exim4 (4.99.1-1ubuntu1.3) resolute-security; urgency=medium

  * SECURITY UPDATE: information disclosure in PROXYv2 (LP: #2154366)
    - debian/patches/202605191-security.patch: Security: fix PROXYv2
      uninitialised-stack disclosure (EXIM-Security-2026-05-16.1) in
      src/proxy.c.
    - CVE number pending

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 27 May 2026 10:15:24 -0400

exim4 (4.99.1-1ubuntu1.2) resolute-security; urgency=medium

  * SECURITY UPDATE: one-byte write into freed buffer (LP: #2152202)
    - debian/patches/202605011-security.patch: TLS: on rxd close with CHUNKING
      active, clean the input processing stack in src/functions.h,
      src/smtp_in.c, src/tls-gnu.c, src/tls-openssl.c.
    - unknown

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 11 May 2026 18:50:06 +0200

exim4 (4.99.1-1ubuntu1.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Multiple security issues
    - debian/patches/CVE-2026-4068x.patch: backported upstream fix.
    - CVE-2026-40685 - Possible OOB read/write on corrupt JSON in header
    - CVE-2026-40686 - Possible OOB read with large UTF8 trailing chars
    - CVE-2026-40687 - Possible OOB read/write with SPA authenticator

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 29 Apr 2026 12:42:33 -0400

exim4 (4.99.1-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2137544). Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
    - Disable external SPF support to avoid Build-Depends on libspf2-dev
      (only available in universe). SPF can still be implemented via
      spf-tools-perl, as documented in exim4.conf.template. This reverts
      Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
      (LP #1952738)
      + d/control: drop Build-Depends on libspf2-dev.
      + d/EDITME.exim4-heavy.diff: disable support for libspf2.
      + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
        on spfquery.mail-spf-perl from spf-tools-perl, but without
        the previously supported helo detection.

 -- Renan Rodrigo <rr@ubuntu.com>  Tue, 06 Jan 2026 09:21:12 -0300

exim4 (4.99.1-1) unstable; urgency=medium

  * Fix CVE-number in 4.99-7 changelog entry.
  * New upstream stable release (= 4.99 + fix for CVE-2025-67896).
    + Drop (misnamed) 88_07-CVE-2025-30232.diff
    + Unfuzz patches.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 21 Dec 2025 08:00:57 +0100

exim4 (4.99-7) unstable; urgency=high

  * Drop unused b-d on libident-dev, exim's RFC 1413 support is
    self-contained.
  * Add fix for CVE-2025-67896, unfuzz patches.

 -- Andreas Metzler <ametzler@debian.org>  Wed, 17 Dec 2025 18:16:25 +0100

exim4 (4.99-6) unstable; urgency=medium

  * local_scan: bump API version, for smtp_fflush().

 -- Andreas Metzler <ametzler@debian.org>  Sun, 30 Nov 2025 12:05:05 +0100

exim4 (4.99-5) unstable; urgency=medium

  * Fix grammar error in NEWS entry.
  * Cherry-pick three patches from upstream GIT master.
  * Fix string_expand() being unavailable in local_scan().
  * Bump local-scan API minor version.

 -- Andreas Metzler <ametzler@debian.org>  Thu, 27 Nov 2025 17:56:48 +0100

exim4 (4.99-4ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2126017). Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
    - Disable external SPF support to avoid Build-Depends on libspf2-dev
      (only available in universe). SPF can still be implemented via
      spf-tools-perl, as documented in exim4.conf.template. This reverts
      Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
      (LP #1952738)
      + d/control: drop Build-Depends on libspf2-dev.
      + d/EDITME.exim4-heavy.diff: disable support for libspf2.
      + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
        on spfquery.mail-spf-perl from spf-tools-perl, but without
        the previously supported helo detection.
  * Dropped changes:
    - d/p/Fix-build-error-with-gcc-15.patch: fix eximon ftbfs with gcc-15
      Closes: #1096601 (LP #2124274)
      [ Applied upstream in version 4.99-RC3 ]

 -- Renan Rodrigo <rr@ubuntu.com>  Tue, 18 Nov 2025 23:23:22 -0300

exim4 (4.99-4) unstable; urgency=low

  * Upload to unstable.

