Date:         Fri, 14 Apr 2000 23:04:56 -0700
From: Dan Harkless <dan-pgp2@DILVISH.SPEED.NET>
Subject:      nmh-1.0.4 released
To: BUGTRAQ@SECURITYFOCUS.COM

-----BEGIN PGP SIGNED MESSAGE-----

Greetings.  nmh 1.0.4 has just been released.  It is available at:

    ftp://ftp.mhost.com/pub/nmh/nmh-1.0.4.tar.gz

Also in that directory is nmh-1.0.4.tar.gz.asc, a PGP 2.6.2 signature made
with my public key, available from the public keyservers (this message is
also signed with that key).  Cryptographic hash of the archive:

    MD5 (nmh-1.0.4.tar.gz) = fd0dc5c84f67cfbcdfdc1196a5298e47

This release of nmh is primarily a bugfix release.  Visible changes, in
brief (order is that of implementation):

   * inc into a full filesystem no longer results in loss of mail.

   * initgroups() declaration portability fix for FreeBSD, etc.

   * GECOS field '&' translation now activated by BSD42 #define instead of
     GCOS_HACK.

   * There are now three types of email address masquerading.  Rather than
     having them all be turned on by having "mmailid: 1" in the mts.conf,
     they can be individually enabled on a "masquerade: draft_from mmailid
     username_extension" line.  draft_from and mmailid were present in
     1.0.3, but username_extension is new -- if active, users can set a
     $USERNAME_EXTENSION environment variable to values like "+usenet" or
     "-pgp2" to have those values appended to their usernames on the From:
     line of outgoing mails.  This feature is meant to interoperate with the
     analogous one of MTAs like sendmail and qmail.

   * ',' considered a delimiter even when "mmailid" processing active.

   * Fixed memory corruption bug when examining mmdf mailboxes.

   * New mhshow-suffix-* lines in mts.conf allow use of MIME part viewing
     programs that only work properly when the

   * A wrap-around problem in the implementation of "Zeller's congruence"
     was causing incorrect day-of-week calculations after Feb 29, 2000.

   * New --with-smtpservers configure parameter to avoid mts.conf editing.

   * Similar --enable-masquerade parameter for the "masquerade:" line.

   * Some MUAs, such as elm and dxmail, have been generating an illegal "00"
     year since January 1.  Fix to "2000" when displaying mail from these.

   * New scan.MMDDYY and scan.YYYYMMDD format files.

   * 1.0.3 incorrectly required Folder-Protect octal constant to start w/ 0.

   * Again possible to hardcode nmh to always use KPOP instead of POP3.

   * Fixed a core dump in packf triggered by corrupted mail files.

   * 1.0.3 was announced on bugtraq due to its fix for a security hole
     relating to shell metacharacters in MIME headers.  Unfortunately, there
     were bugs in the quoting code that closed the hole.  These bugs have
     hopefully now all been fixed.  MH and nmh users who decided not to
     upgrade to 1.0.3 because of these bugs are encouraged to upgrade to
     1.0.4.

   * MH changelogs added back into the distribution.

   * Single-character format strings no longer cause a seg fault.

   * mhshow-charset-iso-8859-1 line does not work with quotes around %s.

A detailed description of the changes between 1.0.3 and 1.0.4 is available
from:

    http://www.mhost.com/cgi-bin/cvsweb/nmh/ChangeLog?r1=1.40&r2=1.71

For more information on nmh, please visit:

    http://www.mhost.com/nmh/


Thanks for your time,

  Dan Harkless <dan-pgp2@dilvish.speed.net>,
  for the nmh developers

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBOPf+s7TTeQ7w/jtdAQEGkwQA103RHjErZuVU+vwG7jPtiF2wYrUQS+3a
wI4oDJAeigF/3SnXsq74JwEdNrh8LzFrqQZJfiv0qgb3pBRpAnQYSnwJRfbND4m4
4xrETYx++xwWWc+xMfS6r4FkHLmCf5bh4N07aLLzXeKKR3sCOsCybjHHYMyFRL1K
4THFoRLSqvM=
=UGNW
-----END PGP SIGNATURE-----