lp://qastaging/~james-page/ubuntu/hardy/mailman/fix-659975

Branch merges

Propose for merging

No branches dependent on this one.

Merged into lp://qastaging/ubuntu/hardy/mailman

Mathias Gug: Approve on 2010-11-04

Chuck Short: Pending requested 2010-11-04

Ubuntu Development Team: Pending requested 2010-10-18

Diff: 513 lines (+488/-0)

3 files modified

debian/changelog (+7/-0)
debian/email-2.5.8-patches/email/_parseaddr.py (+478/-0)
debian/rules (+3/-0)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #659975: mailman breaks CC field incorrectly when spread over multiple lines

Low

Fix Released

Link a bug report

Related blueprints

17. By James Page on 2010-10-18

Patched bundled python-2.5.8 email package to correctly parse
email addresses (LP: #659975)

16. By Emanuele Gentili on 2008-03-07

* debian/control:
 + updated maintainer field
* SECURITY UPDATE:
 + debian/patches/100_CVE-2008-0564.dpatch (LP: #199338)
  - Multiple cross-site scripting (XSS) vulnerabilities in Mailman
    before 2.1.10b1 allow remote attackers to inject arbitrary web
    script or HTML via unspecified vectors related to (1) editing
    templates and (2) the list's "info attribute" in the web
    administrator interface.
* References
 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0564
 + http://bugs.gentoo.org/show_bug.cgi?id=208710

15. By Thijs Kinkhorst on 2007-12-04

* Drop suggests for obsolete python-*-codecs and drop versioned
  dependencies for pre-oldstable versions.
* Fix formatting of man pages (Closes: #432848).
* Fix some bashisms in Debian packaging scripts.
* Do not make /var/log/mailman world-readable, because it can contain
  a bit of semi-private information. Thanks Alexander Gerasiov.
  (Closes: #450927)
* After logrotate, call 'mailmanctl reopen' instead of sending SIGHUP
  since that is the supported way of rotating logs (Closes: #424620).
* Fix pidfile location in mailman.init, thanks Peter Rabbitson
  (Closes: #439325).
* Make symlinks to /var/lo{g,ck}/mailman absolute, because the relative
  ones cause trouble on systems where people move these things around
  (Closes: #408855, #413604). Override lintian since this is allowed by
  policy.
* Checked for policy 3.7.3, no changes required. Additional packaging
  cleanups.

14. By Thijs Kinkhorst on 2007-06-11

[ Thijs Kinkhorst ]
* Added Portuguese debconf translation by Miguel Figueiredo
  (Closes: #414365).
* Make sure Mailman can be properly purged (Closes: #421676).
* Remove obsolete upgrading code.
* Do not break upgrades in case python is temporarily unavailable
  (Closes: #419563).

[ Lionel Elie Mamane ]
* Avoid implicit-sort-on-load of indexes being converted to Unicode
  (hopefully really closes: #412142 now)

13. By Lionel Elie Mamane <email address hidden> on 2007-02-28

Upgrade subject and author indexes of _all_ archiving volumes to
Unicode strings. (completely closes: #412142)

12. By Martin Pitt on 2006-12-19

* Merge from debian unstable, remaining changes:
  - debian/control: exim4 -> postfix.

11. By Martin Pitt on 2006-10-30

* Synchronize to Debian; remaining Ubuntu change:
  - debian/control: exim4 -> postfix.

10. By Martin Pitt on 2006-09-12

* SECURITY UPDATE: XSS.
* Add debian/patches/security-CVE-2006-3636-XSS.dpatch:
  - Fix various cross-site scripting vulnerabilities.
  - Patch backported from svn head, thanks to Barry Warsaw for preparing it.
  - CVE-2006-3636
* Add debian/patches/security-CVE-2006-2941.dpatch:
  - Scrubber.py: Do not bail out if emails' get_filename() throws a
    ValueError. This has been properly fixed in the next upstream email
    package (in Python core), but the fix is very intrusive. Thanks to Steve
    Alexander for discovering this and for the proposed patch.
  - CVE-2006-2941
  - Closes: LP#49620
* Add debian/patches/security-error_log.dpatch:
  - Check characters in URL to prevent injecting bogus messages into
    error_log.
  - Patch taken from upstream SVN:
    http://svn.sourceforge.net/viewvc/mailman?view=rev&revision=7918

9. By Martin Pitt on 2006-08-15

Merge new Debian revision; Debian adopted the init script and apache2
dependency fix, only remaining diff is the exim4->postfix dependency
change.

8. By Martin Pitt on 2006-07-03

* Merge to Debian; remaining Ubuntu changes:
  - debian/mailman.init: Create /var/{run,lock}/mailman.
  - debian/control: exim4 -> postfix.
* debian/control: Dependency fix: apache -> apache2.