cyrus-imapd-2.4: CVE-2015-8077 CVE-2015-8078

Debian Bug report logs - #804182
cyrus-imapd-2.4: CVE-2015-8077 CVE-2015-8078

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: cyrus-imapd-2.4: CVE-2015-8077 CVE-2015-8078

Date: Thu, 05 Nov 2015 21:10:43 +0100

Source: cyrus-imapd-2.4
Version: 2.4.17+nocaldav-2
Severity: important
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerabilities were published for cyrus-imapd-2.4.

CVE-2015-8077[0]:
| integer overflow in the start_octet addition after the
| 07de4ff1bf2fa340b9d77b8e7de8d43d47a33921 fix

CVE-2015-8078[1]:
| integer overflow in the section_offset addition after the
| c21e179c1f6b968fe69bebe079176714e511587b fix

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

Both basically are due to incomplete fix of CVE-2015-8076, so
technically wheezy and jessie are not affected by CVE-2015-8077 and
CVE-2015-8078 but the fix for CVE-2015-8076 would need to be completed
including these patches.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-8077
    https://cyrus.foundation/cyrus-imapd/commit/?id=745e161c834f1eb6d62fc14477f51dae799e1e08
[1] https://security-tracker.debian.org/tracker/CVE-2015-8078
    https://cyrus.foundation/cyrus-imapd/commit/?id=6fb6a272171f49c79ba6ab7c6403eb25b39ec1b2

Regards,
Salvatore

Message #10 received at 804182@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>

To: Salvatore Bonaccorso <carnil@debian.org>, Debian Bug Tracking System <804182@bugs.debian.org>

Subject: Re: Bug#804182: cyrus-imapd-2.4: CVE-2015-8077 CVE-2015-8078

Date: Tue, 17 Nov 2015 08:32:44 +0100

Hi Salvatore,

just letting you know I will take care of the security update this week.
I just need to sort out the rest of the bugreports whether they are
related to the +nocaldav bump or not.

Cheers,
Ondrej

On Thu, Nov 5, 2015, at 21:10, Salvatore Bonaccorso wrote:
> Source: cyrus-imapd-2.4
> Version: 2.4.17+nocaldav-2
> Severity: important
> Tags: security upstream patch fixed-upstream
> 
> Hi,
> 
> the following vulnerabilities were published for cyrus-imapd-2.4.
> 
> CVE-2015-8077[0]:
> | integer overflow in the start_octet addition after the
> | 07de4ff1bf2fa340b9d77b8e7de8d43d47a33921 fix
> 
> CVE-2015-8078[1]:
> | integer overflow in the section_offset addition after the
> | c21e179c1f6b968fe69bebe079176714e511587b fix
> 
> If you fix the vulnerabilities please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
> 
> Both basically are due to incomplete fix of CVE-2015-8076, so
> technically wheezy and jessie are not affected by CVE-2015-8077 and
> CVE-2015-8078 but the fix for CVE-2015-8076 would need to be completed
> including these patches.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2015-8077
>     https://cyrus.foundation/cyrus-imapd/commit/?id=745e161c834f1eb6d62fc14477f51dae799e1e08
> [1] https://security-tracker.debian.org/tracker/CVE-2015-8078
>     https://cyrus.foundation/cyrus-imapd/commit/?id=6fb6a272171f49c79ba6ab7c6403eb25b39ec1b2
> 
> Regards,
> Salvatore
> 
> _______________________________________________
> Pkg-Cyrus-imapd-Debian-devel mailing list
> Pkg-Cyrus-imapd-Debian-devel@lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-cyrus-imapd-debian-devel


-- 
Ondřej Surý <ondrej@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server

Message #15 received at 804182-close@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@debian.org>

