://bugs.exim.org/show_bug.cgi?id=2201 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16944 - -Patch copied from upstream source repository: - -https://git.exim.org/exim.git/commit/4804c62909a62a3ac12ec4777ebd48c541028965 - -From 4804c62909a62a3ac12ec4777ebd48c541028965 Mon Sep 17 00:00:00 2001 -From: "Heiko Schlittermann (HS12-RIPE)" <hs@schlittermann.de> -Date: Mon, 27 Nov 2017 22:42:33 +0100 -Subject: [PATCH] Chunking: do not treat the first lonely dot special. - CVE-2017-16944, Bug 2201 - -(cherry picked from commit 178ecb70987f024f0e775d87c2f8b2cf587dd542) - -Change log update - -(cherry picked from commit b488395f4d99d44a950073a64b35ec8729102782) ---- - doc/doc-txt/ChangeLog | 6 +++++- - src/src/receive.c | 2 +- - src/src/smtp_in.c | 7 +++++++ - 3 files changed, 13 insertions(+), 2 deletions(-) - -#diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog -#index a2d9339..541ebaf 100644 -#--- a/doc/doc-txt/ChangeLog -#+++ b/doc/doc-txt/ChangeLog -#@@ -61,7 +61,11 @@ JH/30 Fix a logging bug on aarch64: an unsafe routine was previously used for -# -# JH/34 Bug 2199: fix a use-after-free while reading smtp input for header lines. -# A crafted sequence of BDAT commands could result in in-use memory beeing -#- freed. -#+ freed. CVE-2017-16943. -#+ -#+HS/03 Bug 2201: Fix checking for leading-dot on a line during headers reading -#+ from SMTP input. Previously it was always done; now only done for DATA -#+ and not BDAT commands. CVE-2017-16944. -# -# -# Exim version 4.89 -diff --git a/src/src/receive.c b/src/src/receive.c -index 20672db..2812ea2 100644 ---- a/src/receive.c -+++ b/src/receive.c -@@ -1827,7 +1827,7 @@ for (;;) - prevent further reading), and break out of the loop, having freed the - empty header, and set next = NULL to indicate no data line. */ - -- if (ptr == 0 && ch == '.' && (smtp_input || dot_ends)) -+ if (ptr == 0 && ch == '.' && dot_ends) - { - ch = (receive_getc)(GETC_BUFFER_UNLIMITED); - if (ch == '\r') -diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c -index 1b45f84..0207540 100644 ---- a/src/smtp_in.c -+++ b/src/smtp_in.c -@@ -4955,16 +4955,23 @@ while (done <= 0) - DEBUG(D_receive) debug_printf("chunking state %d, %d bytes\n", - (int)chunking_state, chunking_data_left); - -+ /* push the current receive_* function on the "stack", and -+ replace them by bdat_getc(), which in turn will use the lwr_receive_* -+ functions to do the dirty work. */ - lwr_receive_getc = receive_getc; - lwr_receive_ungetc = receive_ungetc; -+ - receive_getc = bdat_getc; - receive_ungetc = bdat_ungetc; - -+ dot_ends = FALSE; -+ - goto DATA_BDAT; - } - - case DATA_CMD: - HAD(SCH_DATA); -+ dot_ends = TRUE; - - DATA_BDAT: /* Common code for DATA and BDAT */ - if (!discarded && recipients_count <= 0) --- -1.9.1 - |