CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

mail/qmail 1.06_7

Secure, reliable, efficient, simple, and fast MTA

Port info

Maintainer
erdgeist@erdgeist.org
Packages
latest: 1.06_7
Upstream
up to date
Last update
to 1.06_7 · fff227115a
Quarterly
2026Q4: 1.06_7
WWW
https://cr.yp.to/qmail.html
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install netqmail
installs 1.06_7 from latest; from quarterly (2026Q4) 1.06_7
Port
# cd /usr/ports/mail/qmail && make install clean
# make -C /usr/ports/mail/qmail config  # change options first
Size
258 KiB download · 1.0 MiB installed
Depends on
nothing
Creates
user alias, qmaild, qmaill, qmailp, qmailq, qmailr, qmails, group qmail, qnofiles
Options
3 of 16 on in the package: DNS_CNAME DOCS RCDLINK
Show the 13 options that are off
BIG_CONCURRENCY_PATCH BIG_TODO_PATCH BLOCKEXEC_PATCH DISCBOUNCES_PATCH EXTTODO_PATCH LOCALTIME_PATCH MAILDIRQUOTA_PATCH OUTGOINGIP_PATCH QEXTRA QMTPC_PATCH SMTP_AUTH_PATCH SPF_PATCH TARPIT_PATCH
pkg-message
Shown after installing
ATTENTION:

You can enable qmail as your default mailer executing:
> /var/qmail/scripts/enable-qmail

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.06_71.06_7–
FreeBSD 151.06_71.06_7–
FreeBSD 141.06_71.06_71.06_7

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.06_71.06_7–
FreeBSD 141.06_71.06_71.06_7

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 1.06_7 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2020-38117.52020-05-26qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.
CVE-2020-38125.52020-05-26qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere …

VuXML only (0)

Listed in VuXML, the packaged version 1.06_7 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (287)

Mario Sergio Fujikawa Ferreira (lioux) · 1.03_1
Update tls.patch checksum (required by slave port qmail-tls)

PR:		27954
Submitted by:	Jeff Palmer <scorpio@drkshdw.org>
fd84038273
Mario Sergio Fujikawa Ferreira (lioux) · 1.03_1
1) Fix bug introduced in Makefile rev 1.29: files/maildir not    replacing @PREFIX@ with ${PREFIX} 2) Rewrite rc script patching to both handle more cases and    fix (1). Mostly within thereal-post-patch target 3) Update files/maildir both due to (2) and to resemble the rc    scripts supplied with the qmail distribution

Prompted by:	Thomas Sarlandie <sarfata@altern.org>
1a32f86a3f
Mario Sergio Fujikawa Ferreira (lioux) · 1.03_1
Add updated distinfo for qmail-ldap slave port: ldap patch version 20010301
8d0b03efd4
Mario Sergio Fujikawa Ferreira (lioux) · 1.03_1
Add {start|stop} support to the initialization (rc.d style) scripts. Also, add a informational message if the user does not use the scripts correctly.
90a7b13a96
Mario Sergio Fujikawa Ferreira (lioux) · 1.03_1
* qmail port o bump PORTREVISION o sanitize MASTER_SITES o added several flags (defined checks) to enable active slave port control on what they inherit o add extra enhancement patches, these can be inherited too: 	- WITH_QMAILQUEUE_PATCH: qmailqueue-patch 	- WITH_BIG_TODO_PATCH: big-todo.103.patch 	- WITH_BIG_CONCURRENCY_PATCH: big-concurrency.patch 		- WITH_BIG_CONCURRENCY_PATCH_CONCURRENCY_LIMI

* qmail-ldap port
o bump PORTREVISION in sync with master port bump
o minor changes to comply to recent changes to the master
port
o block the WITH_BIG_CONCURRENCY_PATCH, it does not like
the qmail-ldap patch
o enable SMTP TLS support with WITH_TLS
	- the PKGNAMESUFFIX changes to -ldap-with_tls
	- let it know the location of QMAIL_TLS_PORT
	- add certificate and certificate-req; in fact,
		we are inheriting qmail-tls targets
 o s/yetanotherone-/slaveport-/: that is the correct
nomenclature
o tabulate better the WITH_* advertisement messages
o add appropriate message to PKGMESSAGE about the
new certificate targets following the qmail-tls
port
o nomenclature fix: ^ldap- -> ^qmail-ldap-