To: 804182-close@bugs.debian.org

Subject: Bug#804182: fixed in cyrus-imapd-2.4 2.4.18-4

Date: Thu, 24 Mar 2016 22:37:33 +0000

Source: cyrus-imapd-2.4
Source-Version: 2.4.18-4

We believe that the bug you reported is fixed in the latest version of
cyrus-imapd-2.4, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 804182@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ondřej Surý <ondrej@debian.org> (supplier of updated cyrus-imapd-2.4 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Mar 2016 21:16:39 +0100
Source: cyrus-imapd-2.4
Binary: cyrus-common cyrus-doc cyrus-imapd cyrus-pop3d cyrus-admin cyrus-murder cyrus-replication cyrus-nntpd cyrus-clients cyrus-dev libcyrus-imap-perl cyrus-common-2.4 cyrus-doc-2.4 cyrus-imapd-2.4 cyrus-pop3d-2.4 cyrus-admin-2.4 cyrus-murder-2.4 cyrus-replication-2.4 cyrus-nntpd-2.4 cyrus-clients-2.4 cyrus-dev-2.4 libcyrus-imap-perl24
Architecture: source all amd64
Version: 2.4.18-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Cyrus Team <pkg-cyrus-imapd-debian-devel@lists.alioth.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Description:
 cyrus-admin - Cyrus mail system - administration tools
 cyrus-admin-2.4 - Cyrus mail system - administration tools [dummy package]
 cyrus-clients - Cyrus mail system - test clients
 cyrus-clients-2.4 - Cyrus mail system - test clients [dummy package]
 cyrus-common - Cyrus mail system - common files
 cyrus-common-2.4 - Cyrus mail system - common files [dummy package]
 cyrus-dev  - Cyrus mail system - developer files
 cyrus-dev-2.4 - Cyrus mail system - developer files [dummy package]
 cyrus-doc  - Cyrus mail system - documentation files
 cyrus-doc-2.4 - Cyrus mail system - documentation files [dummy package]
 cyrus-imapd - Cyrus mail system - IMAP support
 cyrus-imapd-2.4 - Cyrus mail system - IMAP support [dummy package]
 cyrus-murder - Cyrus mail system - proxies and aggregator
 cyrus-murder-2.4 - Cyrus mail system - proxies and aggregator [dummy package]
 cyrus-nntpd - Cyrus mail system - NNTP support
 cyrus-nntpd-2.4 - Cyrus mail system - NNTP support [dummy package]
 cyrus-pop3d - Cyrus mail system - POP3 support
 cyrus-pop3d-2.4 - Cyrus mail system - POP3 support [dummy package]
 cyrus-replication - Cyrus mail system - replication
 cyrus-replication-2.4 - Cyrus mail system - replication [dummy package]
 libcyrus-imap-perl - Interface to Cyrus imap client imclient library
 libcyrus-imap-perl24 - Interface to Cyrus imap client imclient library [dummy package]
