==========================================================================
Ubuntu Security Notice USN-4621-1
November 05, 2020

netqmail vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

netqmail could be made to crash if it received specially crafted
input.

Software Description:
– netqmail: a secure, reliable, efficient, simple message transfer agent

Details:

It was discovered that netqmail did not properly handle certain input. Both
remote and local attackers could use this vulnerability to cause netqmail
to crash or execute arbitrary code. (CVE-2005-1513, CVE-2005-1514,
CVE-2005-1515)

It was discovered that netqmail did not properly handle certain input when
validating email addresses. An attacker could use this to bypass email
address validation. (CVE-2020-3811)

It was discovered that netqmail did not properly handle certain input when
validating email addresses. An attacker could use this vulnerability to
cause netqmail to disclose sensitive information. (CVE-2020-3812)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
qmail 1.06-6.2~deb10u1build0.18.04.1

Ubuntu 16.04 LTS:
qmail 1.06-6.2~deb10u1build0.16.04.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4621-1
CVE-2005-1513, CVE-2005-1514, CVE-2005-1515, CVE-2020-3811,
CVE-2020-3812

Package Information:
https://launchpad.net/ubuntu/+source/netqmail/1.06-6.2~deb10u1build0.18.04.1
https://launchpad.net/ubuntu/+source/netqmail/1.06-6.2~deb10u1build0.16.04.1
—–BEGIN PGP SIGNATURE—–

iQIzBAABCgAdFiEEkCdEQ5T6DutSveCybUp5kL3izGYFAl+lSCIACgkQbUp5kL3i
zGaVKg/+NI5Nr4jlPUoHcglB71zvmfAgqLDoViGI9hk6dU1bUb+5PkzYKVbFBT3t
50saICkri03ouLMVkwa4/7GSqfJs1KANSC6mH/vsrX0QWX0MpjSHeLkLol+XCJZ+
LIIVQ9rXieomHLOzIc9aV2SmrsUddrZDcMzfPgkNYWZ8D6DMT1hZBRGFvEdXYKQz
TXl0NJMpXJiahp/f6vCiqxFDCK3l5d427EUOl+XHg9Vrxt71qG2R6zbnXRSWw3A6
EoWp3XmpA2r2Cvpn5upfM5FPxGiodltA8Lem1my0qRzF0y3U8Ip/mX5eETYkPZto
QI5dVmyu9XD6kexZ+2EBzbfOFzwkHsPlpy7Hg945RD60Mhp0ATbPkWq4yDuxTma3
lNbpMEAPMKWsM8Z7nJDZfLfdszgcLUT548QQ11kkKw1DRHykvj91nW2lhJZgpQ3u
XUPiIIsYnG19aSqdCuJzVX5aay3tPvM+yyPBwv6sqNHYnfbpQlT/YNXp1XdvAxaS
LqIprQpXcpoLzR69gsVDfh/zhGvoE0yYSPMqNVHKvTR94wWyGu17ntz5KdQKU+SV
fzguv9KB2bXV9yn5+mU60T7d7A8xZuM7ord9ZuwLGkBZGTrUAH2ysCjdwXOhNZrs
8LD7XsCRpWACh6ZRqPLqHW9aLZPba3cxLPHdPAorgK0TcUkopS8=
=fsxI
—–END PGP SIGNATURE—–
—