cdrom.image/sme8/README.txt

Koozali SME Server 8.2 Release Notes

====================================


18 March 2015


The Koozali SME Server (SME Server) development team is pleased to announce 

the release of SME Server 8.2 which is based on CentOS 5.11


Bug reports and reports of potential bugs should be raised in the bug

tracker (and only there, please);


    http://bugs.contribs.org/


Download

========


You can download SME Server 8.2 from

http://mirror.contribs.org/smeserver/releases/8.2/iso/x86_64/

or for other methods see http://wiki.contribs.org/SME_Server:Download


Please note it may take up to 48 hours for mirrors to finish syncing,

during this time you may experience problems.


About SME Server

================


SME Server is the leading Linux distribution for small and medium

enterprises. SME Server is brought to you by Koozali Foundation, Inc., 

a non-profit corporation that exists to provide marketing and legal support 

for SME Server.


SME Server is freely available under the GNU General Public License and

is only possible through the efforts of the SME Server community.

However, the availability and quality of SME Server is dependent on

meeting our expenses, such as hosting costs, server hardware, etc.


As such, we ask for a donation to offset costs and fund further development.


a) If you are a school, a church, a non-profit organisation or an individual

using SME Server for private purposes, we would appreciate you to contribute

within your means toward the costs associated with hosting, maintenance and

development.


b) If you are a company or an integrator and you are deploying SME Server in

the course of your work to generate revenue, we expect you to make a donation

commensurate with the level of revenue you generate and the number of servers

your have in the field. Please, help the project


Please visit http://wiki.contribs.org/Donate to donate.


Koozali Inc is happy to supply an invoice for any donations received, 

simply email treasurer@koozali.org


Thanks

======


The development team would like to thank all of those who have involved

themselves with this release.


Notes

=====


1. CentOS 5 has dropped support for i586 and therefore SME Server 8.2

   will not work on i586 hardware. [See bugzilla:2845]. i586 hardware

   means processors before and including Intel Pentium, Pentium MMX;

   AMD K5, K6, K6-II, K6-III and Via C3. i686 architecture processors

   are Intel Pentium Pro, Pentium II, Pentium III; AMD Athlon,

   Athlon XP and later.


2. Some notes on SME Server 8.2 including help on upgrades can be found at

   http://wiki.contribs.org/SME_Server_8


3. Please note Upstream policy on Production Phase 3 for EL5. Only those

   security updates deemed crucial are now being released upstream for EL5

   (so also for SME8) The Koozali team recommends that you start moving

   workloads from SME Server 8 to SME Server 9. 

   Planned EOL for CentOS 5 is Mar 31 2017


4. Please note it may take up to 48 hours for mirrors to finish syncing,

   during this time you may experience problems.

   You can download SME Server 8.2 from

   http://mirror.contribs.org/smeserver/releases/8.2/iso/i386/

   or for other methods see http://wiki.contribs.org/SME_Server_8


Changes in this release

=======================


Packages altered by Centos, Redhat, and Fedora-associated developers are

not included.


Backups

-------

 - Add pkgconfig dar

 - New Upstream Version dar

 - Add requires nfs-utils

 - The nfs service is neither started or allowed to start

 - Workstation Backup, do not create folder in / 


LDAP

----

 - Make pdbedit output independent from locale and timezone so it can be

   parsed 


Localisation

------------

 - apply locale 2015-03-14 patch from pootle 

 - apply locale 2014-12-25 patch from pootle 

 - apply locale 2014-03-08 patch from pootle 


Mail Server

-----------

 - Updated to ClamAV release 0.98.6 

 - Updated to release ClamAV 0.98.5 

 - Add BuildRequires for openssl-devel and libxml2-devel 

 - Remove Packager and Vendor from ClamAV spec file.

 - Updates to release ClamAV 0.98.4.

 - Updated to release ClamAV 0.98.3.

