Re: [BLFS Trac] #23241: postfix-3.11.2

"BLFS Trac" ([email protected] via blfs-book Mailing List) <[email protected]>
Newsgroups gmane.linux.lfs.beyond.book
Message-ID <[email protected]>
#23241: postfix-3.11.2
-------------------------+------------------------
 Reporter:  Bruce Dubbs  |       Owner:  blfs-book
     Type:  enhancement  |      Status:  new
 Priority:  elevated     |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+------------------------
Changes (by Douglas R. Reno):

 * priority:  normal => elevated

Comment:

 This one is now a security release:

 {{{
 Hi,

 On Mon, May 04, 2026 at 05:35:38PM +0100, Sam James wrote:
 > The most significant one here seems to be the first entry under "Fixed
 > in Postfix 3.8, 3.9, 3.10:".
 [...]
 > Fixed in Postfix 3.8, 3.9, 3.10:
 >
 >   * Bugfix (defect introduced: Postfix 2.3, date: 20050323): buffer
 >     over-read when Postfix an enhanced status code is not followed
 >     by other text. For example, "5.7.2" without text after the
 >     three-number code. This CANNOT be triggered with an SMTP or
 >     LMTP server response; is confirmed with an access(5) table and
 >     likely with a policy server response; can possibly be triggered
 >     with pipe-to-command output, header_checks(5), body_checks(5),
 >     an error(8) transport in transport_maps, or a milter response;
 >     and is confirmed with a DNSBL server TXT response while Postfix
 >     is configured with "$rbl_code $rbl_text" in rbl_reply_maps or
 >     default_rbl_reply. This could result in process termination.
 >     Problem reported by Kamil Frankowicz.

 This one got https://www.cve.org/CVERecord?id=CVE-2026-43964 assigned.

 Regards,
 Salvatore
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23241#comment:1>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.