package: pound
severity: important
Pound 1.8.2 currently in Sarge is considered beta and contains numerous
bugs including a buffer overflow.
Please unfreeze pound to get much-needed bugfixes. New upstream
versions 1.8.5, 1.8.4, 1.8.3 are interim bugfix releases that fix all
known bugs and is highly recommended over 1.8.2.
File: http://www.apsis.ch/pound/Pound-1.8.5.tgz
Signed: http://www.apsis.ch/pound/Pound-1.8.5.asc
Signature: http://www.apsis.ch/pound/roseg.asc
Specifically, the change in 1.8.3 fixes bug #307852: CAN-2005-1391.
And the change in 1.8.5 may fix bug #263578.
Changelogs for 1.8.5, 1.8.4 and 1.8.3 are as follows:
Changes in Pound v1.8.5, primarily a bug-fix interim release:
- added a CRLlist configuration directive. This allows putting the CRL
in a separate file (as opposed to the CAlist). Probably cleaner that
way.
- tweaked the final SSL_shutdown - some people have complained that it
caused problems with non-MS browsers and/or WebDAV clients. Let me know
how it works.
Changes in Pound v1.8.4, primarily a bug-fix interim release:
- added a -c run-time switch (check-only). Running Pound with this flag
will cause it to process the config file and exit immediately
afterwards.
- added a -v run-time switch (verbose). Running Pound with this flag
will cause it to show error messages to the standard error even if the
program was configured to use syslog, at least until the program
"daemonizes" itself. This allows you to see on screen any errors that
may occur while processing the config file and early run-time errors
(conflicting ports, etc).
- based on ideas from various people here modified the pid file
mechanism: instead of creating a file pound_pid.nnn Pound will now
append its process number to a file called pound.pid (fixed name). The
file may contain more than one pid if you have multiple Pound instances.
Changes in Pound v1.8.3, primarily a bug-fix interim release:
- fixed a potential buffer overflow problem (thanks to Steven Van Acker
for bringing it to my attention). Hopefully this is the last sprintf we
have missed.
- RewriteRedirect 2 ignores port value for host matching (suggested by
Frank Schmirle)
- Minor "cosmetic" fixes (suggested by Frank Schmirler)
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