 - Remove the patch e-smith-email-5.2.0-UEsDBBQDAAAIA-new-signature.patch

 - Add new zip file signatures to default mailpatterns database :
   UEsDBBQDAAAIA

 - Add new zip file signatures to default mailpatterns database : ZIPVOSX &
   ZIPV3

 - Fix stunnel path 

 - Use stunnel instead of sslio to support TLS 

 - Modify whitelist_soft transaction to interact with dnsbl filter 

   by John Crisp <jcrisp@safeandsoundit.co.uk>

 - Remove DENYSOFT on SPF softfail qpsmtpd

 - Increase MemLimit to 700M for clamav-0.98 

 - Remove dnsbl.ahbl.org RBL List 


Server manager

--------------

 - Resync with upstream php53, which include

    fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710

    xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668

    core: fix integer overflow in unserialize() CVE-2014-3669

    exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670

 - Resync with upstream php53, which include

    spl: fix use-after-free in ArrayIterator due to object

    change during sorting. CVE-2014-4698

    spl: fix use-after-free in SPL Iterators. CVE-2014-4670

    gd: fix NULL pointer dereference in gdImageCreateFromXpm.

    CVE-2014-2497

    fileinfo: fix incomplete fix for CVE-2012-1571 in

    cdf_read_property_info. CVE-2014-3587

    core: fix incomplete fix for CVE-2014-4049 DNS TXT

    record parsing. CVE-2014-3597

 - Resync with upstream php53, which include

    core: type confusion issue in phpinfo(). CVE-2014-4721

    date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712

    core: fix heap-based buffer overflow in DNS TXT record parsing.

    CVE-2014-4049

    core: unserialize() SPL ArrayObject / SPLObjectStorage type

    confusion flaw. CVE-2014-3515

    fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270

    fileinfo: unrestricted recursion in handling of indirect type

    rules. CVE-2014-1943

    fileinfo: out of bounds read in CDF parser. CVE-2012-1571

    fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479

    fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480

    fileinfo: cdf_unpack_summary_info() excessive looping

    DoS. CVE-2014-0237

    fileinfo: CDF property info parsing nelements infinite

    loop. CVE-2014-0238


Web Server

----------

 - Disable SSLv3 

 - Revert CRIME mitigation patch, as it's not needed 

 - Mitigate CRIME, CVE-2012-4929 


Other fixes and updates

-----------------------

 - When quiting the console app with unsaved changes set the default selected

   answer to NO 

 - Add a verification in the console of number of pptp clients against ip
   allowed in dhcpd

 - Add a verification in remoteaccess panel of number of pptp clients against
   ip allowed in dhcpd

 - Reset primary ibay default type 

 - Add a migrate fragment to sanitize the host comment for illegal characters
   in the server-manager.

   Sanitize existing hostname records, Add a validator for the comment in the
hostname field

   Code done by Charlie Brady <charlieb-contribs-bugzilla@budge.apana.org.au>

   and Huib <sme@artixdesign.com>

 - Force SSL following ibays settings to the relevant domain 

 - Move mysql logging to multilog 

 - Allow ntp status queries from localhost. 

 - Avoid uninitialized variable warning from last update. 

 - Add ssh-autoblock for external interface - patch by Chris Maltby 

 - Update to upstream version 2.3.4, which fixes CVE-2012-3478 and
   CVE-2012-2252

 - Updated rsync-protocol.patch to fix CVE-2012-2251, and to apply on top of
   the

   CVE-2012-3478 and CVE-2012-2252 fixes.

 - Updated makefile.patch to preserve RPM CFLAGS.

 - Added command-line-error.patch (from Debian), correcting error message

   generated when insecure command line option is used (CVE-2012-3478 fix

   regression).

 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild

 - Add patch for rsync3 compat (#485946)