Closes: 804182
Changes:
 cyrus-imapd-2.4 (2.4.18-4) unstable; urgency=medium
 .
   * [CVE-2015-8077, CVE-2015-8078]: Fix vulnerabilities in index_urlfetch
     function due incomplete fix for CVE-2015-8076 (Closes: #804182)
Checksums-Sha1:
 c00d9830fc954400af4c19f587b6d713b0d9c602 3824 cyrus-imapd-2.4_2.4.18-4.dsc
 2fb9d400bc752ed4c093bf4a8dbe9caf735f321e 225804 cyrus-imapd-2.4_2.4.18-4.debian.tar.xz
 40d0d2ddaed37b1410c80bbc4c07f90d09663b08 21064 cyrus-admin-2.4_2.4.18-4_all.deb
 f2b0b081af74431df78a7b3db1392cc3889896f0 80594 cyrus-admin_2.4.18-4_all.deb
 332ac5874de57edb45f6d6bac3c9eea680ba689e 21058 cyrus-clients-2.4_2.4.18-4_all.deb
 8b7ccde6bb82d1f09591344a04cd04e01d90f850 134210 cyrus-clients_2.4.18-4_amd64.deb
 ee2c9908dd707dcacc1b277ee9669847f02ef723 21024 cyrus-common-2.4_2.4.18-4_all.deb
 feec70a1329b662bacc02ced359f740fc7ea8f74 16874760 cyrus-common-dbgsym_2.4.18-4_amd64.deb
 9c032680abb38685e59bf9b5372e4060689058a3 1517034 cyrus-common_2.4.18-4_amd64.deb
 07943e4f95830a27befe3404c973ce1607475295 21054 cyrus-dev-2.4_2.4.18-4_all.deb
 b75d7bc2adc092140ea8a7fdf90145f9c715a8f1 249544 cyrus-dev_2.4.18-4_amd64.deb
 dde186b00cc3dbd98383141be0800ad4d2cdaf4c 21066 cyrus-doc-2.4_2.4.18-4_all.deb
 b0d73086db9db33fd777765ff67b878f98b01628 277186 cyrus-doc_2.4.18-4_all.deb
 46c64cea9e00e4345405cf8ef61df8d490509be2 21048 cyrus-imapd-2.4_2.4.18-4_all.deb
 218aee7372145c4a3cb7896b4c6fa46f9b1fa5a0 2194294 cyrus-imapd-dbgsym_2.4.18-4_amd64.deb
 45b03031f0d713fa283334388449ea40b9286dfe 486586 cyrus-imapd_2.4.18-4_amd64.deb
 1cb1f1347d4d701cac3dc141237b98c43416c896 21064 cyrus-murder-2.4_2.4.18-4_all.deb
 2df63de3233dd757984433cc74e0a66f90834a29 662678 cyrus-murder-dbgsym_2.4.18-4_amd64.deb
 bd5e3ec552f43a09d62126d21c7c58daff28a3e5 305202 cyrus-murder_2.4.18-4_amd64.deb
 6929e49cf93c901205067ce95189bfdf4b2c6acc 21062 cyrus-nntpd-2.4_2.4.18-4_all.deb
 6ed90d105edf0977765a6f2f4f412d6dc221d95d 1405676 cyrus-nntpd-dbgsym_2.4.18-4_amd64.deb
 a718ce361ef0c78bc490f271cc241ce224c8460d 399568 cyrus-nntpd_2.4.18-4_amd64.deb
 2339cdd00ec0d6ab352221e7189626a58986e723 21064 cyrus-pop3d-2.4_2.4.18-4_all.deb
 0dba3c9969f0fddcaac462b6eef0386ae6a70166 661650 cyrus-pop3d-dbgsym_2.4.18-4_amd64.deb
 c328d1d374cb5aa8ae49ed51fcaa734670c6c5d4 307916 cyrus-pop3d_2.4.18-4_amd64.deb
 4935dc4078de516adfbaf178d7a4fbe23f7a399b 21060 cyrus-replication-2.4_2.4.18-4_all.deb
 f0ea6d776f2551574ac27fa054115aa631cdbde1 2530996 cyrus-replication-dbgsym_2.4.18-4_amd64.deb