* qmail-mysql port
o bump PORTREVISION in sync with master port bump
o block the WITH_QMAILQUEUE_PATCH, it does not like
the qmail-mysql patch
o s/yetanotherone-/slaveport-/: that is the correct
nomenclature

* qmail-tls port
o bump PORTREVISION in sync with master port bump
o minor changes to comply to recent changes to the master
port
o s/yetanotherone-/slaveport-/: that is the correct
nomenclature
o nomenclature fix: ^tls- -> ^qmail-tls-
224a6052af
Mario Sergio Fujikawa Ferreira (lioux) · 1.03
Add some bell and whistles that will enable better support for the qmail-* skeleton ports inheriting (including) this port

While there, update NO_PACKAGE with a more informative message.
The NO_PACKAGE variable will be inherited by all meta ports

Since qmail-{ldap,mysql,tls} are meta ports sharing qmail's port
code, update qmail distinfo information with new distribution
patches:
	- Add new distinfo information required by updated qmail-ldap
	version 1.03.20010201
	- Add new distinfo for recently added port qmail-tls and
	qmail-mysql

In PLIST, use recently added PORTDOCS variable support

PORTREVISION bump is not necessary.
4729a174ab
Thomas Gellekum (tg) · 1.03
Don't package, the license doesn't allow this.
b628afeb73
Mario Sergio Fujikawa Ferreira (lioux) · 1.03
The PATCHFILES file owner pointed out that a secondary location should be provided for his patch since there was only one official location. Appropriate arrangements have been made to house it under ${MASTER_SITE_LOCAL}.

PORTREVISION bump is not necessary.

Submitted by:	Christopher K Davis <ckd@ckdhr.com>
74475a5ded
Mario Sergio Fujikawa Ferreira (lioux) · 1.03
Add yet another WITH option to qmail-ldap. This time a WITH_LDAP_DEBUG option for those in pursue of enlightment.

While there, update NO_PACKAGE with a more informative message.
Along with addition of appropriate LEGAL information.

Also, since qmail-ldap is a meta port sharing qmail's port code,
update qmail distinfo information with the new distribution patch
required by the qmail-ldap port. This is a typo fix. This was missed
on revision 1.6 of qmail-ldap.

Submitted by: Cristhian Venegas <cvb@deltron.net>
27cb3a7160
Mario Sergio Fujikawa Ferreira (lioux) · 1.03
I added a warning for pre-mailwrapper users about the "danger" of making world; thus, "destroying" their qmail installation. A target should be added later to "fix" this automatically.

PR:		ports/22269
Submitted by:	Gavin Cameron <gavin@itworks.com.au>
Discussed by:	Chris Faulhaber <jedgar@fxp.org>
Discussed by:	Neil Blakey-Milner <nbm@mithrandr.moria.org>
5d3c37186a
Satoshi Asami (asami) · 1.03
Use variables for ${PKGDIR}/{INSTALL,MESSAGE}.  ${PKGINSTALL} is called twice without any arguments but I'm not sure what I should give it (it's once called from do-configure!) so I'll leave it alone.
495a8149cb
Mario Sergio Fujikawa Ferreira (lioux) · 1.03
Maintainer is now a committer, update email accordingly

Approved by: will
b327e9c777
Neil Blakey-Milner (nbm) · 1.03
Update qmail-ldap 1.03.20000701, and share logic in qmail port, and some other minor tweaks.

"However, this is not worth a PORTREVISION tag. I did not
change the behavior of the qmail port in any way."

PR:		21563
Submitted by:	Mario Sergio Fujikawa Ferreira <lioux@uol.com.br> (maintainer)
d2661fc1f2
Kevin Lo (kevlo) · 1.03
Simple MASTER_SITES clean up.

PR: 20771
Submitted by: MAINTAINER
efa850427e
Steve Price (steve) · 1.03
- Don't hardcode /usr/local. - Also add a mailer.conf that allows sendmail to be replaced with qmail.

PR:		19449
Submitted by:	Mike Meyer <mwm@mired.org> and maintainer
c0a42fd5da
Akinori MUSHA (knu) · 1.03
Output PREFIX safe pkg/MESSAGE.