 - Update smeserver-release for beta1 of SME Server 8.2

 - Set the check update frequency of smecontribs through the server-manager

 - Add a default Yum db property for check4contribsupdates 

 - Added a check-update for the smecontribs repository 


General features

================


- Based on CentOS 5.11 and all available updates


Terry Fage

On behalf of the SME Server development team
1	stephdl	1.32	Koozali SME Server 8.2 Release Notes
2
3			====================================
4
5
6
7			18 March 2015
8
9
10
11			The Koozali SME Server (SME Server) development team is pleased to announce
12
13			the release of SME Server 8.2 which is based on CentOS 5.11
14	wellsi	1.2
15
16
17	wellsi	1.3	Bug reports and reports of potential bugs should be raised in the bug
18	stephdl	1.32
19	wellsi	1.3	tracker (and only there, please);
20	wellsi	1.2
21	stephdl	1.32
22
23	wellsi	1.2	http://bugs.contribs.org/
24
25	stephdl	1.32
26
27			Download
28
29			========
30
31
32
33			You can download SME Server 8.2 from
34
35			http://mirror.contribs.org/smeserver/releases/8.2/iso/x86_64/
36
37			or for other methods see http://wiki.contribs.org/SME_Server:Download
38
39
40
41			Please note it may take up to 48 hours for mirrors to finish syncing,
42
43			during this time you may experience problems.
44
45
46
47
48
49	wellsi	1.2	About SME Server
50	stephdl	1.32
51	wellsi	1.2	================
52
53	stephdl	1.32
54
55	wellsi	1.2	SME Server is the leading Linux distribution for small and medium
56	stephdl	1.32
57	wellsi	1.23	enterprises. SME Server is brought to you by Koozali Foundation, Inc.,
58	stephdl	1.32
59	wellsi	1.23	a non-profit corporation that exists to provide marketing and legal support
60	stephdl	1.32
61	wellsi	1.23	for SME Server.
62	wellsi	1.2
63	stephdl	1.32
64
65	wellsi	1.5	SME Server is freely available under the GNU General Public License and
66	stephdl	1.32
67	wellsi	1.5	is only possible through the efforts of the SME Server community.
68	stephdl	1.32
69	wellsi	1.2	However, the availability and quality of SME Server is dependent on
70	stephdl	1.32
71	wellsi	1.2	meeting our expenses, such as hosting costs, server hardware, etc.
72
73	stephdl	1.32
74
75	wellsi	1.22	As such, we ask for a donation to offset costs and fund further development.
76	stephdl	1.32
77
78
79	wellsi	1.22	a) If you are a school, a church, a non-profit organisation or an individual
80	stephdl	1.32
81	wellsi	1.22	using SME Server for private purposes, we would appreciate you to contribute
82	stephdl	1.32
83	wellsi	1.22	within your means toward the costs associated with hosting, maintenance and
84	stephdl	1.32
85	wellsi	1.2	development.
86	stephdl	1.32
87
88
89	wellsi	1.22	b) If you are a company or an integrator and you are deploying SME Server in
90	stephdl	1.32
91	wellsi	1.22	the course of your work to generate revenue, we expect you to make a donation
92	stephdl	1.32
93	wellsi	1.22	commensurate with the level of revenue you generate and the number of servers
94	stephdl	1.32
95	wellsi	1.22	your have in the field. Please, help the project
96	wellsi	1.2
97	stephdl	1.32
98
99	wellsi	1.4	Please visit http://wiki.contribs.org/Donate to donate.
100	wellsi	1.2
101	stephdl	1.32
102
103	wellsi	1.23	Koozali Inc is happy to supply an invoice for any donations received,
104	stephdl	1.32
105	wellsi	1.23	simply email treasurer@koozali.org
106	wellsi	1.22
107	stephdl	1.32
108
109
110
111	wellsi	1.22	Thanks
112	stephdl	1.32
113	wellsi	1.22	======
114	wellsi	1.15
115	stephdl	1.32
116
117	wellsi	1.15	The development team would like to thank all of those who have involved
118	stephdl	1.32
119	wellsi	1.22	themselves with this release.
120	wellsi	1.15
121	stephdl	1.32
122
123
124
125	wellsi	1.15	Notes
126	stephdl	1.32
127	wellsi	1.15	=====
128
129	stephdl	1.32
130
131			1. CentOS 5 has dropped support for i586 and therefore SME Server 8.2
132
133	wellsi	1.15	will not work on i586 hardware. [See bugzilla:2845]. i586 hardware
134	stephdl	1.32
