summaryrefslogtreecommitdiff
path: root/doc/doc-txt/ChangeLog
diff options
context:
space:
mode:
authorJeremy Harris <jgh146exb@wizmail.org>2016-09-22 22:55:49 +0100
committerJeremy Harris <jgh146exb@wizmail.org>2016-09-22 22:55:49 +0100
commit92b0827a90559a266bd00662d842b643ac8bdc81 (patch)
treed74deb3c96ddd432246be5bbf902440bf8e422da /doc/doc-txt/ChangeLog
parentd1f9fb42472323edb17c3ee3cbbfce3557083ceb (diff)
Defend against symlink attack by another process running as exim
Reported-by: http://www.halfdog.net/Security/2016/DebianEximSpoolLocalRoot/
Diffstat (limited to 'doc/doc-txt/ChangeLog')
-rw-r--r--doc/doc-txt/ChangeLog5
1 files changed, 5 insertions, 0 deletions
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index b920d92cc..28007d01f 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -99,6 +99,11 @@ JH/26 Fix problem with one_time used on a redirect router which returned the
delivered, so not attempt the (identical) child. As a result mail would
be lost.
+JH/27 Fix a possible security hole, wherein a process operating with the Exim
+ UID can gain a root shell. Credit to http://www.halfdog.net/ for
+ discovery and writeup. Ubuntu bug 1580454; no bug raised against Exim
+ itself :(
+
Exim version 4.87
-----------------