 b2825394e77116cc686408dcd50f9fdaac6683ea 443314 cyrus-replication_2.4.18-4_amd64.deb
 92295ef8e256d50a76da6c41fcb06c84924bdbb7 353774 libcyrus-imap-perl-dbgsym_2.4.18-4_amd64.deb
 66512bb9ab7321789a6c68cffc2a42f7a12e6e43 21070 libcyrus-imap-perl24_2.4.18-4_all.deb
 039e49e7a1f74d87d9f2df513f1ce948f92308af 183222 libcyrus-imap-perl_2.4.18-4_amd64.deb
Checksums-Sha256:
 17b6c2c145204ddd9e0b15120b6dec35d41226b931f29c4e5e18da3d6cde95a7 3824 cyrus-imapd-2.4_2.4.18-4.dsc
 77b5a8e8975b8c9f3824202708d29b3c0d42a9217e06db6c89a91e6a47ecba09 225804 cyrus-imapd-2.4_2.4.18-4.debian.tar.xz
 9c82c58f15783babe8d5ad9309f7bcafa1192e2be5fb1e3bb764352dca715dd7 21064 cyrus-admin-2.4_2.4.18-4_all.deb
 4de87988ea685dc9b21fd8433cb1f8fa2ac60935e86d111ce02f2409ca2196c8 80594 cyrus-admin_2.4.18-4_all.deb
 2bb5afdcdc4aa31c4d8c04dbec0c1cfa64d69120722667143790769cae9a6c2f 21058 cyrus-clients-2.4_2.4.18-4_all.deb
 c6ef1d7768c9ad18bdf8d0d8e3d3f9092b64ea19b04d1cea4c7b2d297560618c 134210 cyrus-clients_2.4.18-4_amd64.deb
 86c202e142a43bdc78a924f46f15847038e39addfa0ffebb5712473d7cd7f56d 21024 cyrus-common-2.4_2.4.18-4_all.deb
 ef26859b9c3bf702a7acc00923cdd64b3ea8b2c9c68bfa6025c8e3c1cde298ff 16874760 cyrus-common-dbgsym_2.4.18-4_amd64.deb
 2be8911bae99905f6fbab7e93a9ce644e29a93e1c934d627505c9e545ec33e86 1517034 cyrus-common_2.4.18-4_amd64.deb
 3456f425f4669d315229eb5ad6a33b526f46b8f1d58abd5342815c1a7a5963e4 21054 cyrus-dev-2.4_2.4.18-4_all.deb
 d4944f65e46237aedcdfbed0b7f8edcb8abb09e21e67e96cee86522271dd7a98 249544 cyrus-dev_2.4.18-4_amd64.deb
 2b9ebb44bdc18b3e29ab8295b908c41e0b3da8e0598a9ea0cbf73f426b5ea0e1 21066 cyrus-doc-2.4_2.4.18-4_all.deb
 ddd81cf13a4838bea4a25212f8d8707b203061b1aaa02fcc62ad2b3b97044f8f 277186 cyrus-doc_2.4.18-4_all.deb
 ad5239809e91ea9748741fbe64eed5787c597d61fe97fc524dc5d191ff4a7c4f 21048 cyrus-imapd-2.4_2.4.18-4_all.deb
 6938f45094082259a1cf6bfe28dbfbb0412f195d67d575a62d880d324553d4aa 2194294 cyrus-imapd-dbgsym_2.4.18-4_amd64.deb
 679ed9b1878c181580e1683b82869808cb431578f357ab33de0a067fd6332e73 486586 cyrus-imapd_2.4.18-4_amd64.deb
 7eb53b80d604ad1f65751600589a32e4ee4aa7f797ed22c126a03fb0bcbe55ef 21064 cyrus-murder-2.4_2.4.18-4_all.deb
 b19c7066f68d52ada4447afbf7be6b36ac632730867d1d76be5cf000e64c7a80 662678 cyrus-murder-dbgsym_2.4.18-4_amd64.deb
 848031dbb7a9a67b8bf9d248fe3d800b6a2b96e87cbde8aabc4aaee026111114 305202 cyrus-murder_2.4.18-4_amd64.deb
 16e712d03f0a261dc77b3e38a401150fd86c0dc67094d35b4037db719aaef3e3 21062 cyrus-nntpd-2.4_2.4.18-4_all.deb
