summaryrefslogtreecommitdiff
path: root/mail/fetchmail
AgeCommit message (Collapse)AuthorFilesLines
2010-02-14document that mail/fetchmailconf reaches over heretnn1-1/+2
2010-02-14Update to 6.3.14:wiz2-6/+6
fetchmail 6.3.14 (released 2010-02-05, 25487 LoC): # SECURITY FIXES * SSL/TLS certificate information is now also reported properly on computers that consider the "char" type signed. Fixes malloc() buffer overrun. Workaround for older versions: do not use verbose mode. See fetchmail-SA-2010-01.txt for details, including a minimal patch. # BUG FIXES * The IMAP client no longer skips messages from several IMAP servers including Dovecot if fetchmail's "idle" is in use. Causes were that fetchmail (a) ignored some untagged responses when it should not (b) relied on EXISTS messages in response to EXPUNGE, which aren't mandated by RFC-3501 (the IMAP standard) and aren't sent by Dovecot either. Fix by Sunil Shetye (the fix also consolidates IMAP response handling, improving overall robustness of the IMAP client), bug report and testing by Matt Doran, with further hints from Timo Sirainen. * The SMTP client now recovers from errors (such as servers dropping the connection after errors) when sending an RSET command. Fix by Sunil Shetye. Report by James Moe. * The IMAP client now uses "SEARCH UNSEEN" rather than "SEARCH UNSEEN NOT DELETED" again on IMAP2, to fix a regression in fetchmail 6.2.5 reported by Will Stringer in June 2004. (Sunil Shetye) * The IMAP client now uses "SEARCH UNSEEN UNDELETED" on IMAP4 and IMAP4r1 servers (Sunil Shetye). * Workaround: The IMAP client now falls back to "FETCH n:m FLAGS" if the server does not support "SEARCH". (Sunil Shetye) * The IMAP client now requests message numbers in batches of 1,000 to avoid problems if there are more than 1860 unseen messages. (Sunil Shetye) Note that this wasn't security relevant because fetchmail would only read up to the maximum buffer size and leave the remainder of the string unread, going out of synch afterwards. * Stricter validation of IMAP responses containing byte or message counts. # CHANGES * Only include gssapi.h if we're not including gssapi/gssapi.h, to fix a FreeBSD compiler warning about gssapi.h being obsolete. # DOCUMENTATION * The README.SSL document was revised for grammar, spelling, and clarity. Courtesy of Robert Mullin. fetchmail 6.3.13 (released 2009-10-30, 25333 LoC): # REGRESSION FIXES * The multiline SMTP error fix in release 6.3.12 caused fetchmail to lose message codes 400..599 and treat all of these as temporary error. This would cause messages to be left on the server even if softbounce was turned off. Reported by Thomas Jarosch. fetchmail 6.3.12 (released 2009-10-05): # REGRESSION FIXES * The CVS-2009-2666 fix in fetchmail release 6.3.11 caused a free() of unallocated memory on SSL connections, which caused crashes or program aborts on some systems (depending on how initialization and free() of unallocated memory is handled in compiler and libc). Workaround for older versions: run in verbose mode. Patch courtesy of Thomas Heinz, fixes Gentoo Bug #280760. This regression affected only the 6.3.11 release, but not the patch that was part of the security announcement fetchmail-SA-2009-01. # BUG FIXES * Fix error reporting for GSSAPI on Heimdal (h5l) Kerberos. * Look for MD5_Init in libcrypto rather than libssl, fixes Gentoo Kerberos builds; fixes upstream parts of Gentoo Bugs #231400 and #185652, and fixes BerliOS Bug #16134. * Report multiline SMTP errors properly, reported by Earl Chew; fixes Debian Bug #529899, reported by Akihiro Terasaki. Note: This fix introduced a regression, fixed in 6.3.13. * Replace control characters in SMTP replies by '?'. * Fetchmailconf: Fix descriptions for smtpaddress and smtpname options; smtpaddress is for RCPT TO, not MAIL FROM. Found by Gerard Seibert. ...as well as translation updates in all three releases.
2009-08-10Update "fetchmail" package to version 6.3.11. Changes since version 6.3.8:tron5-61/+22
- Security fixes for CVE-2009-2666, CVE-2007-4565 and CVE-2008-2711. - Fetchmail no longer drops permanently undelivered messages by default, to match historic documentation. It does this by adding a new "softbounce" option. - A lot bug fixes and improvements.