135	wellsi	1.15	means processors before and including Intel Pentium, Pentium MMX;
136	stephdl	1.32
137	wellsi	1.15	AMD K5, K6, K6-II, K6-III and Via C3. i686 architecture processors
138	stephdl	1.32
139	wellsi	1.15	are Intel Pentium Pro, Pentium II, Pentium III; AMD Athlon,
140	stephdl	1.32
141	wellsi	1.15	Athlon XP and later.
142
143	stephdl	1.32
144
145			2. Some notes on SME Server 8.2 including help on upgrades can be found at
146
147	wellsi	1.15	http://wiki.contribs.org/SME_Server_8
148
149	stephdl	1.32
150
151			3. Please note Upstream policy on Production Phase 3 for EL5. Only those
152
153			security updates deemed crucial are now being released upstream for EL5
154
155			(so also for SME8) The Koozali team recommends that you start moving
156
157			workloads from SME Server 8 to SME Server 9.
158
159			Planned EOL for CentOS 5 is Mar 31 2017
160
161
162
163			4. Please note it may take up to 48 hours for mirrors to finish syncing,
164
165	wellsi	1.15	during this time you may experience problems.
166	stephdl	1.32
167			You can download SME Server 8.2 from
168
169			http://mirror.contribs.org/smeserver/releases/8.2/iso/i386/
170
171	wellsi	1.15	or for other methods see http://wiki.contribs.org/SME_Server_8
172
173	wellsi	1.30
174
175	wellsi	1.28
176	wellsi	1.21
177	wellsi	1.2	Changes in this release
178	stephdl	1.32
179	wellsi	1.2	=======================
180
181	stephdl	1.32
182
183	wellsi	1.16	Packages altered by Centos, Redhat, and Fedora-associated developers are
184	stephdl	1.32
185	wellsi	1.15	not included.
186	wellsi	1.5
187	wellsi	1.17
188	stephdl	1.32
189
190
191	wellsi	1.5	Backups
192	stephdl	1.32
193	wellsi	1.5	-------
194	stephdl	1.32
195			- Add pkgconfig dar
196
197			- New Upstream Version dar
198
199			- Add requires nfs-utils
200
201			- The nfs service is neither started or allowed to start
202
203			- Workstation Backup, do not create folder in /
204
205
206	wellsi	1.24
207	wellsi	1.5
208	wellsi	1.17
209	stephdl	1.32	LDAP
210	wellsi	1.10
211			----
212	stephdl	1.32
213			- Make pdbedit output independent from locale and timezone so it can be
214
215			parsed
216
217	wellsi	1.17
218	wellsi	1.5
219			Localisation
220	stephdl	1.32
221	wellsi	1.5	------------
222	stephdl	1.32
223			- apply locale 2015-03-14 patch from pootle
224
225			- apply locale 2014-12-25 patch from pootle
226
227			- apply locale 2014-03-08 patch from pootle
228
229	wellsi	1.5
230	wellsi	1.17
231	wellsi	1.5	Mail Server
232	stephdl	1.32
233	wellsi	1.5	-----------
234	stephdl	1.32
235			- Updated to ClamAV release 0.98.6
236
237			- Updated to release ClamAV 0.98.5
238
239			- Add BuildRequires for openssl-devel and libxml2-devel
240
241			- Remove Packager and Vendor from ClamAV spec file.
242
243			- Updates to release ClamAV 0.98.4.
244
245			- Updated to release ClamAV 0.98.3.
246
247			- Remove the patch e-smith-email-5.2.0-UEsDBBQDAAAIA-new-signature.patch
248
249			- Add new zip file signatures to default mailpatterns database :
250			UEsDBBQDAAAIA
251
252			- Add new zip file signatures to default mailpatterns database : ZIPVOSX &
253			ZIPV3
254
255			- Fix stunnel path
256
257			- Use stunnel instead of sslio to support TLS
258
259			- Modify whitelist_soft transaction to interact with dnsbl filter
260
261			by John Crisp <jcrisp@safeandsoundit.co.uk>
262
263			- Remove DENYSOFT on SPF softfail qpsmtpd
264
265			- Increase MemLimit to 700M for clamav-0.98
266
267			- Remove dnsbl.ahbl.org RBL List
268
269
270	wellsi	1.5
271			Server manager
272	stephdl	1.32
273	wellsi	1.5	--------------
274	stephdl	1.32
275			- Resync with upstream php53, which include
276
277			fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710
278
279			xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
280
281			core: fix integer overflow in unserialize() CVE-2014-3669
282
283			exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
284
285			- Resync with upstream php53, which include
286
287			spl: fix use-after-free in ArrayIterator due to object