PR:		ports/19188
Submitted by:	Maintainer
e83a709d64
Steve Price (steve) · 1.03
Fix pkg/PLIST and prepare this port to be the MASTERDIR for the upcoming qmail-ldap port.

PR:		18733
Submitted by:	maintainer
11f78ae3f7
Chris Piazza (cpiazza) · 1.03
Update to use PORTNAME/PORTVERSION
28849e36e9
Satoshi Asami (asami)
Don't use ${INSTALL_PROGRAM} to install a shell script.  While I'm here, take out a bunch of @'s, this Makefile is so hard to debug because the log contained no meaningful output.

PR:		17090 (report only, no fix)
c339b4dbc8
Chris Piazza (cpiazza)
Update MASTER_SITES and add a file explaining how to replace sendmail on 4.0 (mailwrapper)

PR:		16921
Submitted by:	maintainer
e690b295ee
Chris D. Faulhaber (jedgar)
Update Maintainer's email address

PR:		16399
Submitted by:	Maintainer
db680614ba
Chris Piazza (cpiazza)
Add a patch so that will accept the non-RFC >512 "AOL" DNS entries. Bad, yet necessary.

PR:		13699
Submitted by:	maintainer
2991e4885e
Peter Wemm (peter)
$Id$ -> $FreeBSD$
7b8fca1447
Michael Haro (mharo)
expr -> ${EXPR} mv   -> ${MV} rm   -> ${RM} tr   -> ${TR}
3262cce303
David E. O'Brien (obrien)
Change Id->FreeBSD.
f3a9c6c81e
Chris Piazza (cpiazza)
Use ${PERL5} instead of /usr/bin/perl

PR:		12199
Submitted by:	Nick Hibma <nick.hibma@jrc.it>
b2c4b25f76
Tim Vanderhoek (hoek)
Commit #3/4 to enforce caps, no period.

FWIW, checkout of these things took 5+hrs, staying on the local
.freebsd.org net w/o hitting the 'net at all.

As promised,

$ time cvs ci
real    67m51.701s
user    0m1.250s
sys     0m5.345s
dd9ff05a6a
Michael Haro (mharo)
Add (prepare to be shocked) WWW:
c7a56e9c3e
Satoshi Asami (asami)
Need to create etc/rc.d by myself if I'm not going to run mtree.
dcd9d6350f
Tim Vanderhoek (hoek)
Don't generate a PLIST on-the-fly.
446c0d1b28
Tim Vanderhoek (hoek)
Add a '&' to all bootfiles so they can be used directly as /usr/local/etc/rc.d/x.sh.
bce8695182
Tim Vanderhoek (hoek)
Remove BROKEN.  The gid/uid conflict only existed because other ports were improperly registered.
a4f73518af
Tim Vanderhoek (hoek)
Use qmail gid 82 (instead of 80).

Suggested-by:	asami's package-building machine
fd50a5e48f
Satoshi Asami (asami)
=== ## make package >> Checksum OK for qmail-1.03.tar.gz. ===>  Extracting for qmail-1.03 ===>  Patching for qmail-1.03 ===>  Applying FreeBSD patches for qmail-1.03 ===>  Configuring for qmail-1.03 pw: gid `80' has already been allocated Failed to add group qmail as gid 80 *** Error code 2 ===

Can the uid/gid checking be made a little more lenient?  Or choose
another one that's not used by other ports?
b7b94c790b
Tim Vanderhoek (hoek)
(null commit, as prompted by Eivind)

[This refers to the original r1.1]

PR:	ports/2993 ports/5985 ports/6917 ports/7145
Submitted-by:	Julian Assange <proff@suburbia.net>,
		Mario Sergio Fujikawa Ferreira <lioux@gns.com.br>,
		SADA Kenji <sada@e-mail.ne.jp>,
		Stuart Henderson <stuart@internationalschool.co.uk>,
		and probably myself.

ports/7145 contains stuff that may be useful for anyone trying to
implement a "qmail-run" script to be included with this port in the
future.
baa4484084
Tim Vanderhoek (hoek)
Ah, what-the-heck...one more qmail-related commit.

Mention that the commented-out PATCHFILES can't be expected to apply
to qmail-1.03.
68808e882f
Tim Vanderhoek (hoek)
I think most of us are familiar with that particular program.
64885f557e