CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

mail/qmail 1.06_7

Secure, reliable, efficient, simple, and fast MTA

Port info

Maintainer
erdgeist@erdgeist.org
Packages
latest: 1.06_7
Upstream
up to date
Last update
to 1.06_7 · fff227115a
Quarterly
2026Q4: 1.06_7
WWW
https://cr.yp.to/qmail.html
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install netqmail
installs 1.06_7 from latest; from quarterly (2026Q4) 1.06_7
Port
# cd /usr/ports/mail/qmail && make install clean
# make -C /usr/ports/mail/qmail config  # change options first
Size
258 KiB download · 1.0 MiB installed
Depends on
nothing
Creates
user alias, qmaild, qmaill, qmailp, qmailq, qmailr, qmails, group qmail, qnofiles
Options
3 of 16 on in the package: DNS_CNAME DOCS RCDLINK
Show the 13 options that are off
BIG_CONCURRENCY_PATCH BIG_TODO_PATCH BLOCKEXEC_PATCH DISCBOUNCES_PATCH EXTTODO_PATCH LOCALTIME_PATCH MAILDIRQUOTA_PATCH OUTGOINGIP_PATCH QEXTRA QMTPC_PATCH SMTP_AUTH_PATCH SPF_PATCH TARPIT_PATCH
pkg-message
Shown after installing
ATTENTION:

You can enable qmail as your default mailer executing:
> /var/qmail/scripts/enable-qmail

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.06_71.06_7–
FreeBSD 151.06_71.06_7–
FreeBSD 141.06_71.06_71.06_7

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.06_71.06_7–
FreeBSD 141.06_71.06_71.06_7

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 1.06_7 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2020-38117.52020-05-26qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.
CVE-2020-38125.52020-05-26qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere …

VuXML only (0)

Listed in VuXML, the packaged version 1.06_7 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (287)

Renato Botelho (garga) · 1.03_7
Update spamcontrol patch to 2527
19c5907d88
Renato Botelho (garga) · 1.03_7
Fix docs installation on qmail-ldap

PR:		ports/140866
Submitted by:	Hiroyuki Seino <seichan-ml@wakhok.ne.jp>
32565f020f
Renato Botelho (garga) · 1.03_7
- Update (fix bug) SMTPEXTFORK code (affects only qmail-ldap port) - Add JMS's Greet Delay feature on Qmail-LDAP - Enhace qmail-smtpd logs (spamcontrol-like) on qmail-ldap

PR:		ports/140255
Submitted by:	Patrick Tracanelli <eksffa@freebsdbrasil.com.br>
8dc5f0acd2
Renato Botelho (garga) · 1.03_7
Fix qmtpc + outgoingip patch to prevent a segfault when both are applied

PR:		ports/136176
Submitted by:	Bryan Drewery <bryan@shatow.net>
c2123b387e
Renato Botelho (garga) · 1.03_7
- Fix shell errors on make certificate

PR:		ports/136082
Submitted by:	Bryan Drewery <bryan@shatow.net>
a8194128d7
Renato Botelho (garga) · 1.03_7
- Update qmail-spamcontrol to 2525a
cc97a5cc60
Renato Botelho (garga) · 1.03_7
- Update to 2523
b9974ad42c
Renato Botelho (garga) · 1.03_7
- Fix segfaulting on amd64 adding alloc.h on cdbmake_add.c

PR:		ports/133709
Submitted by:	Milos Vyletel <milos.vyletel@gmail.com>
6dace6b6ad
Renato Botelho (garga) · 1.03_7
- Make SENDERCHECK4 patch respect OPTIONS - Bump PORTREVISION

Submitted by:	Martin Lesser <ml@bettercom.de>
Approved by:	portmgr (pav)
1723e851f3
Renato Botelho (garga) · 1.03_7
Mark all my ports as MAKE_JOBS_SAFE and MAKE_JOBS_UNSAFE
c9e008f727
Renato Botelho (garga) · 1.03_7
- Add SENDERCHECK4 patch for qmail-ldap, off by default, patch description:

This is a small change to SENDERCHECK feature in Qmail-LDAP which adds a new
option called LOOSERELAY. It will allow the very same checks that "LOOSE"
options do but exclusvely for RELAY clients.

Therefore it is a split-horizon approach to the problem where our relayclients
spoofs outgoing envelope sender causing abuses like phishing.

Suggested by:	Patrick Tracanelli (author)
b6803ee694
Renato Botelho (garga) · 1.03_7
- Update spamcontrol to 2522

Submitted by:	Erwin Hoffman (author)
977be399ce
Renato Botelho (garga) · 1.03_7
- Remove qmail-custom-error patch for qmail-ldap, jmelo, that sent me this in   the past detected a big problem with this and couldn't find a solution yet,   better removing it for now and wait new version.

