TK/02

[users/jgh/exim.git] / doc / doc-txt / ChangeLog

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 157433630affbab7ffa6959bf3fd02bad04e4746..d292d99ec80a2ddd8402e96d4d757fe3966610c7 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.507 2007/05/11 08:50:42 tom Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.509 2007/05/17 19:58:48 tom Exp $
 
 Change log file for Exim from version 4.21
 -------------------------------------------
@@ -28,6 +28,16 @@ PH/02 When an IPv6 address is converted to a string for single-key lookup
 TK/01 Change PRVS address formatting scheme to reflect latests BATV draft
       version.
 
+MH/01 The "spam" ACL condition code contained a sscanf() call with a %s
+      conversion specification without a maximum field width, thereby enabling
+      a rogue spamd server to cause a buffer overflow. While nobody in their
+      right mind would setup Exim to query an untrusted spamd server, an
+      attacker that gains access to a server running spamd could potentially
+      exploit this vulnerability to run arbitrary code as the Exim user.
+
+TK/02 Bugzilla 502: Apply patch to make the SPF-Received: header use
+      $primary_hostname instead of what libspf2 thinks the hosts name is.
+
 
 Exim version 4.67
 -----------------