 17572e93e307e056aac07c68bb6d599ae668217dc7da7c078adb5e1471422f08 1405676 cyrus-nntpd-dbgsym_2.4.18-4_amd64.deb
 fdcacf044947f46fe5564629868de49bd05324ba0aeecc75237502db0c0f6d40 399568 cyrus-nntpd_2.4.18-4_amd64.deb
 a69968f9aa9d0d32dbcc9b4e1ad971770523a1362ca414e40b34efdc59446176 21064 cyrus-pop3d-2.4_2.4.18-4_all.deb
 f6240b0478ea6ee6983ce3c30908cce6c7ed999022ee3fdc2697430958e0c28a 661650 cyrus-pop3d-dbgsym_2.4.18-4_amd64.deb
 4317bdc1907c6c57bbd89e848bce48219f441af0348fbbdebea6d9af1dbe14ca 307916 cyrus-pop3d_2.4.18-4_amd64.deb
 c96b53ef1e1a86b01dfba9a165711e20c5e42df34a185b10daf8811e392e8bde 21060 cyrus-replication-2.4_2.4.18-4_all.deb
 879c96412db2866aa91bae16a7dd0ba06141d4a324733bf23f477251efcb3ba9 2530996 cyrus-replication-dbgsym_2.4.18-4_amd64.deb
 602dc8d5cf0ab16b0d74e7b2b80cd0e1b0c9a5120d7a1f21a09d6b78483169f3 443314 cyrus-replication_2.4.18-4_amd64.deb
 c8687ce8a441cf9f7c49a8210905de30c93c7ba049d6e47993e46f4c3e0494dd 353774 libcyrus-imap-perl-dbgsym_2.4.18-4_amd64.deb
 080d09176e908901f612190e27e4a43382db150fa0a8ee69aca4455939daed63 21070 libcyrus-imap-perl24_2.4.18-4_all.deb
 6457e127c672a65176fa324450eac38208ff563ec4b765b572e7af1a2c9c3a66 183222 libcyrus-imap-perl_2.4.18-4_amd64.deb
Files:
 bd2fd83d0f61057266b019cf778b2e5d 3824 mail extra cyrus-imapd-2.4_2.4.18-4.dsc
 aad52750490ff41f56bb48025d47dc63 225804 mail extra cyrus-imapd-2.4_2.4.18-4.debian.tar.xz
 c2dcf44c63ef3099e1cf97960ac46e29 21064 oldlibs extra cyrus-admin-2.4_2.4.18-4_all.deb
 3ef84bc23f1d308d2f97a9a85b7eeb4e 80594 mail extra cyrus-admin_2.4.18-4_all.deb
 bf6a54c4fcb6d88a616c8d4aa4e83e8a 21058 oldlibs extra cyrus-clients-2.4_2.4.18-4_all.deb
 4d1782be2b903341f79c79c445193bb2 134210 mail extra cyrus-clients_2.4.18-4_amd64.deb
 21e6d70867efaaa80e3f8555c5ea1481 21024 oldlibs extra cyrus-common-2.4_2.4.18-4_all.deb
 1e7fcb12285d522082ff56b28b717f96 16874760 debug extra cyrus-common-dbgsym_2.4.18-4_amd64.deb
 9347417327e356bdd868b52a78bbeecc 1517034 mail extra cyrus-common_2.4.18-4_amd64.deb
 a57b26df4c34f7a5f2c6110400da7603 21054 oldlibs extra cyrus-dev-2.4_2.4.18-4_all.deb
 0528d018aefebff2523d32c0fe770712 249544 devel extra cyrus-dev_2.4.18-4_amd64.deb
 fc3c94e9dab13bbf820e09fba0a73881 21066 oldlibs extra cyrus-doc-2.4_2.4.18-4_all.deb
 ed9ba1c0e2a2c3f75b549c73d2f6883c 277186 doc extra cyrus-doc_2.4.18-4_all.deb
 49682b378df113bf4e1e4e3102294a5f 21048 oldlibs extra cyrus-imapd-2.4_2.4.18-4_all.deb
