update Changelog about security fixes

[exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 389968a9033f691bb9d7c3736a51cbfcb10f7bda..8c5b7fd9cb45b7192cdfa44ed5cd10626bbcb226 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -2,6 +2,24 @@ This document describes *changes* to previous versions, that might
 affect Exim's operation, with an unchanged configuration file.  For new
 options, and new features, see the NewStuff file next to this ChangeLog.
 
+Exim version 4.96.1
+-------------------
+
+This is a security release.
+
+JH/01 Bug 2999: Fix a possible OOB write in the external authenticator, which
+      could be triggered by externally-supplied input.  Found by Trend Micro.
+      CVE-2023-42115
+
+JH/02 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
+      be triggered by externally-controlled input.  Found by Trend Micro.
+      CVE-2023-42116
+
+JH/03 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
+      be triggered by externally-controlled input.  Found by Trend Micro.
+      CVE-2023-42114
+
+
 Exim version 4.96
 -----------------
 
@@ -140,6 +158,17 @@ JH/31 Bug 2886: GnuTLS: Do not free the cached creds on transport connection
       close; it may be needed for a subsequent connection.  This caused a
       SEGV on primary-MX defer.  Found/investigated by Gedalya & Andreas.
 
+JH/32 Fix CHUNKING for a second message on a connection when the first was
+      rejected.  Previously we did not reset the chunking-offered state, and
+      erroneously rejected the BDAT command.  Investigation help from
+      Jesse Hathaway.
+
+JH/33 Fis ${srs_encode ...} to handle an empty sender address, now returning
+      an empty address.  Previously the expansion returned an error.
+
+HS/01 Bug 2855: Handle a v4mapped sender address given us by a frontending
+      proxy.  Previously these were misparsed, leading to paniclog entries.
+
 
 Exim version 4.95
 -----------------