 -- Andreas Metzler <ametzler@debian.org>  Thu, 13 Nov 2025 13:17:02 +0100

exim4 (4.99-3) experimental; urgency=medium

  * Sync post 4.99 changelog-entry numbering with upstream git.
  * Fix file open modes for Gnu/Hurd.
    https://bugs.exim.org/show_bug.cgi?id=3175

 -- Andreas Metzler <ametzler@debian.org>  Sun, 09 Nov 2025 13:16:50 +0100

exim4 (4.99-2) experimental; urgency=medium

  * Cherrypick post-release fixes:
    + 88_07-Build-quieten-sqlite-hints-Wunused-function-build.patch
    + 88_08-RFC-2047-fix-encode-operation.-Bug-3168.patch
    + 88_09-compiler-quietening.patch
    + 88_11-Fix-local-delivery-defers.patch
    + 88_12-Fix-remote-delivery-DNS-defers.-Bug-3172.patch

 -- Andreas Metzler <ametzler@debian.org>  Thu, 06 Nov 2025 07:09:42 +0100

exim4 (4.99-1) experimental; urgency=medium

  * Point watchfile to release directory again.
  * New upstream stable release (almost unchanged since rc4).
    + Drop cherry-picked patches.
  * Cherrypick patch to avoid logging error on seeing TCP-drop after sending
    QUIT. (https://bugs.exim.org/show_bug.cgi?id=3121)
  * Cherrypick post-release fixes:
    + 88_01-Fix-taint-status-for-dbm-lookups.-Bug-3169.patch
    + 88_03-Fix-duplicate-address-processing-vs.-continued-trans.patch

 -- Andreas Metzler <ametzler@debian.org>  Sat, 01 Nov 2025 14:06:26 +0100

exim4 (4.99~RC3-2) experimental; urgency=medium

  * Update to GIT head.

 -- Andreas Metzler <ametzler@debian.org>  Fri, 17 Oct 2025 13:13:57 +0200

exim4 (4.99~RC3-1) experimental; urgency=medium

  * New upstream version.
  * Drop 82_Fix-build-error-with-gcc-15.patch, included upstream.
  * Enable sqlite for exim4-daemon-light.
  * Use sqlite instead of berkely db 5.3 for exim hints databases and dbm
    lookups. Closes: #1119165

 -- Andreas Metzler <ametzler@debian.org>  Sun, 12 Oct 2025 13:23:43 +0200

exim4 (4.99~RC2-1) experimental; urgency=medium

  * Fold overlong lines when sending paniclog excerpts by mail. (Thanks,
    Célestin Matte) Closes: #1115604
  * New upstream version.
  * Do not DKIM-oversign empty Sender, Resent-* and List-* headers.
    This is minimal change to avoid bad settings, an optimal setting might
    look different. (Closes: #939808)

 -- Andreas Metzler <ametzler@debian.org>  Sun, 21 Sep 2025 14:01:35 +0200

exim4 (4.99~RC1-1) experimental; urgency=low

  * Point watchfile to test release.
  * New upstream version.
    + Unfuzz patches, drop superfluous patches.
    * convert4r4 was dropped upstream, update docs and packaging.
    * Ancient upgrading docs wer also dropped upstream, adapt packaging.
    * Update build-time config (EDITME*).
    * Bump copyright year.

 -- Andreas Metzler <ametzler@debian.org>  Wed, 03 Sep 2025 18:32:12 +0200

exim4 (4.98.2-2) unstable; urgency=medium

  * Set current_directory = /var/mail in mail_spool transport.
    Closes: #1106865
  * Fix eximon FTBFS with gcc-15. Closes: #1096601

 -- Andreas Metzler <ametzler@debian.org>  Thu, 14 Aug 2025 13:58:16 +0200

exim4 (4.98.2-1ubuntu2) questing; urgency=medium

  * d/p/Fix-build-error-with-gcc-15.patch: fix eximon ftbfs with gcc-15
    Closes: #1096601 (LP: #2124274)

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 17 Sep 2025 18:33:26 +0530

exim4 (4.98.2-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
    - Disable external SPF support to avoid Build-Depends on libspf2-dev
      (only available in universe). SPF can still be implemented via
      spf-tools-perl, as documented in exim4.conf.template. This reverts
      Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
      (LP #1952738)
      + d/control: drop Build-Depends on libspf2-dev.
      + d/EDITME.exim4-heavy.diff: disable support for libspf2.
      + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
        on spfquery.mail-spf-perl from spf-tools-perl, but without
        the previously supported helo detection.

 -- Bryce Harrington <bryce@canonical.com>  Thu, 12 Jun 2025 00:44:26 -0700

exim4 (4.98.2-1) unstable; urgency=medium

  * New upstream version (Basically identical to 4.98,1 + CVE-2025-30232 fix)
  * Unfuzz patches.
  * Add export-dir setting to gbp.conf.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 29 Mar 2025 13:22:55 +0100

exim4 (4.98.1-2) unstable; urgency=high

  * Fix use-after-free  (requiring local command-line access) notified by
    Trend Micro (ref: ZDI-CAN-26250). this is 4.98.2 without the version
    number bump. CVE-2025-30232

