Bug 166969 – mail-filter/spamassassin DoS <3.1.8 (CVE-2007-0451)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description valli 2007-02-15 08:18:38 UTC]

http://svn.apache.org/repos/asf/spamassassin/branches/3.1/build/announcements/3.1.8.txt

Reproducible: Always

[Comment 1 MATSUU Takuto (RETIRED) 2007-02-16 03:08:52 UTC]

3.1.8 contains security fix for CVE-2007-0451.

[Comment 2 Michael Cummings (RETIRED) 2007-02-16 16:22:43 UTC]

Bumped

[Comment 3 Raphael Marichez (Falco) (RETIRED) 2007-02-17 23:56:44 UTC]

Thanks;

hi arches, please test and mark stable spamassassin-3.1.8 if appropriate, thanks

[Comment 4 Jeroen Roovers (RETIRED) 2007-02-18 02:06:17 UTC]

Stable for HPPA.

[Comment 5 Markus Rothe (RETIRED) 2007-02-18 08:40:51 UTC]

ppc64 stable

[Comment 6 Alexander Færøy 2007-02-18 10:47:15 UTC]

Stable on Alpha, IA64 and MIPS.

[Comment 7 Tobias Scherbaum (RETIRED) 2007-02-18 11:12:34 UTC]

ppc stable

[Comment 8 Markus Meier 2007-02-18 12:15:47 UTC]

mail-filter/spamassassin-3.1.8  USE="berkdb ipv6 ldap ssl -doc -mysql -postgres -qmail -sqlite -tools"
1. emerges on x86
2. passes test suite
3. passes collision test
4. evolution still works with it

Portage 2.1.2-r9 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.5-r0, 2.6.19.3 i686)
=================================================================
System uname: 2.6.19.3 i686 Genuine Intel(R) CPU           T2300  @ 1.66GHz
Gentoo Base System release 1.12.9
Timestamp of tree: Sat, 17 Feb 2007 09:30:01 +0000
dev-java/java-config: 1.3.7, 2.0.31
dev-lang/python:     2.3.5-r3, 2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.14
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c"
CXXFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--nospinner"
FEATURES="autoconfig collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://mirror.switch.ch/mirror/gentoo/ http://gentoo.inode.at/"
LINGUAS="en de en_GB de_CH"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X a52 aac acpi alsa apache2 asf berkdb bitmap-fonts cairo cdr cdrom cli cracklib crypt cups dbus divx dlloader dri dts dvd dvdr dvdread eds emboss encode fam ffmpeg firefox flac fortran gdbm gif gnome gpm gstreamer gtk hal iconv ipv6 isdnlog java jpeg kde kdeenablefinal ldap libg++ mad midi mikmod mmx mono mp3 mpeg ncurses nls nptl nptlonly ogg opengl oss pam pcre perl png ppds pppd python qt3 qt4 quicktime readline reflection rtsp ruby samba sdl session smp spell spl sse sse2 sse3 ssl svg tcpd test tetex theora threads truetype truetype-fonts type1-fonts unicode vcd vorbis win32codecs wxwindows x264 x86 xine xml xorg xprint xv xvid zlib" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LINGUAS="en de en_GB de_CH" USERLAND="GNU" VIDEO_CARDS="i810 fbdev vesa"
Unset:  CTARGET, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

[Comment 9 Raúl Porcel (RETIRED) 2007-02-18 12:40:38 UTC]

x86 stable

[Comment 10 Jason Wever (RETIRED) 2007-02-18 18:39:59 UTC]

SPARC stable

[Comment 11 Malcolm Lashley (RETIRED) 2007-02-19 20:55:03 UTC]

amd64 stable, anyone for a nice cup of GLSA?

[Comment 12 Raphael Marichez (Falco) (RETIRED) 2007-02-23 17:46:40 UTC]

thanks arches,

i vote for a GLSA

[Comment 13 Matthias Geerdsen (RETIRED) 2007-02-25 19:43:07 UTC]

agreed

[Comment 14 Raphael Marichez (Falco) (RETIRED) 2007-03-02 00:36:12 UTC]

GLSA 200703-02, thanks everybody