Movemail security issue (fix in SXEmacs?)
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2003 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2002 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2001 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2000 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 1999 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 1998 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
Hi,
Out of pure curtesy, I'm bringing this to your attention:
http://bastard.youngs.au.com/pipermail/sxemacs-patches/2005-February/0001...
There you should find all the reference urls you need to judge whether
this is a vulnerability issue (one line patch, or so) or not. I'm not
really sure myself. This is not the same issue as was patched for GNU
Emacs, but similar.
Johann
--
This line is left blank intentionally
>>>> "Johann" == Johann Oskarsson <Johann>
writes:
Johann>
http://bastard.youngs.au.com/pipermail/sxemacs-patches/2005-February/0001...
This is the CAN-2005-0100 vulnerability, right?
In 21.4.17 and 21.5.19:
2005-01-29 Vin Shelton <acs(a)xemacs.org>
* movemail.c (popmail): Pass error string as format parameter
instead of as part of format string. Security fixes for
CAN-2005-0100.
Thanks for the notification!
--
Institute of Policy and Planning Sciences http://turnbull.sk.tsukuba.ac.jp
University of Tsukuba Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
Ask not how you can "do" free software business;
ask what your business can "do for" free software.
* Stephen J Turnbull <stephen(a)xemacs.org> writes:
>>>>> "Johann" == Johann Oskarsson
<Johann> writes:
Johann>
http://bastard.youngs.au.com/pipermail/sxemacs-patches/2005-February/0001...
This is the CAN-2005-0100 vulnerability, right?
Yep.
In 21.4.17 and 21.5.19:
2005-01-29 Vin Shelton <acs(a)xemacs.org>
* movemail.c (popmail): Pass error string as format parameter
instead of as part of format string. Security fixes for
CAN-2005-0100.
Yes. We have this change in SXEmacs. Well, almost. I just looked at
it again and it would seem that I missed one hunk out of Vin's patch
when I synched it across. Oops. :-(
OK, bottom line, XEmacs people can totally ignore this. SXEmacs people
should give me a kick up the arse for blowing the sync.
Johann, good catch! Thanks man.
--
|---<Steve Youngs>---------------<GnuPG KeyID: A94B3003>---|
| In space, |
| No one can hear you rip a stinky |
|------------------------------------<steve(a)sxemacs.org>---|
7212
days inactive
7212
days old
2 comments
3 participants
tags (0)
participants (3)
-
Johann 'Myrkraverk' Oskarsson -
Stephen J. Turnbull -
Steve Youngs