2009-06-14Remove @dirrm entries from PLISTsjoerg1-2/+1
2009-05-21remove not working mirror.zafer1-3/+2
2008-06-19Add patch for CVE-2008-2711.obache3-3/+38
Taken from http://fetchmail.berlios.de/fetchmail-SA-2008-01.txt Bump PKGREVISION.
2008-04-27Set MAINTAINER to pkgsrc-users@NetBSD.org to indicate anyone can work on ↵frueauf1-2/+2
fixes for those packages.
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn1-2/+2
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2008-01-05Added support for installation to DESTDIR.heinz1-3/+4
2007-11-07Remove "inet6" option. The "configure" script doesn't recognizetron1-9/+2
"--enable-inet6" or "--disble-inet6 anymore and decides automatically whether to enable IPv6 support. Pointed out by Matthias Andree in private e-mail.
2007-09-23Add fix for security vulnerability reported in CVE-2007-4565.tron3-2/+17
Bump package revision.
2007-04-14Update "fetchmail" and "fetchmailconf" packages to version 6.3.8.tron2-6/+6
Changes since version 6.3.6: - Make the APOP challenge parser more distrustful and have it reject challenges that do not conform to RFC-822 msg-id format, in the hope to make mounting man-in-the-middle attacks (MITM) against APOP a bit more difficult. (CVE-2007-1558) - Fix pluralization of oversized-message warning mails. - Fix manual page: --sslcheck -> --sslcertck, and do not set trailing "recommended:" in bold. - Repoll immediately if a protocol error happens during the authentication attempt after a failed opportunistic TLS upgrade. - Fix rendering of the "24 - 26, 28, 29" paragraph in the exit codes section. - If SOCKS support was compiled in, add 'socks' to the feature_options Python list emitted in --configdump. - Do not crash with a null pointer dereference when opening the BSMTP file fails. Improve error checking and reporting. - Make BSMTP output actually work, it would persistently fail with SOCKET error after writing the first header. - Fix KPOP. - Fix repoll when server disconnects after opportunistic TLS failed for POP3.
2007-01-17Use documented trick to disable Python detection instead of patchingtron3-44/+3
"Makefile.in". Hint provided by Matthias Andree in private e-mail.
2007-01-17Add second Berlios download site to MASTER_SITES. The main one getssalo1-2/+3
overloaded from time to time.. (e.g., now).
2007-01-17Update "fetchmail" and "fetchmailconf" packages to version 6.3.6.tron12-6670/+53
The list of changes since version 6.2.5.5 is too large to mention here. The new version provides a fix for the vulnerability reported in the fetchmail-SA-2006-02.txt advisory.
2006-04-17Strip ${PKGLOCALEDIR} from PLISTs of packages that already obeyjlam1-14/+14
PKGLOCALEDIR and which install their locale files directly under ${PREFIX}/${PKGLOCALEDIR} and sort the PLIST file entries. From now on, pkgsrc/mk/plist/plist-locale.awk will automatically handle transforming the PLIST to refer to the correct locale directory.
2006-04-13BUILD_USE_MSGFMT and USE_MSGFMT_PLURALS are obsolete. Replace withjlam1-4/+2
USE_TOOLS+=msgfmt.