 -- Andreas Metzler <ametzler@debian.org>  Fri, 21 Mar 2025 15:32:31 +0100

exim4 (4.98.1-1ubuntu2) plucky; urgency=medium

  * SECURITY UPDATE: use-after-free security issue
    - debian/patches/CVE-2025-30232.patch: null out debug_pretrigger_buf
      pointer before freeing the buffer in src/debug.c.
    - CVE-2025-30232

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 28 Mar 2025 07:18:19 -0400

exim4 (4.98.1-1ubuntu1) plucky; urgency=medium

  * Merge with Debian Unstable. Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
    - Disable external SPF support to avoid Build-Depends on libspf2-dev
      (only available in universe). SPF can still be implemented via
      spf-tools-perl, as documented in exim4.conf.template. This reverts
      Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
      (LP #1952738)
      + d/control: drop Build-Depends on libspf2-dev.
      + d/EDITME.exim4-heavy.diff: disable support for libspf2.
      + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
        on spfquery.mail-spf-perl from spf-tools-perl, but without
        the previously supported helo detection.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Sun, 23 Mar 2025 10:10:54 -0500

exim4 (4.98.1-1) unstable; urgency=medium

  * Refresh upstream keys from
    https://downloads.exim.org/Exim-Maintainers-Keyring.asc
  * New upstream version (Basically identical to 4.98 +
    81_Squashed-from-fix-cve-2025-26794-fixes-CVE-26794.patch)

 -- Andreas Metzler <ametzler@debian.org>  Sat, 15 Mar 2025 13:41:07 +0100

exim4 (4.98-4ubuntu1) plucky; urgency=medium

  * Merge with Debian Unstable. Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
    - Disable external SPF support to avoid Build-Depends on libspf2-dev
      (only available in universe). SPF can still be implemented via
      spf-tools-perl, as documented in exim4.conf.template. This reverts
      Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
      (LP #1952738)
      + d/control: drop Build-Depends on libspf2-dev.
      + d/EDITME.exim4-heavy.diff: disable support for libspf2.
      + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
        on spfquery.mail-spf-perl from spf-tools-perl, but without
        the previously supported helo detection.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Tue, 04 Mar 2025 20:37:23 -0600

exim4 (4.98-4) unstable; urgency=high

  * Cherry-pick patches from upstream git master:
    + 79_Dovecot-fix-protocol-sequence-for-version-2.4.0.patch (Compliance
      with upcoming dovecot v1.3 auth protocol)
  * Use default 550 message in lowuid_aliases router ("Unrouteable address"
    instead of "no mail to system accounts") to avoid disclosing information on
    installed packages. Closes: #1092910
  * 81_Squashed-from-fix-cve-2025-26794-fixes-CVE-26794.patch: Upgrade to
    4.98.1, fixing CVE-2025-26794. This is a SQL injection for the
    (Sqlite-)hints database with ETRN. Debian binaries do not yet use sqlite
    for the hints DB so this just only affects users building their own
    binaries from sources and switching to sqlite-hints-DB.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 15 Feb 2025 14:02:27 +0100

exim4 (4.98-3ubuntu1) plucky; urgency=medium

  * Merge with Debian Unstable. Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
    - Disable external SPF support to avoid Build-Depends on libspf2-dev
      (only available in universe). SPF can still be implemented via
      spf-tools-perl, as documented in exim4.conf.template. This reverts
      Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
      (LP #1952738)
      + d/control: drop Build-Depends on libspf2-dev.
      + d/EDITME.exim4-heavy.diff: disable support for libspf2.
      + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
        on spfquery.mail-spf-perl from spf-tools-perl, but without
        the previously supported helo detection.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Tue, 18 Feb 2025 16:02:29 -0600

exim4 (4.98-3) unstable; urgency=low

  * Manpage formatting fixes by Bjarni Ingi Gislason:
    exim4-config_files.5 Closes: #1082620
    exim_db.8            Closes: #1087135
    exim_dbmbuild.8      Closes: #1087139
    exiwhat.8            Closes: #1087225
  * Extract non-lintish changes from patches for pod2man-generated manpages.
    Closes: #1087172,#1087206,#1087222
  * Cherrypick patches from upstream GIT master:
    + 77-Fix-IP-SRR-parsing.-Bug-3124.patch: Fix theoretical crash in
      received connection, triggerable by a crafted packet with massive
      count of IP options. https://bugs.exim.org/show_bug.cgi?id=3124
    + Fix for DKIM smuggling attack.
      78-DKIM-fix-verify-of-malformed-header-lines.-Bug-3036.patch
      https://bugs.exim.org/show_bug.cgi?id=3036
  * Move tls_advertise_hosts setting outside (misnamed) .ifdef
    MAIN_TLS_ENABLE to ease disabling of incoming TLS. Also make
    README.Debian more explicit in this respect. Closes: #1089517
  * Remove Marc Haber from uploaders. - Thank you for your work!
  * Run wrap-and-sort -ast.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 21 Dec 2024 16:47:07 +0100

exim4 (4.98-2ubuntu2) plucky; urgency=medium

  * No-change rebuild against mysql-8.4 and libmysqlclient24 (LP: #2089059)