Sugested by:	jmelo
ee3d5ea20e
Renato Botelho (garga) · 1.03_7
- Update smtpdextfork patch for qmail-ldap to 20060201_3 version

Submitted by:	Patrick Tracanelli9 (author)
b071acbcbb
Renato Botelho (garga) · 1.03_7
- Update spamcontrol to 2521 to fix recipients problem included by last version - Remove spamcontrol spf patch MD% from distinfo, forgot un 2.5 upgrade

PR:		ports/131889
Submitted by:	howard goldstein <hg@queue.to>
92f6d356a3
Renato Botelho (garga) · 1.03_7
- Update spamcontrol patch to 2.5.20 version to fix some problems with   recupients - Update README.smtpdextfork distinfo entry, file was updated by author
beaa34148f
Renato Botelho (garga) · 1.03_7
- Spamcontrol patch 2.5.19 was rerolled, it's documented on errata section at website:

[2.5.19] Rebuild: Updated README_spamcontrol, fixed fatal typo in qmail-queue.scan.

- Bump PORTREVISION
8513f119a8
Renato Botelho (garga) · 1.03_7
- Update spamcontrol patch collection to 2519

For more information about this version, please check:

http://fehcom.de/qmail/spamcontrol/README_spamcontrol.html

Tested by:	Sirko Zidlewitz <sz@bytecamp.net>
Thanks to:	Erwin Hoffmann <feh@fehcom.de>
209f586611
Renato Botelho (garga) · 1.03_7
- Update qmail-spamcontrol's smtpdextfork patch to last version

Submitted by:	Patrick Tracanelli (Author by icq)
24d83930d0
Renato Botelho (garga) · 1.03_7
- Add qmail-custom-error, a new patch for qmail-ldap port, off by default. It   permits you to set custom error messages for rejected messages.

Sugested by:	jmelo
Tested by:	jmelo
33baaddc45
Renato Botelho (garga) · 1.03_7
- Fix a bug detected on spamcontrol patch. This but is in qmail-smtpd.c, when   qmail_close return a reason that starts with char 'D', smtpd rejects the   message using a QHPSI virus_found message. - Bump qmail-spamcontrol's PORTREVISION

Reported by:	Wendell Martins Borges <wendellmartins@mac.com>
Tested by:	Wendell Martins Borges <wendellmartins@mac.com>
b1263ba741
Renato Botelho (garga) · 1.03_7
- Add a warning on pkg-install about rc.d/qmail.sh symlink and show to user   the way to have it working

PR:		ports/125740
Submitted by:	G. Georgiev <roots_bg@yahoo.com>
96a69840e6
Renato Botelho (garga) · 1.03_7
- Fix pkg-install to create initial aliases correctly, broken when was rewritten from csh to sh - Bump PORTREVISION from all slave ports
63f3b93b3d
Renato Botelho (garga) · 1.03_6
- Fix qmail-tls to accept connections if control/tlsserverciphers doesn't   exist [1] - Bump PORTREVISION - Cometic fixes, s/!defined(WITHOUT/defined(WITH/

PR:		ports/119954 (based on)
Submitted by:	Luiz Otavio O Souza <loos.br@gmail.com>
982efb813c
Renato Botelho (garga) · 1.03_6
- Fix pkg-install's user detection

PR:		ports/119935
Submitted by:	Simon Shapiro <simon@niftywerks.com>
0517a32fc9
Renato Botelho (garga) · 1.03_6
- Convert pkg-install from csh to sh, since it's the default on ports

Reviewed by:	miwi
1a8f8ec40b
Renato Botelho (garga) · 1.03_6
- Fix segfault on 64-bit platforms on qmail-spamcontrol like was made on   another slave ports.
e959d2c1c8
Renato Botelho (garga) · 1.03_6
- Fix a segfault on amd64 (except on qmail-spamcontrol and qmail-ldap) [1] - Add an rcNG startup example file to QMAIL_PREFIX/boot [2] - Bump PORTREVISION due to rcNG add (except for qmail-ldap) - Fix make certificate to add ciphers file to QMAIL_PREFIX/control [3]

PR:		ports/118117 [1], ports/117422 [2], ports/118198 [3]
Submitted by:	Andrew Reilly <areilly@bigpond.net.au> [1] [3]
		Nick@van-laarhoven.org [2]
e1ab2d0519
Renato Botelho (garga) · 1.03_5
- qmail license has changed to public domain, so, remove RESTRICTED

http://cr.yp.to/qmail/dist.html
8e7eb7871b
Renato Botelho (garga) · 1.03_5
- Add SMTPEXTFORK patch to qmail-ldap - Add one more mastersite for this patch - Cosmetic changes
aa11fe8441
Renato Botelho (garga) · 1.03_5
Revert last commit that added a rnCG example file, the script was totally out of defaults from Porters Handbook and was an error add it.

