[BACK]Return to errata65.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata65.html between version 1.25 and 1.26

version 1.25, 2020/01/28 21:30:52 version 1.26, 2020/02/24 16:27:53
Line 412 
Line 412 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
   <li id="p031_smtpd_envelope">
   <strong>031: SECURITY FIX: February 24, 2020</strong>
   &nbsp; <i>All architectures</i>
   <br>
   An out of bounds read in smtpd allows an attacker to inject arbitrary
   commands into the envelope file which are then executed as root.
   Separately, missing privilege revocation in smtpctl allows arbitrary
   commands to be run with the _smtpq group.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/common/031_smtpd_envelope.patch.sig">
   A source code patch exists which remedies this problem.</a>
   <p>
 </ul>  </ul>
   
 <hr>  <hr>
Legend:
Removed from v.1.25  
changed lines
  Added in v.1.26