 a31635cadb2b01c9ec2adee16f6c64e1 2194294 debug extra cyrus-imapd-dbgsym_2.4.18-4_amd64.deb
 734b999166fa930501f182cff7c7e6b4 486586 mail extra cyrus-imapd_2.4.18-4_amd64.deb
 aebd9c35e4043e0f012e082ffba2d414 21064 oldlibs extra cyrus-murder-2.4_2.4.18-4_all.deb
 95bb5e403dac68f4191a790c85b94564 662678 debug extra cyrus-murder-dbgsym_2.4.18-4_amd64.deb
 ddb4f379d76c25ee85c9e3c22d547475 305202 mail extra cyrus-murder_2.4.18-4_amd64.deb
 0dcdec4c21e94226c6ccd0c8b1f84e6c 21062 oldlibs extra cyrus-nntpd-2.4_2.4.18-4_all.deb
 db2e2c10a49e2f80f9f32d8086eed912 1405676 debug extra cyrus-nntpd-dbgsym_2.4.18-4_amd64.deb
 e82ef15f74a2969855d24251cb4e0845 399568 mail extra cyrus-nntpd_2.4.18-4_amd64.deb
 8ff92b9913d9d9fd7c618c690a79c9c9 21064 oldlibs extra cyrus-pop3d-2.4_2.4.18-4_all.deb
 7494a710611eef769fffd1a97c8faeef 661650 debug extra cyrus-pop3d-dbgsym_2.4.18-4_amd64.deb
 710efc94118c9fd270819bcc7fbc0a2d 307916 mail extra cyrus-pop3d_2.4.18-4_amd64.deb
 5e6dde8d5d1ec7782cf154a89cc27749 21060 oldlibs extra cyrus-replication-2.4_2.4.18-4_all.deb
 0b8d25574b43d768e92b5c21e143dd56 2530996 debug extra cyrus-replication-dbgsym_2.4.18-4_amd64.deb
 d0d09380770e2871f522566f62f70c2e 443314 mail extra cyrus-replication_2.4.18-4_amd64.deb
 13bf9a1ac4892c1692322f7b4d24dc42 353774 debug extra libcyrus-imap-perl-dbgsym_2.4.18-4_amd64.deb
 5a8a3b8bab884db38864a19da62662a1 21070 oldlibs extra libcyrus-imap-perl24_2.4.18-4_all.deb
 bb26f05e5345be853a90308b440305cc 183222 perl extra libcyrus-imap-perl_2.4.18-4_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQJ8BAEBCgBmBQJW9E1gXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQzMEI5MzNEODBGQ0UzRDk4MUEyRDM4RkIw
Qzk5QjcwRUY0RkNCQjA3AAoJEAyZtw70/LsH65wQAN990Ct4iU8Z8fFlZWcDrTqz
KZ7lYkGiCWwdbW3HMqkRoaYehVBlJqeuq0ecXGc2R5wDPF4sIN0tb36Y+P+ZyeaY
eeCAvA11EVrr3OahcIV7UX4tZ0Yu77ab1CNo+bKWFxrbLrhKP7sSfq06t82+0AXh
O7qHoaV/jPKYrSpqYB781PvfYmQZE/saqgJta6sRGhNKTNnBo+kX6chOtQh4J7EM
gX2tn9XNL4mcL7/HWIL2aqtjbCTZU6ZlRuE4ZZKAFApbbxr+4LDVNXAxWqUvPbwM
0iVFCBV+pA8DL1f9SejomS1hT//iItAzqU2a+vZrSZaybEA1pnk6L0Tnjk01fvCM
X46RsS1TjVXzouAjCzwp6DCkqpZ5r0+f8WjzrIxpwJpNDBP1Vcu4zGQ9ZTgGSEeS
jCRPd9+W/gdVoZeQV5rfWtKqoKqEdUTxJqfiJkoZuTPbmefd1Fv4lSRei7xmhC0/
2Wyo3if31rcconEeArCsqNlvjpuM2jf6RKMb4GlnEd27AuaoEAmG5SInJ2ADtXvD
VrMe+3MFYkt7n16vc29tDAkhx1K79qFk17iE4PJfi309xORr+BxM6ZbI3BlZaBz2
6Ophn84xBPtYOihYFW2nC6X9CFYnEB38l+QMaeEF5G2Hjlj7clkyckqo7CgREpId
cO6z+N0E+6/2jo9C0Uks
=vvPm
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.