From: Wietse Venema on
[An on-line version of this announcement will be available at]

Postfix legacy releases 2.6.6, 2.5.10 and 2.4.14 contain fixes that
were already included with Postfix 2.7 (stable release) and Postfix
2.8 (experimental release).

NOTE: Postfix 2.3 is no longer updated.

Defects fixed with Postfix 2.6.6 only (more in the next section):

- "postmulti -p command" did not skip disabled instances.

- In the multi_instance_wrapper parameter, the expansion of
$command_directory and $daemon_directory was broken.

- The address_verify_poll_count parameter value was not made
stress-dependent by default. This defeated the purpose of making
other settings stress-dependent by default with Postfix 2.6.

Defects fixed with Postfix 2.6.6, 2.5.10, 2.4.14:

- Milter applications would hang up after receiving an unexpected
SMFIC_HEADER (mail header) command. This problem happened with
Milters that (legitimately) do not send replies for SMFIC_RCPT
(recipient address) or SMFIC_DATA (start of message) commands.

- Core dump while an printing error message for a malformed %<letter>
sequence in LDAP, MySQL or PostgreSQL lookup table configuration.

- Mail with zero recipients was forever stuck in the queue. This
happened when "postsuper -r" was run after all the recipients of
a message were delivered (or bounced), but before the message was
deleted from the queue.

- With hostnames such as 1-2-3-4, the valid_hostname() fuction did
not recognize the '-' as a non-numeric character, causing a
legitimate name to be rejected as "invalid".

- The VRFY command did not accept a mailbox address inside <>.

You can find the source code and patches at the mirrors listed at