 -- Lena Voytek <lena.voytek@canonical.com>  Wed, 05 Feb 2025 15:45:41 -0500

exim4 (4.98-2ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085230). Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
    - Disable external SPF support to avoid Build-Depends on libspf2-dev
      (only available in universe). SPF can still be implemented via
      spf-tools-perl, as documented in exim4.conf.template. This reverts
      Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
      (LP #1952738)
      + d/control: drop Build-Depends on libspf2-dev.
      + d/EDITME.exim4-heavy.diff: disable support for libspf2.
      + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
        on spfquery.mail-spf-perl from spf-tools-perl, but without
        the previously supported helo detection.

 -- Bryce Harrington <bryce@canonical.com>  Wed, 27 Nov 2024 15:42:06 -0800

exim4 (4.98-2) unstable; urgency=low

  * Also run update-exim4.conf on systemd daemon reload. Closes: #1077034
  * Use --allow-bad-names instead of --force-badname when invoking adduser.
  * Cherry-pick patches from upstream git master / bugzilla:
    + 73_Fix-SPA-authenticator.-Bug-3106.patch
      https://bugs.exim.org/show_bug.cgi?id=3106
    + 74_DKIM-fix-parsing-of-pubkey-RR.patch
      https://bugs.exim.org/show_bug.cgi?id=3120
    + 75_dkim_sign.patch https://bugs.exim.org/show_bug.cgi?id=3116
      Closes: #1082905

 -- Andreas Metzler <ametzler@debian.org>  Sat, 19 Oct 2024 11:54:30 +0200

exim4 (4.98-1ubuntu3) plucky; urgency=medium

  * No-change rebuild for libperl soname.

 -- Matthias Klose <doko@ubuntu.com>  Sun, 20 Oct 2024 14:32:42 +0200

exim4 (4.98-1ubuntu2) oracular; urgency=medium

  * No-change rebuild against debhelper 13.18ubuntu2 from -proposed
    (LP: #2077407)

 -- Bryce Harrington <bryce@canonical.com>  Sun, 15 Sep 2024 13:41:05 -0700

exim4 (4.98-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2077046). Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
    - Disable external SPF support to avoid Build-Depends on libspf2-dev
      (only available in universe). SPF can still be implemented via
      spf-tools-perl, as documented in exim4.conf.template. This reverts
      Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
      (LP #1952738)
      + d/control: drop Build-Depends on libspf2-dev.
      + d/EDITME.exim4-heavy.diff: disable support for libspf2.
      + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
        on spfquery.mail-spf-perl from spf-tools-perl, but without
        the previously supported helo detection.

 -- Bryce Harrington <bryce@canonical.com>  Wed, 14 Aug 2024 20:46:04 -0700

exim4 (4.98-1) unstable; urgency=medium

  * New stable release, almost identical to RC3.

 -- Andreas Metzler <ametzler@debian.org>  Thu, 11 Jul 2024 07:41:31 +0200

exim4 (4.98~RC3-2) unstable; urgency=medium

  * Upload to unstable.
  * RC3 fixes CVE-2024-39929 Closes: #1075785

 -- Andreas Metzler <ametzler@debian.org>  Fri, 05 Jul 2024 18:06:31 +0200

exim4 (4.98~RC3-1) experimental; urgency=low

  * New upstream release candidate.

 -- Andreas Metzler <ametzler@debian.org>  Wed, 03 Jul 2024 18:21:36 +0200

exim4 (4.98~RC2-1) experimental; urgency=low

  * New upstream release candidate.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 23 Jun 2024 18:23:00 +0200

exim4 (4.98~RC1-1) experimental; urgency=low

  * New upstream release candidate.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 15 Jun 2024 11:05:49 +0200

exim4 (4.98~RC0-1) experimental; urgency=low

  * Add minimal gbp.conf.
  * New upstream release candidate.
    + Drop cherry-picked patches, unfuzz 90_localscan_dlopen.dpatch.
    + Fixes hurd FTBFS. Closes: #1070396
    + Refresh debian/EDITME*
    + Add lintian-override for bash-term-in-posix-shell false positive in
      exinext sh/perl script.
  * Add NEWS entry to 4.97-1 regarding exiqgrep requiring at least one
    selection option and point to exim's -bpi option. Closes: #1027968
  * Ship newly available mailtest utility in exim4-base.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 08 Jun 2024 13:40:06 +0200

exim4 (4.97-8ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064401). Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
     - Disable external SPF support to avoid Build-Depends on libspf2-dev
       (only available in universe). SPF can still be implemented via
       spf-tools-perl, as documented in exim4.conf.template. This reverts
       Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
       (LP #1952738)
       + d/control: drop Build-Depends on libspf2-dev.
       + d/EDITME.exim4-heavy.diff: disable support for libspf2.
       + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
         on spfquery.mail-spf-perl from spf-tools-perl, but without
         the previously supported helo detection.

