Author: Sam Hartman
Revision Date: 2006-04-30 00:49:39 UTC

* Resync with 2.1.19.dfsg1-0.2
* Note that the MIT packages do not install digest-md5 so CVE 2006-1721
  does not apply

Author: Sam Hartman
Revision Date: 2006-04-30 00:49:39 UTC

* Resync with 2.1.19.dfsg1-0.2
* Note that the MIT packages do not install digest-md5 so CVE 2006-1721
  does not apply

Author: Sam Hartman
Revision Date: 2006-04-30 00:49:39 UTC

* Resync with 2.1.19.dfsg1-0.2
* Note that the MIT packages do not install digest-md5 so CVE 2006-1721
  does not apply

Author: Sam Hartman
Revision Date: 2005-12-16 22:01:06 UTC

* Sync with 2.1.19-1.7
      - Includes fix for FTBFS, Closes: #285613
* Include NMU from 2.1.19-1.1
* Disable gssapi library mutexes as we no longer need them.

Author: Henrique de Moraes Holschuh
Revision Date: 2004-10-17 00:43:17 UTC

* NMU
* resync to cyrus-sasl2 2.1.19-1.5):
  * SECURITY FIX: SASL_PATH environment variable must not be honoured on
    setuid environments, otherwise we have a local privilege escalation
    exploit (CVE: CAN-2004-0884), related advisories: RHSA-2004:546-02;
    GLSA 200410-05 (closes: #276865)
    * upstream CVS: lib/common.c: don't honor SASL_PATH in setuid
      environment. from Gentoo (CVE CAN-2004-0884);
    * Fix to upstream CVS security fix: initialize *path = NULL
  * upstream CVS: plugins/kerberos4.c: document weirdness with openssl DES
  * upstream CVS: plugins/cram.c,plugins/anonymous.c,plugins/login.c,
    plugins/plain.c,plugins/sasldb.c: Fixed several 64 bit portability
    warnings
  * Forward port sasl_set_alloc locking patch from SASL 1.5, to avoid
    problems with the braindead idea of globals SASL has, and with libraries
    that think they can get around mucking with them (hello openldap!)
  * Add Build-Conflicts: autoconf2.13, automake1.4

Author: Henrique de Moraes Holschuh
Revision Date: 2004-10-17 00:43:17 UTC

* NMU
* resync to cyrus-sasl2 2.1.19-1.5):
  * SECURITY FIX: SASL_PATH environment variable must not be honoured on
    setuid environments, otherwise we have a local privilege escalation
    exploit (CVE: CAN-2004-0884), related advisories: RHSA-2004:546-02;
    GLSA 200410-05 (closes: #276865)
    * upstream CVS: lib/common.c: don't honor SASL_PATH in setuid
      environment. from Gentoo (CVE CAN-2004-0884);
    * Fix to upstream CVS security fix: initialize *path = NULL
  * upstream CVS: plugins/kerberos4.c: document weirdness with openssl DES
  * upstream CVS: plugins/cram.c,plugins/anonymous.c,plugins/login.c,
    plugins/plain.c,plugins/sasldb.c: Fixed several 64 bit portability
    warnings
  * Forward port sasl_set_alloc locking patch from SASL 1.5, to avoid
    problems with the braindead idea of globals SASL has, and with libraries
    that think they can get around mucking with them (hello openldap!)
  * Add Build-Conflicts: autoconf2.13, automake1.4

Author: Sam Hartman
Revision Date: 2004-04-23 15:02:54 UTC

Fix build-depends, Closes: #245239