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg1-1/+2
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-20Update fetchmail to 6.2.5.5.frueauf7-7226/+5829
Change homepage to http://fetchmail.berlios.de/ and update MASTER_SITES. Changes introduced since 6.2.5: fetchmail-6.2.5.X is a security fix branch that forked off fetchmail-6.2.5. It does not change for anything but security and the most severe bug fixes. Note that no 6.2.5.X security audits are planned except when a particular bug is reported, and that 6.2.5.X is unsafe to use on some systems, particularly those that lack a *working and secure* snprintf implementation. The fetchmail 6.2.5.X branch will be discontinued early in 2006. fetchmail-6.2.5.5 2005-12-19 Matthias Andree * SECURITY FIX CVE-2005-4348: fix null pointer dereference in multidrop mode when the message is empty. Reported by Daniel Drake <http://article.gmane.org/gmane.mail.fetchmail.user/7573> and others (Debian Bug #343836). Fix by Sunil Shetye. * Fix Debian bug #301964, fetchmail leaks sockets when SSL negotiation fails. Fix suggested by Goswin Brederlow. * Add fetchmail-SA-2005-{01,02,03}.txt fetchmail-6.2.5.4 2005-11-13 Matthias Andree * Also ship pre-built rcfile_y.[ch] for systems that don't have flex, yacc or bison. * On FreeBSD, add /usr/local/include to CPPFLAGS so that libintl.h is found. * Avoid automatically picking up HESIOD implementations that lack hesiod_getmailhost, such as the one in FreeBSD's base system. * Fix makedepend for separated build (where the build is not run from the source directory), but prevent packaging from separated build, it yields bogus results. * Fix resolv.h autodetection. * Add +HESIOD to version printout if appropriate. fetchmail-6.2.5.3 2005-11-12 Matthias Andree * SECURITY FIX CVE-2005-3088: fetchmailconf: fix password exposure: use umask 077 before opening output file and restore umask later. * Critical fix: fix IMAP timeouts, counting message count down on servers that do not send EXISTS counts after EXPUNGE. Debian Bug#314509. * Ship pre-built rcfile_l.c for systems that don't have flex. * Build environment: Update included gettext. Fix --with-included-gettext. Fix parallel build (make -j). Fix "always rebuild fetchmail" syndrome. * Do not link against -ll or -lfl (not needed). fetchmail-6.2.5.2 (patch Fri Jul 22 01:52 GMT 2005, tarball Sat Jul 23 21:34 GMT 2005) * README: Added a note about release status - READ IT! * Note: Due to a Makefile.in bug, you may need to use GNU make. * SECURITY FIX CVE-2005-2335: truncate UIDL replies, lest malicious or compromised POP3 servers overflow fetchmail's stack. Debian bug #212762. This is a remote root exploit. Thanks: Miloslav Trmac for pointing out the fix in 6.2.5.1 was buggy. Thanks: Ludwig Nussel for a much simpler fix. * Critical fix: omit blank between MAIL FROM: and <user@example.org>, as this causes mail loss with some listeners. * Fix: POP2 driver wouldn't properly check authentication failure. * Sunil Shetye's fix to force fetchsizelimit to 1 for APOP and RPOP.
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig1-4/+4
CONFIGURE_ARGS.
2005-11-01Add patch-ak for a fetchmailconf security issue. This patch doesadrianp2-1/+48
not impact the fetchmail package so no version bump is required.
2005-10-25Add SOCKS4/SOCKS5 support.scottr1-1/+15
2005-10-21Fix mail/fetchmail under darwin (PR 28543).tonio5-3/+153
The added patches add a prefix "fm_" to lock related finctions, to avoid name clash with darwin lock functions. Link with -lresolv under darwin. (thanks scole_at_sdf.lonestar.org for the patches) Bump PKGREVISION
2005-09-28Replaced "# defined" with "yes" in Makefile variables like GNU_CONFIGURE,rillig1-3/+3
NO_BUILD, USE_LIBTOOL.
2005-07-22Include patch for fetchmail 6.2.5.2 because of CAN-2005-2335.frueauf3-3/+188
For more details have a look at http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt Changes listed within the NEWS file since 6.2.5: fetchmail-6.2.5.2 (Fri Jul 22 01:52 GMT 2005): * NOTE: Due to a Makefile.in bug, you may need to use GNU make. * SECURITY FIX: truncate UIDL replies, lest malicious or compromised POP3 servers overflow fetchmail's stack. Debian bug #212762. This is a remote root exploit. CVE Name: CAN-2005-2335. Thanks: Miloslav Trmac for pointing out the fix in 6.2.5.1 was buggy. Thanks: Ludwig Nussel for a much simpler fix. * Critical fix: omit blank between MAIL FROM: and <user@example.org>, as this causes mail loss with some listeners. * Fix: POP2 driver wouldn't properly check authentication failure. * Sunil Shetye's fix to force fetchsizelimit to 1 for APOP and RPOP.
2005-05-30Correct handling if gssapi and kerberos is defined. Proposal byfrueauf1-4/+3
Dieter Baron, tested by Jukka Salmi.