 -- Bryce Harrington <bryce@canonical.com>  Mon, 20 May 2024 15:48:10 -0700

exim4 (4.97-8) unstable; urgency=medium

  * Pull fixes from upstream GIT master:
    + 78_35-Fix-encoding-for-AUTH-on-MAIL-FROM.patch
    + 78_37-Logging-fix-receive-time-crash-with-recipients-loggi.patch
    + 78_39-SRS-fix-encode-for-local-part-with-zero-length-quote.patch (exim
      bug #3087)

 -- Andreas Metzler <ametzler@debian.org>  Sun, 07 Apr 2024 07:50:45 +0200

exim4 (4.97-7) unstable; urgency=medium

  * Pull fixes from upstream GIT master:
    + 78_30-Rewrites-fix-delivery-crash-from-constant-errors_to..patch (exim
      bug #3081)
    + 78_31-Lookups-fix-dbmnz-crash-on-zero-length-datum.-Bug-30.patch (exim
      bug #3079)
  * Update lintian overrides.

 -- Andreas Metzler <ametzler@debian.org>  Mon, 01 Apr 2024 10:45:05 +0200

exim4 (4.97-6) unstable; urgency=high

  * Add b-d on libnsl-dev to fix (temporary) FTBFS. Closes: #1065107
  * Pull fixes from upstream GIT master:
    78_10-Use-non-releaseable-memory-for-regex-match-strings.-.patch
    78_11-use-dynamic-mem-for-regex_match_string.patch
    78_12-Use-non-releasable-memory-for-regex-line-buffer.patch
    78_15-regex-avoid-releasing-built-RE-midloop.patch
    78_21-Lookups-avoid-leaking-user-passwd-from-server-spec-t.patch
    78_23-Fix-crash-on-empty-oMt-argument.-Bug-3070.patch
  * 78_06, 78_07, 78_10, 78_11, 78_12 and 78_15 together Closes: #1053447

 -- Andreas Metzler <ametzler@debian.org>  Fri, 01 Mar 2024 18:09:49 +0100

exim4 (4.97-5) unstable; urgency=low

  * Multiple fixes from upstream GIT master:
    + 73_Check-for-missing-commandline-arg-after-options-taki.patch (upstream
      bug #3049)
    + 76_01-Support-old-format-message_id-spoolfiles-for-mailq-b.patch
      (upstream bug #3050)
    + 76_05-Fix-periodic-queue-runs.-Bug-3046.patch (upstream bug #3046)
    + 78_01-Fix-recipient-or-source-selection-in-combination-wit.patch
      (upstream bug #3064)
    + 78_02-Eximon-handle-new-format-message-IDs.patch (upstream bug #)
    + 78_03-Lookups-log-warning-for-deprecated-syntax.-Bug-3068.patch
      (upstream bug #3068)
    + 78_04-Exinext-handle-new-format-message-IDs.patch
    + 78_05-TLS-fix-startup-after-forced-fail.patch (upstream bug #)
    + 78_06-Appendfile-release-regex-match-store-every-thousand-.patch
      (upstream bug #3047)
    + 78_07-ACL-in-regex-condition-release-store-every-thousand-.patch
      (upstream bug #3047)
    + 78_08-Fix-smtp-transport-response-to-close-after-all-rcpt-.patch
      (upstream bug #3059)

 -- Andreas Metzler <ametzler@debian.org>  Sun, 28 Jan 2024 14:08:10 +0100

exim4 (4.97-4ubuntu4) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 18:12:56 +0000

exim4 (4.97-4ubuntu3) noble; urgency=medium

  * No-change rebuild against libperl5.38t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sat, 09 Mar 2024 18:19:06 +0000

exim4 (4.97-4ubuntu2) noble; urgency=medium

  * No-change rebuild against libdb5.3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sat, 02 Mar 2024 20:31:24 +0000

exim4 (4.97-4ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2051408). Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
     - Disable external SPF support to avoid Build-Depends on libspf2-dev
       (only available in universe). SPF can still be implemented via
       spf-tools-perl, as documented in exim4.conf.template. This reverts
       Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
       (LP #1952738)
       + d/control: drop Build-Depends on libspf2-dev.
       + d/EDITME.exim4-heavy.diff: disable support for libspf2.
       + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
         on spfquery.mail-spf-perl from spf-tools-perl, but without
         the previously supported helo detection.

