update Changelog about security fixes

[exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 389968a9033f691bb9d7c3736a51cbfcb10f7bda..8c5b7fd9cb45b7192cdfa44ed5cd10626bbcb226 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -2,6 +2,24 @@ This document describes *changes* to previous versions, that might
 affect Exim's operation, with an unchanged configuration file.  For new
 options, and new features, see the NewStuff file next to this ChangeLog.
 
 affect Exim's operation, with an unchanged configuration file.  For new
 options, and new features, see the NewStuff file next to this ChangeLog.
 

+Exim version 4.96.1
+-------------------
+
+This is a security release.
+
+JH/01 Bug 2999: Fix a possible OOB write in the external authenticator, which
+      could be triggered by externally-supplied input.  Found by Trend Micro.
+      CVE-2023-42115
+
+JH/02 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
+      be triggered by externally-controlled input.  Found by Trend Micro.
+      CVE-2023-42116
+
+JH/03 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
+      be triggered by externally-controlled input.  Found by Trend Micro.
+      CVE-2023-42114
+
+

 Exim version 4.96
 -----------------
 
 Exim version 4.96
 -----------------
 


@@ -140,6 +158,17 @@ JH/31 Bug 2886: GnuTLS: Do not free the cached creds on transport connection
       close; it may be needed for a subsequent connection.  This caused a
       SEGV on primary-MX defer.  Found/investigated by Gedalya & Andreas.
 
       close; it may be needed for a subsequent connection.  This caused a
       SEGV on primary-MX defer.  Found/investigated by Gedalya & Andreas.
 

+JH/32 Fix CHUNKING for a second message on a connection when the first was
+      rejected.  Previously we did not reset the chunking-offered state, and
+      erroneously rejected the BDAT command.  Investigation help from
+      Jesse Hathaway.
+
+JH/33 Fis ${srs_encode ...} to handle an empty sender address, now returning
+      an empty address.  Previously the expansion returned an error.
+
+HS/01 Bug 2855: Handle a v4mapped sender address given us by a frontending
+      proxy.  Previously these were misparsed, leading to paniclog entries.
+

 
 Exim version 4.95
 -----------------
 
 Exim version 4.95
 -----------------