288
289			change during sorting. CVE-2014-4698
290
291			spl: fix use-after-free in SPL Iterators. CVE-2014-4670
292
293			gd: fix NULL pointer dereference in gdImageCreateFromXpm.
294
295			CVE-2014-2497
296
297			fileinfo: fix incomplete fix for CVE-2012-1571 in
298
299			cdf_read_property_info. CVE-2014-3587
300
301			core: fix incomplete fix for CVE-2014-4049 DNS TXT
302
303			record parsing. CVE-2014-3597
304
305			- Resync with upstream php53, which include
306
307			core: type confusion issue in phpinfo(). CVE-2014-4721
308
309			date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
310
311			core: fix heap-based buffer overflow in DNS TXT record parsing.
312
313			CVE-2014-4049
314
315			core: unserialize() SPL ArrayObject / SPLObjectStorage type
316
317			confusion flaw. CVE-2014-3515
318
319			fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
320
321			fileinfo: unrestricted recursion in handling of indirect type
322
323			rules. CVE-2014-1943
324
325			fileinfo: out of bounds read in CDF parser. CVE-2012-1571
326
327			fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
328
329			fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
330
331			fileinfo: cdf_unpack_summary_info() excessive looping
332
333			DoS. CVE-2014-0237
334
335			fileinfo: CDF property info parsing nelements infinite
336
337			loop. CVE-2014-0238
338
339
340
341	wellsi	1.17
342	wellsi	1.5
343			Web Server
344	stephdl	1.32
345	wellsi	1.5	----------
346	stephdl	1.32
347			- Disable SSLv3
348
349			- Revert CRIME mitigation patch, as it's not needed
350
351			- Mitigate CRIME, CVE-2012-4929
352
353	wellsi	1.17
354	wellsi	1.5
355			Other fixes and updates
356	stephdl	1.32
357	wellsi	1.5	-----------------------
358	stephdl	1.32
359			- When quiting the console app with unsaved changes set the default selected
360
361			answer to NO
362
363			- Add a verification in the console of number of pptp clients against ip
364			allowed in dhcpd
365
366			- Add a verification in remoteaccess panel of number of pptp clients against
367			ip allowed in dhcpd
368
369			- Reset primary ibay default type
370
371			- Add a migrate fragment to sanitize the host comment for illegal characters
372			in the server-manager.
373
374			Sanitize existing hostname records, Add a validator for the comment in the
375			hostname field
376
377			Code done by Charlie Brady <charlieb-contribs-bugzilla@budge.apana.org.au>
378
379			and Huib <sme@artixdesign.com>
380
381			- Force SSL following ibays settings to the relevant domain
382
383			- Move mysql logging to multilog
384
385			- Allow ntp status queries from localhost.
386
387			- Avoid uninitialized variable warning from last update.
388
389			- Add ssh-autoblock for external interface - patch by Chris Maltby
390
391			- Update to upstream version 2.3.4, which fixes CVE-2012-3478 and
392			CVE-2012-2252
393
394			- Updated rsync-protocol.patch to fix CVE-2012-2251, and to apply on top of
395			the
396
397			CVE-2012-3478 and CVE-2012-2252 fixes.
398
399			- Updated makefile.patch to preserve RPM CFLAGS.
400
401			- Added command-line-error.patch (from Debian), correcting error message
402
403			generated when insecure command line option is used (CVE-2012-3478 fix
404
405			regression).
406
407			- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
408
409			- Add patch for rsync3 compat (#485946)
410
411			- Update smeserver-release for beta1 of SME Server 8.2
412
413			- Set the check update frequency of smecontribs through the server-manager
414
415			- Add a default Yum db property for check4contribsupdates
416
417			- Added a check-update for the smecontribs repository
418
419
420
421	wellsi	1.25
422	wellsi	1.2
423			General features
424	stephdl	1.32
425	wellsi	1.2	================
426
427	wellsi	1.7
428	stephdl	1.32
429			- Based on CentOS 5.11 and all available updates
430
431
432
433			Terry Fage
434
435			On behalf of the SME Server development team