 -- Bryce Harrington <bryce@canonical.com>  Fri, 26 Jan 2024 17:11:37 -0800

exim4 (4.97-4) unstable; urgency=medium

  * autopkgtest: Stop using previously deprecated swaks feature to autodetect
    whether the argument for --data was a file. This was dropped in swaks
    20240102.0.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 06 Jan 2024 07:48:19 +0100

exim4 (4.97-3ubuntu2) noble; urgency=medium

  * No-change rebuild for the perl update.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 11 Jan 2024 04:29:22 +0100

exim4 (4.97-3ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040379). Remaining changes:
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + d/control: Build-Depends on lsb-release to detect Distribution.
     - Disable external SPF support to avoid Build-Depends on libspf2-dev
       (only available in universe). SPF can still be implemented via
       spf-tools-perl, as documented in exim4.conf.template. This reverts
       Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
       (LP #1952738)
       + d/control: drop Build-Depends on libspf2-dev.
       + d/EDITME.exim4-heavy.diff: disable support for libspf2.
       + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
         on spfquery.mail-spf-perl from spf-tools-perl, but without
         the previously supported helo detection.
  * Dropped:
    - information disclosure
      + d/p/CVE-2023-42114.patch: fix possible OOB read in
        SPA authenticator
      [Included in 4.97~RC1-2]
    - remote code execution
      + d/p/CVE-2023-42115.patch: fix possible OOB write in
        external authenticator
      [Included in 4.97~RC1-2]
    - remote code execution
      + d/p/CVE-2023-42116.patch: fix possible OOB write in
        SPA authenticator
      [Included in 4.97~RC1-2]
    - d/p/CVE-2023-42114_15_16.patch:
      + use uschar more in spa authenticator
      [Included in 4.97~RC1-2]
    - remote code execution
      + d/p/CVE-2023-42117.patch: fixed string_is_ip_address()
        in string.c
    - information disclosure
      + d/p/CVE-2023-42119.patch: hardened dnsdb.c against
        crafted DNS responses.
      [Included in upstream release 4.97]

 -- Bryce Harrington <bryce@canonical.com>  Wed, 03 Jan 2024 12:58:30 -0800

exim4 (4.97-3) unstable; urgency=medium

  * Fixes from upstream GIT master:
    77_01-Reject-dot-LF-as-ending-data-phase.-Bug-3063.patch
    77_02-Use-enum-for-body-data-input-state-machine.patch
    77_03-Reject-dot-LF-as-ending-data-phase-pt.-2-.-Bug-3063.patch
    + Enforce a data synch check before emitting the 354 "go ahead".
      Previously this was only done if a pre-data ACL was configured.
    + Refuse to accept a line "dot, LF" as end-of-DATA unless operating in
      LF-only mode (as detected from the first header line).  Previously we
      did accept that in (normal) CRLF mode; this has been raised as a
      possible attack scenario (under the name "smtp smuggling").
    Closes: #1059387 CVE-2023-51766

 -- Andreas Metzler <ametzler@debian.org>  Mon, 25 Dec 2023 07:50:16 +0100

exim4 (4.97-2) unstable; urgency=medium

  * Add 75-04-Lookups-Fix-dnsdb-lookup-of-multi-chunk-TXT.-Bug-305.patch from
    upstream git master to fix dnsdb lookup regression. (Upstream bug 3054)
  * Due to being rebuilt with a newer debhelper exim4-base.service
    and exim4-base.timer move to /usr/lib/systemd/.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 18 Nov 2023 13:02:52 +0100

exim4 (4.97-1) unstable; urgency=medium

  * Drop reference to QUEUEINTERVAL from conf.d/retry/30_exim4-config.
    (Thanks, Vincent Lefevre!) Closes: #1054492
  * New upstream version.
    + Update debian/copyright.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 04 Nov 2023 18:28:43 +0100

exim4 (4.97~RC3-1) unstable; urgency=medium

  * New upstream version, drop patches pulled from master.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 22 Oct 2023 07:31:26 +0200

exim4 (4.97~RC2-2) unstable; urgency=high

  * 76_changesfrom_4.96.2.diff: Pull fixes for CVE-2023-42117 and
    CVE-2023-42119 from upstream GIT master. Closes: #1053310

 -- Andreas Metzler <ametzler@debian.org>  Mon, 16 Oct 2023 18:26:40 +0200

exim4 (4.97~RC2-1) unstable; urgency=low

  * Generate /etc/default/exim4 in exim4-config.postinst instead of
    /etc/default/exim. Closes: #1053788
  * Also remove the unused file and generate the correct one if missing.
  * New upstream version.
    + Drop 75-01-Auths*.diff.
  * Add two post-release fixes:
    + 75-01-Fix-crash-in-SPF-DNS-usage.patch
    + 75-02-SPF-harden-against-crafted-DNS-responses.patch

