<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks David; it wasn't clear to me that the author was saying in the last section that all these exposures had been fixed.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
His opening second paragraph states explicitly that "...at least one potential RCE exists in all versions of Zimbra." and then his three bullet list includes 8.8.11, so I drew the opposite conclusion.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
All the best,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Mark</div>
<div id="signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p style="margin-top: 0px; margin-bottom: 0px;"><strong>_________________________________________________</strong></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><strong>Another Message From... L. Mark Stone</strong></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> David Touitou <david@network-studio.com><br>
<b>Sent:</b> Tuesday, March 19, 2019 9:08 AM<br>
<b>To:</b> L Mark Stone<br>
<b>Cc:</b> Info Zeta Alliance; users<br>
<b>Subject:</b> Re: [Users] Last security patch</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi,<br>
<br>
> The tint0 article is a little too far above my understanding of programming, but<br>
> if the article's IMAP exploit is addressed via current patches on 8.7.11 and<br>
> 8.8.10/11, then all we need to worry about is the memcache issue.<br>
<br>
The blog post was done once the vulnerabilities were patched, that's in the post conclusion.<br>
So we should not worry about the memcached issue if running the very last version of Zimbra (as IMAP can not reclaim the needed data from memcached anymore).<br>
<br>
As Barry said, automatic upgrade would be great. On a stable and working version.<br>
But current Q&A doesn't allow that.<br>
<br>
David<br>
</div>
</span></font></div>
</body>
</html>