Eduardo Chappa
2021-09-20 01:37:35 UTC
Dear Alpiners,
it is my pleasure to announce the new release of Alpine, version 2.25.
This new version has new features and bug fixes. The complete list of
changes can be found in the release notes, which you can access from the
main screen of Alpine, by pressing "R".
These are direct links to the relevant files:
Source code
http://alpine.x10host.com/alpine/release/src/alpine-2.25.tar.xz
MD5: 50e59c7979f43fcc7a45e43760e2a97d
SHA256: 658a150982f6740bb4128e6dd81188eaa1212ca0bf689b83c2093bb518ecf776
64-bits version of Alpine
http://alpine.x10host.com/alpine/release/src/alpine-2.25.zip
MD5: 0aa2f784549fb4e144182a38e95033a1)
SHA256: b97cddad140a00e91d17a33d4029731033586718660d4acbaa8c3dc8cb54e581)
32-bits version of Alpine
http://alpine.x10host.com/alpine/release/src/alpine-2.25_32bits.zip
MD5: 351f72709ac3ee12f17e489955da8e39
SHA256: 28a9740a7fdcfe11301d5950404d229d2a8cda605d114dc1ba807cf2d36b0f79
It is worth noticing that this version fixes a new vulnerability of
Alpine in the imap code. Versions previous to this version accept untagged
replies from an imap server and process them as if Alpine were in
authenticated state. An attacker could use this to make Alpine crash,
leading to a denial of service. I am not aware that this could be
exploited in any other way. This vulnerability exists in all version of
alpine up to 2.24 (or any program built with the c-client library.)
See more details at
https://nvd.nist.gov/vuln/detail/CVE-2021-38370
and
https://nostarttls.secvuln.info/
Enjoy the new release of Alpine.
it is my pleasure to announce the new release of Alpine, version 2.25.
This new version has new features and bug fixes. The complete list of
changes can be found in the release notes, which you can access from the
main screen of Alpine, by pressing "R".
These are direct links to the relevant files:
Source code
http://alpine.x10host.com/alpine/release/src/alpine-2.25.tar.xz
MD5: 50e59c7979f43fcc7a45e43760e2a97d
SHA256: 658a150982f6740bb4128e6dd81188eaa1212ca0bf689b83c2093bb518ecf776
64-bits version of Alpine
http://alpine.x10host.com/alpine/release/src/alpine-2.25.zip
MD5: 0aa2f784549fb4e144182a38e95033a1)
SHA256: b97cddad140a00e91d17a33d4029731033586718660d4acbaa8c3dc8cb54e581)
32-bits version of Alpine
http://alpine.x10host.com/alpine/release/src/alpine-2.25_32bits.zip
MD5: 351f72709ac3ee12f17e489955da8e39
SHA256: 28a9740a7fdcfe11301d5950404d229d2a8cda605d114dc1ba807cf2d36b0f79
It is worth noticing that this version fixes a new vulnerability of
Alpine in the imap code. Versions previous to this version accept untagged
replies from an imap server and process them as if Alpine were in
authenticated state. An attacker could use this to make Alpine crash,
leading to a denial of service. I am not aware that this could be
exploited in any other way. This vulnerability exists in all version of
alpine up to 2.24 (or any program built with the c-client library.)
See more details at
https://nvd.nist.gov/vuln/detail/CVE-2021-38370
and
https://nostarttls.secvuln.info/
Enjoy the new release of Alpine.
--
Eduardo
Eduardo