Re: New releases of courier packages.

[email protected] Thu, 27 Aug 2015 15:45:51 +0200
Newsgroups	gmane.mail.maildrop
Message-ID	<20150827134551.GA9045@g0n>
On Thu, Aug 27, 2015 at 01:32:13PM +0200, [email protected] wrote:
> Just to not leave the Courier-Maildrop users uninformed, esp. Gentooers,
> I've posted, for now, on Gentoo Forums:
> 
> use-after-free bug maildrop still in portage
> https://forums.gentoo.org/viewtopic-t-1027610.html
> 
> On Thu, Aug 27, 2015 at 10:46:27AM +0200, [email protected] wrote:
> > See further below.
> > 
> > On Mon, Apr 27, 2015 at 08:57:35PM -0400, Sam Varshavchik wrote:
> > > Download: http://www.courier-mta.org/download.html
> > > 
> > > New releases, of courier, courier-unicode, courier-imap, sqwebmail,
> > > maildrop, and cone packages.
...
> > > 
> > > • A use-after-free bug in sqwebmail was fixed; occurs only in case of a
> > > hardware disk failure, or running out of disk space.
> > > 
...
> > 
> > So, if I'm not wrong, and if other Gentoo users of Maildrop are eager for this
> > issue to be fixed, they can investigate themselves and file a bug themselves,
> > as I can not promise to be able to do it very soon. I might, but I might not
> > do it at all. Of poor health and also busy these days I am.
> > 

I was mostly wrong, and I'm glad I found out myself that I was.  In
short, my ~/.mailfilter calls /usr/bin/mail upon creating new folders,
which was the case here, where I received reply from
[email protected] for which it wanted to created a folder, but
couldn't because of my grsec-hardened kernel RBAC policy that I need to
fix for that. Grsec RBAC is easy... for really advanced users ;-) and
I'm still struggling with it a little...

I'll finish explaining this issue on the forums.grsecurity.net and it
will be linked from the Gentoo Forum topic that I gave the link in
previous email, and is also found in top of this email.

It is quite possible that for the maildrop:

https://packages.gentoo.org/package/mail-filter/maildrop

there is no need for particular update (although I don't know that), as
(although I don't know that) the version is likely (because the Gentoo
guys likely know that) just fine.

I hope I have not caused much if a disruption.

Regards!
-- 
Miroslav Rovis
Zagreb, Croatia
http://www.CroatiaFidelis.hr

------------------------------------------------------------------------------

_______________________________________________
Courier-maildrop mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/courier-maildrop
signature.asc (application/pgp-signature, 819 B)