 -- Andreas Metzler <ametzler@debian.org>  Wed, 11 Oct 2023 18:56:28 +0200

exim4 (4.97~RC1-2) unstable; urgency=high

  * Address SPA authenticator vulnerabilities (CVE-2023-42114, CVE-2023-42115,
    CVE-2023-42116)
    - Auths: fix possible OOB write in external authenticator (CVE-2023-42115)
    - Auths: use uschar more in spa authenticator
    - Auths: fix possible OOB write in SPA authenticator (CVE-2023-42116)
    - Auths: fix possible OOB read in SPA authenticator (CVE-2023-42114)

 -- Andreas Metzler <ametzler@debian.org>  Sun, 01 Oct 2023 18:04:33 +0200

exim4 (4.97~RC1-1) unstable; urgency=medium

  [ Helmut Grohne ]
  * Fix FTBFS when dh_installsystemd installs units to /usr.
    Closes: #1053110

  [ Andreas Metzler ]
  * New upstream version.
    + Drop 75_01-Fix-tr.-and-empty-strings.-Bug-3023.patch.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 30 Sep 2023 11:29:26 +0200

exim4 (4.97~RC0-3) unstable; urgency=medium

  * Drop misleading phrase regarding incoming TLS support in README.Debian.
    Closes: #1051945
  * Improve on description of group setting for pipe deliveries in
    README.Debian.
  * 75_01-Fix-tr.-and-empty-strings.-Bug-3023.patch from upstream GIT master
    fixing crashes in string expansion.
    https://bugs.exim.org/show_bug.cgi?id=3023

 -- Andreas Metzler <ametzler@debian.org>  Tue, 19 Sep 2023 18:04:22 +0200

exim4 (4.97~RC0-2) unstable; urgency=low

  * Fix URL of specific upstream exim bugreport in README.Debian.
  * Upload to unstable.
  * Add NEWS entry for format change of internal ID used for message
    identification. (See upstream changelog JH/29!)
  * Generate manpage for exim_msgdate(8) with pod2man and ship it.
  * Add manpage for exim_id_update.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 10 Sep 2023 14:04:49 +0200

exim4 (4.97~RC0-1) experimental; urgency=low

  * New upstream version.
    + Drop cherry-picked patches.
    + Unfuzz 90_localscan_dlopen.dpatch.
    + Add b-d and -basde dep on libfile-fcntllock-perl.
    + Update example conf md5 hash (no changes to merge).
  * Let -base depend on ${perl:Depends}.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 09 Sep 2023 13:53:15 +0200

exim4 (4.96-22) unstable; urgency=low

  * Fix architecture all build.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 02 Sep 2023 15:41:28 +0200

exim4 (4.96-21) unstable; urgency=low

  * tests/basic: Add isolation-container restriction (needs a running
    exim daemon).
  * Add ${run } expansion test to tests/basic.
  * Replace 75_78-Fix-free-of-value-after-run.patch with
    75_83-Re-fix-live-variable-value-free.-The-inital-fix-resu.patch fixing
    $value expansion after ${run ..}.
  * Upload to unstable.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 02 Sep 2023 13:49:33 +0200

exim4 (4.96-20) experimental; urgency=low

  * Drop support for configuring daemon startup by setting QUEUERUNNER in
    /etc/default/exim4. Also queue run from /etc/ppp/ip-up.d/exim4 is
    disabled by default.
    Also replace QFLAGS, QUEUEINTERVAL, COMMONOPTIONS, QUEUERUNNEROPTIONS and
    SMTPLISTENEROPTIONS settings for systemd service/init script in
    etc/default/exim4 with a combined EXIMSERVICE (for systemd) or
    EXIMDAEMONOPTS (init script) directive.
  * Drop update-inetd related code from maintainerscripts, update docs.
  * Drop update-exim4defaults and its manpage It has no users in Debian
    and with the removal of the queuerunner option functionality does not
    provide a real benefit over editing /etc/default/exim4.
  * Ship systemd exim4.service unit in exim4-daemon-* packages. (Mainly
    inspired by the file from OpenSuse, but using Type=exec and -bdf as in
    from exim upstream git). Since contrary to the init script
    /lib/systemd/system/exim4.service is not a conffile we can simply ship it
    in *both* daemon packages (they have the necessarry conflicts/replaces
    relation) and let dh_installsystemd handle maintainerscripts.
  * Ship exim4.service in its real location below /usr (by moving after
    dh_installsystemd has run.
  * Add lintian-overrides for omitted-systemd-service-for-init.d-script and
    package-supports-alternative-init-but-no-init.d-script which are triggered
    by service file and init script being in different packages.

