-
dovecot (1:1.1.11-0ubuntu4.1) jaunty-security; urgency=low
* SECURITY UPDATE: arbitrary code execution via buffer overlows in
the Sieve plugin
- debian/patches/security-CVE-2009-3235.dpatch: increase scount size in
dovecot-sieve/src/libsieve/bc_eval.c, use snprintf in
dovecot-sieve/src/libsieve/sieve.y, use snprintf and calculate the
right length in dovecot-sieve/src/libsieve/script.c.
- CVE-2009-2632
- CVE-2009-3235
* Switch from byacc to bison to fix FTBFS with security patch
-- Marc Deslauriers <email address hidden> Thu, 24 Sep 2009 08:19:22 -0400
-
dovecot (1:1.1.11-0ubuntu4) jaunty; urgency=low
* debian/dovecot-postfix.postinst (LP: #360891):
- restart dovecot after linking certificates
- handle use case when postfix is unconfigured
+ check if /etc/postfix/main.cf exist before runing postconf
-- Ante Karamatic <email address hidden> Thu, 16 Apr 2009 15:17:45 +0200
-
dovecot (1:1.1.11-0ubuntu3) jaunty; urgency=low
[ Ante Karamatic ]
* Add SMTP-AUTH support for Outlook (login auth mechanism)
* debian/dovecot-postfix.postinst:
- merge user's custom changes from dovecot.conf (LP: #339966)
[ Mathias Gug ]
* properly support package upgrades.
* handle reinstallation of package if it wasn't purged. Based on Ante's
patch:
+ debian/dovecot-postfix.postinst, debian/dovecot-posftix.postrm:
- rename configuration name on remove, delete on purge
+ debian/dovecot-postfix.dirs
- create backup directory for postfix's configuration
-- Mathias Gug <email address hidden> Tue, 31 Mar 2009 18:43:06 -0400
-
dovecot (1:1.1.11-0ubuntu2) jaunty; urgency=low
* debian/dovecot-postfix.postinst:
- fix certificates paths in postfix' main.cf
- add reject_unauth_destination to postfix' recipient restrictions
- add reject_unknown_sender_domain to postfix' sender restrictions
* debian/patches/dovecot-postfix.conf.patch:
- enable sieve plugin
* debian/control:
- set Architecture all for dovecot-postfix (LP: #329878)
* debian/rules:
- build architecure independent packages too
-- Ante Karamatic <email address hidden> Sat, 14 Feb 2009 09:03:34 +0000
-
dovecot (1:1.1.11-0ubuntu1) jaunty; urgency=low
[ Ante Karamatic ]
Add new binary pkg dovecot-postfix that integrates postfix and dovecot
automatically: (LP: #164837)
- debian/control:
+ add new binary with short description.
- debian/dovecot-postfix.postinst:
+ create initial certificate symlinks to snakeoil.
+ set up postfix with postconf to:
- use Maildir/ as the default mailbox.
- use dovecot as the sasl authentication server.
- use dovecot LDA (deliver).
- use tls for smtp{d} services.
+ restart postfix and dovecot.
- debian/dovecot-postfix.postrm:
+ remove all dovecot related configuration from postfix.
+ restart postfix and dovecot.
- debian/dovecot-common.init:
+ check if /etc/dovecot/dovecot-postfix.conf exists and use it
as the configuration file if so.
- debian/patches/warning-ubuntu-postfix.dpatch
+ add warning about dovecot-postfix.conf in dovecot default
configuration file.
- debian/patches/dovecot-postfix.conf.diff:
+ Ubuntu server custom changes to the default dovecot configuration for
better integration with postfix:
- enable imap, pop3, imaps, pop3s and managesieve by default.
- enable dovecot LDA (deliver).
- enable SASL auth socket in postfix private directory.
- debian/rules:
+ copy, patch and install dovecot-postfix.conf in /etc/dovecot/.
[ Mathias Gug ]
* New upstream release:
* Update dovecot-managesieve to 0.10.5. Fixes:
- check if names of sieve scripts contain '/' (LP: #307291)
* Update dovecot-managesieve patch for 1.1.11 and 0.10.5.
* Update dovecot-sieve plugin to 1.1.6.
* Merge from debian experimental, remaining changes:
- Use Snakeoil SSL certificates by default.
+ debian/control: Depend on ssl-cert
+ debian/paptches/ssl-cert-snakeoil.dpatch: Change default SSL cert
paths to snakeoil.
+ debian/dovecot-common.postinst: Relax grep for SSL_* a bit.
- Add autopkgtest in debian/tests/*.
- debian/dovecot-common.init: Check to see if there is an /etc/inetd.conf.
(LP: #208411)
- Fast TearDown: Update lsb init header to not stop in level 6.
- Add status action to the init script:
+ debian/control: Depend on lsb >= 3.2.12ubuntu3.
+ debian/dovecot-common-init: Add the 'status' action (LP: #247096).
- debian/rules:
- Copy config.{guess,sub} after running libtoolize.
- Clean dovecot-managesieve directory.