2005-05-30Avoid that "kerberos" appears more than once in PKG_OPTIONS.frueauf1-2/+2
Change suggested by Jukka Salmi.
2005-05-24transform PKG_DEFAULT_OPTIONS+= to PKG_SUGGESTED_OPTIONS. Suggested byfrueauf1-4/+2
Jukka Salmi.
2005-05-22Remove USE_TBL from pkgsrc and replace with USE_TOOLS+=tbl.jlam1-2/+2
2005-05-02RCD_SCRIPTS_EXAMPLEDIR is no longer customizable.reed1-1/+2
And always is defined as share/examples/rc.d which was the default before. This rc.d scripts are not automatically added to PLISTs now also. So add to each corresponding PLIST as required. This was discussed on tech-pkg in late January and late April. Todo: remove the RCD_SCRIPTS_EXAMPLEDIR uses in MESSAGES and elsewhere and remove the RCD_SCRIPTS_EXAMPLEDIR itself.
2005-04-21update this since patch-ae changed.frueauf1-2/+2
2005-04-21Include change described in pr/29955 which checks for $with_kerberos5frueauf1-5/+23
!= "no" instead of = "yes"
2005-04-11Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used.tv1-2/+1
2005-02-24Add RMD160 digests.agc1-1/+2
2005-01-21Remove definition of CRYPTO. It is no longer needed iffrueauf1-2/+1
PKG_USE_KERBEROS is defined, noted by Jukka Salmi.
2005-01-21Rework kerberos V support:frueauf3-114/+212
- use kerberos instead of kerberos5 as PKG_SUPPORTED_OPTIONS to keep compliance with other kerberos aware packages in pkgsrc - use the krb5 buildlink environment Introduce support for gssapi which was also requested in pr pkg/26170 with the according PKG_SUPPORTED_OPTIONS. gssapi will imply kerberos5.
2005-01-20Add option for kerberos5 like suggested in pr pkg/26170.frueauf3-3/+7489
Since I have no kerberos server I just verified it compiled.
2005-01-19fix URL for primary master site.frueauf1-2/+2
2005-01-10Remove inet6 from PKG_DEFAULT_OPTIONS. When USE_INET6 is defined it will setadrianp1-2/+2
inet6. Move to calling all such flags 'inet6'.
2004-12-28The default location of the pkgsrc-installed rc.d scripts is nowreed1-2/+2
under share/examples/rc.d. The variable name already was named RCD_SCRIPTS_EXAMPLEDIR. This is from ideas from Greg Woods and others. Also bumped PKGREVISION for all packages using RCD_SCRIPTS mechanism (as requested by wiz).
2004-11-17Remove obsolete variables. You'll want to use:xtraeme1-11/+1
PKG_OPTIONS.<pkg>+= foo blah
2004-10-03Libtool fix for PR pkg/26633, and other issues. Update libtool to 1.5.10tv1-2/+2
in the process. (More information on tech-pkg.) Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and installing .la files. Bump PKGREVISION (only) of all packages depending directly on the above via a buildlink3 include.
2004-09-15It's better to fix the configure script in pre-configure than inwiz1-2/+2
post-configure. From Masanori Mikawa in PR 26952.
2004-08-22Change the way that legacy USE_* and FOO_USE_* options are convertedjlam1-15/+14
into the bsd.options.mk framework. Instead of appending to ${PKG_OPTIONS_VAR}, it appends to PKG_DEFAULT_OPTIONS. This causes the default options to be the union of PKG_DEFAULT_OPTIONS and any old USE_* and FOO_USE_* settings. This fixes PR pkg/26590.
2004-08-05Move the setting of default options out of the section that will be deletedjlam1-2/+2
that will be deleted in the future.
2004-08-05Move options-handling into a separate file and document each option.jlam2-44/+55
2004-08-01fetchmail should be started after mail is up and running.jlam1-2/+2
2004-07-30Convert to use bsd.options.mk. The relevant options variable to setjlam1-14/+31
for each package can be determined by invoking: make show-var VARNAME=PKG_OPTIONS_VAR The old options are still supported unless the variable named in PKG_OPTIONS_VAR is set within make(1) (usually via /etc/mk.conf).
2004-07-22just require "tbl", not necessarily the whole groffdrochner1-2/+2
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-06 20:12:40 +0000