Suggested by:	many people
e82d707579
Renato Botelho (garga) · 1.03_5
- Add a rcNG startup script to ${PREFIX}/boot

PR:		ports/110109
Submitted by:	kitsune <v.velox@vvelox.net>
c5f3f70024
Renato Botelho (garga) · 1.03_5
- Update smtpextfork patch for qmail-spamcontrol: 	o Use strncpy instead of strcpy 	o Limit memory buffers and fix QUIT_ASAP behavior on SMTP sessions, 	  which may break some RFCs. Instead, the default behavior now is 100% 	  RFC complaint. The old QUITASAP behavior, sometimes desired for a 	  number of users (used to be default behavior on Spamcontrol in the 	  past) is now a build option (XF_QU

Submitted by:	Patrick Tracanelli (Author, by email)
ef9af68920
Renato Botelho (garga) · 1.03_5
- Update spamcontrol to 2.4.18 - Some cosmetic changes
abbc2fbbbd
Renato Botelho (garga) · 1.03_5
Add a simple but very functional native feature of qmail, the use of QUEUE_EXTRA option, as described in http://cr.yp.to/qmail/faq/admin.html. Can be used with every slaveport.

PR:		ports/108987
Submitted by:	Patrick Tracanelli <eksffa@freebsdbrasil.com.br>
9d6b51a247
Renato Botelho (garga) · 1.03_5
Add smtpextfork patch to qmail-spamcontrol.

This is a patch made by Patrick Tracanelli <eksffa@freebsdbrasil.com.br> that
allow qmail-smtpd to fork external programs and wait for return code to answer
a permanent or temporary failure.

More information on:

http://www6.freebsdbrasil.com.br/~eksffa/l/dev/qmail-smtpextfork/patches/README.smtpextfork

A version to qmail-ldap is comming soon.
885cd2500c
Renato Botelho (garga) · 1.03_5
Update spamcontrol to 2417
80eca2f197
Renato Botelho (garga) · 1.03_5
- RBL2SMTPD patch was not logging URL reference

Reported by:	Patrick Tracanelli <eksffa@freebsdbrasil.com.br>
8136c101ce
Renato Botelho (garga) · 1.03_5
Fix WITH / WITHOUT OPTIONS check

Noted by:	oliver
adfb0de53e
Kris Kennaway (kris) · 1.03_5
RESTRICTED is intended instead of NO_PACKAGE
27ca282f7a
Renato Botelho (garga) · 1.03_5
Fix DISTFILES entry to ext_todo that is killing SPF patch on spamcontrol

Reported by:	Marcos Tischer Vallim <tischer at gmail.com>
f7c8562a14
Renato Botelho (garga) · 1.03_5
Permit big_todo and ext_todo be applied together

Reported by:	Carlos A. Talhati <cat at iqsc.usp.br>
515ae25583
Renato Botelho (garga) · 1.03_5
Register CONFLICTS between qmail master and all slave ports
40ea794f8f
Renato Botelho (garga) · 1.03_5
Prevent BIG_TODO and EXT_TODO patches to be installed together, they cannot coexist

Reported by:	Carlos A. Talhati <cat at iqsc.usp.br>
5edb36bcbf
Renato Botelho (garga) · 1.03_5
Fix outgoingip.patch-spamcontrol MASTER_SITE_SUBDIR
8178bf3c69
Renato Botelho (garga) · 1.03_5
Remove old PORT_NOTES and PORT_NOTES_FreeBSD_40-RELEASE, they are not so useful these days.
a86d546e46
Renato Botelho (garga) · 1.03_5
Add OUTGOINGIP patch to qmail-spamcontrol and qmail-tls slaveports
0a8407fc36
Renato Botelho (garga) · 1.03_5
- Change spamcontrol's spf patch to log when deny an email - Move auth patches from FILESDIR to MASTER_SITE_LOCAL
3d655dcd60
Renato Botelho (garga) · 1.03_5
Fix auth patch for qmail-tls

Submitted by:	Luiz Souza <luiz at visualconnect.com.br> by email
f5c06e857b
Renato Botelho (garga) · 1.03_5
Add SPF checker to qmail-spamcontrol port
5316677351