Security bugs are reported here via bugzilla

[Arwed von Merkatz <v.merkatz AT gmx.net>]

Sendmail contains a signal race vulnerability when receiving and 
processing mail data from remote clients. Sendmail utilizes a signal 
handler for dealing with timeouts that is not async-safe and
interruption 
of certain functions by this signal handler will cause static data 
elements to be left in an inconsistent state. These data elements can be 
used to write data to invalid parts of the stack (or heap in some 
scenarios), thus taking control of the vulnerable process. 

In order to exploit this vulnerability, an attacker simply needs to be 
able to connect to sendmail SMTP server. This is a multi-shot exploit, 
meaning the attacker can attempt to exploit it an indefinite amount 
of times, since sendmail spawns a new process for each connected 
client. 

For more details, see
http://xforce.iss.net/xforce/alerts/id/216

---
This applies to stable, stable-rc and test grimoires.
All systems using sendmail should update it:
# scribe update
# cast -c sendmail

or

# scribe update
# sorcery queue-security
# cast --queue

-- 
Arwed v. Merkatz                              Source Mage GNU/Linux developer
                                                    http://www.sourcemage.org

Attachment: pgppJFzY4MpIh.pgp
Description: PGP signature