Security bugs are reported here via bugzilla

[Eric Sandall <eric AT sandall.us>]

Quoting Seth Alan Woolley <seth AT positivism.org>:
> They are both for this:
> 
> http://www.guninski.com/exim1.html
> 
> The 4.33 fix wasn't "good enough" and so 4.34 was issued.
> 
> I didn't change the spell much though, so it should behave just like
> normal.  Maybe I missed something?  I have no machine to test exim's
> actual workings (I run sendmail so port 25's taken up).
> 
> Not sure why it was rejected though.
> 
> I found 4.34 by going to their source download folder after reading the
> gentoo security announcement.  I often beat them, but this time they
> have an inside track to exim releases, I guess.
> 
> I too noticed no official release on their website.  I figure they will
> announce when they are done fixing all the problems.  In the meantime,
> we're bleeding edge.  I'd rather not risk leaving our boxes open. 
> Better broken than a hole.

Thanks for the link. :)

I agree for the security. I read all their documented changes from the tarball
and nothing mentioned me needing to change any settings in exim.conf nor
anything that looks like it would cause the behaviour. I'll try this one and
see if it exhibits similar behaviour.

-sandalle

-- 
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.