[quote user="cogx"]
http://www.securityfocus.com/archive/1/540601
"v4.72 build 572
Vendor supposedly fixed: January 21, 2016
May 19, 2017 : Public Disclosure"
So, that post says the flaw is still working in 4.72 build 572, but it was supposed to have been fixed in January 21, 2016 which should mean it was fixed in 4.72 build 572 (Feb 19, 2016)?
[/quote]
I think it's just a typo - the actual bug was fixed in January, in both Mercury and Pegasus Mail. I haven't as yet done a release because, frankly, this is a very minor security issue.
What the vulnerability entails is a common issue where an application allows Windows to search along the path for DLLs when loading them. In theory, this means that someone could place a DLL in a directory in the path earlier than the real version, and Windows would load the bogus one when the load call was made. In practice, this is really hardly an issue: Mercury is typically used as a service, so it's nearly impossible to inject a bogus DLL into the path before it starts up, and while it could possibly be exploited in Pegasus Mail, it's hard to see what benefit it would provide.
In both cases, the solution was easy (it's actually a problem in the TER editor I use, not in Pegasus Mail itself), and I'll have maintenance releases out shortly that address it.
Cheers!
-- David --