 -- Andreas Metzler <ametzler@debian.org>  Wed, 16 Aug 2023 17:44:59 +0200

exim4 (4.96-19) unstable; urgency=medium

  * 77_fix_autogencert_expiry.diff: Fix on-demand TLS cert expiry date.
    Closes: #1043233

 -- Andreas Metzler <ametzler@debian.org>  Sat, 12 Aug 2023 14:57:51 +0200

exim4 (4.96-18) unstable; urgency=medium

  *  Fixes from upstream GIT master:
     + 75_78-Fix-free-of-value-after-run.patch
     + 75_79-Fix-recipients-expansion-when-used-within-run.-.-Bug.patch

 -- Andreas Metzler <ametzler@debian.org>  Sat, 05 Aug 2023 13:29:22 +0200

exim4 (4.96-17ubuntu2.1) mantic-security; urgency=medium

  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2023-42117.patch: fixed string_is_ip_address()
      in string.c
    - CVE-2023-42117
  * SECURITY UPDATE: information disclosure
    - debian/patches/CVE-2023-42119.patch: hardened dnsdb.c against
      crafted DNS responses.
    - CVE-2023-42119

 -- Allen Huang <allen.huang@canonical.com>  Wed, 25 Oct 2023 01:21:02 +0100

exim4 (4.96-17ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: information disclosure
    - debian/patches/CVE-2023-42114.patch: fix possible OOB read in
      SPA authenticator
    - CVE-2023-42114
  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2023-42115.patch: fix possible OOB write in
      external authenticator
    - CVE-2023-42115
  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2023-42116.patch: fix possible OOB write in
      SPA authenticator
    - CVE-2023-42116
  * debian/patches/CVE-2023-42114_15_16.patch:
    - use uschar more in spa authenticator

 -- Allen Huang <allen.huang@canonical.com>  Tue, 03 Oct 2023 14:35:45 +0100

exim4 (4.96-17ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2030098). Remaining changes:
     - Disable external SPF support to avoid Build-Depends on libspf2-dev
       (only available in universe). SPF can still be implemented via
       spf-tools-perl, as documented in exim4.conf.template. This reverts
       Vcs-Git commit 494f1fe, first released in 4.95~RC0-1.
       (LP #1952738)
       + d/control: drop Build-Depends on libspf2-dev.
       + d/EDITME.exim4-heavy.diff: disable support for libspf2.
       + d/d/c/a/30_exim4-config_check_rcpt: restore SPF logic based
         on spfquery.mail-spf-perl from spf-tools-perl, but without
         the previously supported helo detection.
    - Show Ubuntu distribution in SMTP banner
      + d/p/fix_smtp_banner.patch: Show Ubuntu distribution
        in SMTP banner.
      + Build-Depends on lsb-release to detect Distribution.
  * Dropped:
    - d/p/fix-run--arg-parsing.patch: Fix argument parsing for ${run }
      expansion. Previously, when an argument included a close-brace
      character (e.g. it itself used an expansion) an error occurred.
      (LP #1998678)
      [Accepted by Debian in 4.96-16]

 -- Bryce Harrington <bryce@canonical.com>  Fri, 04 Aug 2023 20:28:47 -0700

exim4 (4.96-17) unstable; urgency=low

  *  Fixes from upstream GIT master:
     + 75_74-Cancel-early-pipe-on-an-observed-advertising-change.patch
     + 75_75-Fix-json-extract-for-strings-carrying-commas.-Bug-30.patch
     + 75_76-Expansions-disallow-UTF-16-surrogates-from-utf8clean.patch
     + 75_77-GnuTLS-fix-crash-with-tls_dhparam-none.patch
     (Upstream bugs 3006, 2998)

 -- Andreas Metzler <ametzler@debian.org>  Sat, 29 Jul 2023 18:32:55 +0200

exim4 (4.96-16) unstable; urgency=medium

  [ Marc Haber ]
  * Enforce TLS for dovecot_plain_server example. (Thanks: Dominic Preston)
    Closes: #1037127

  [ Andreas Metzler ]
  * 75_42-Fix-run-arg-parsing.patch (From upstream GIT master, backported by
    Bryce Harrington for Ubuntu):  Fix argument parsing for ${run } expansion.
    Previously, when an argument included a close-brace character (eg. it
    itself used an expansion) an error occurred. Closes: #1025420
  * 75_68-Fix-srs_encode-.-for-mod-1024-day-zero.patch from upstream GIT
    master:  Fix ${srs_encode ..}. Previously it would give a bad result for
    one day every 1024 days.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 11 Jun 2023 18:20:21 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog exim4-dev`.