- Add ufw integration:
- Created debian/dovecot-common.ufw.profile
- debian/rules:
+ install profile
- debian/control
+ Suggest ufw
- debian/{control,rules}: enable PIE hardening.
- Updated dovecot.common.README.Debian with information on what has changed
between 1.0 and 1.1.1. Fixes (LP: #257625)
- dovecot-imapd, dovecot-pop3: Replaces dovecot-common (<< 1:1.1). LP: #254721.
- debian/control:
+ Update Vcs-* headers.
* debian/rules:
- Create emtpy stamp.h.in files in dovecot-sieve/ and dovecot-managesieve/
if they're not there since empty files are not included in the diff.gz
file.
* Dropped:
- debian/patches/fix-message-parser.dpatch: Parsing an invalid message
address like "From: (" caused an assert-crash. (LP: #290901).
(CVE-2008-4907 - fixed in 1.1.6)
- debian/patches/login-max-process-count-warning.dpatch: Tell the user
that they have reached the maximum number of processes count.
(LP: #189616) - Different implementation from upstream.
- debian/patches/fix-dovecot-sieve.dpatch: Fixes assertion error
when a header string ends with a LF (LP: #264306). Implemented upstream.
- Don't fail in postinst if dovecot-{sql,ldap} is missing. (LP: #153161)
dovecot (1:1.1.9-1) experimental; urgency=low
[ Fabio Tranchitella ]
* debian/control: dovecot-common suggests ntp.
[ Joel Johnson ]
* New upstream release
* updated managesieve patch to apply against new version
dovecot (1:1.1.8-1) experimental; urgency=low
* New upstream release.
* debian/control: added LDA to the description of dovecot-common.
dovecot (1:1.1.7-1) experimental; urgency=low
* New upstream release
* Updated dovecot-ssh.patch for new release
* Updated MANAGESIEVE to 0.10.4
* Fix package to support double compilation
- Properly clean dovecot-managesieve as pointed out by Stephan Bosch
- Add --copy directive to automake invocation
-- Mathias Gug <email address hidden> Thu, 12 Feb 2009 21:45:09 -0500
-
dovecot (1:1.1.4-0ubuntu1.2) intrepid-security; urgency=low
* SECURITY UPDATE: denial of service via malformed headers.
- debian/patches/fix-message-parser.dpatch: Parsing an invalid message
address like "From: (" caused an assert-crash. (LP: #290901).
- CVE-2008-4907
-- Mathias Gug <email address hidden> Wed, 05 Nov 2008 15:30:16 -0500
-
dovecot (1:1.1.4-0ubuntu1) intrepid; urgency=low
* New upstream release (LP: #281423):
- Fix message parser.
- Fix maildirlock utility.
- Fix bzip2 support in zlib plugin.
- mbox: Several bugfixes causing errors and crashes.
- Many error handling fixes and log message improvements.
- SORT: Fix assert-crashes.
* Update dovecot-managesieve patch for 1.1.4.
* debian/control:
- Update Vcs-* headers.
* Merge from debian experimental, remaining changes:
- Use Snakeoil SSL certificates by default.
+ debian/control: Depend on ssl-cert
+ debian/paptches/ssl-cert-snakeoil.dpatch: Change default SSL cert
paths to snakeoil.
+ debian/dovecot-common.postinst: Relax grep for SSL_* a bit.
- Add autopkgtest in debian/tests/*.
- Don't fail in postinst if dovecot-{sql,ldap} is missing. (LP: #153161)
- debian/dovecot-common.init: Check to see if there is an /etc/inetd.conf.
(LP: #208411)
- debian/patches/login-max-process-count-warning.dpatch: Tell the user
that they have reached the maximum number of processes count.
(LP: #189616)
- Fast TearDown: Update lsb init header to not stop in level 6.
- Add status action to the init script:
+ debian/control: Depend on lsb >= 3.2.12ubuntu3.
+ debian/dovecot-common-init: Add the 'status' action (LP: #247096).
- debian/rules:
- Copy config.{guess,sub} after running libtoolize.
- Clean dovecot-managesieve directory.
- debian/patches/fix-dovecot-sieve.dpatch: Fixes assertion error
when a header string ends with a LF (LP: #264306)
- Add ufw integration:
- Created debian/dovecot-common.ufw.profile
- debian/rules:
+ install profile
- debian/control
+ Suggest ufw
- debian/{control,rules}: enable PIE hardening
- Updated dovecot.common.README.Debian with information on what has changed
between 1.0 and 1.1.1. Fixes (LP: #257625)
- dovecot-imapd, dovecot-pop3: Replaces dovecot-common (<< 1:1.1). LP: #254721.
* Dropped:
- debian/dovecot-common.postinst: Remove stop script symlinks fom rc0
and rc6 on upgrades. Need to be kept until next LTS release.
- Fast TearDown:
+ debian/rules: Call dh_installinit in 'multiuser' mode.
+ debian/control: Depend on new sysv-rc for this.
- Include dovecot-sieve-1.1.5: available in Debian.
-- Mathias Gug <email address hidden> Fri, 10 Oct 2008 16:05:33 -0400
