diff --git a/postfix/HISTORY b/postfix/HISTORY
index 0bcf34c93..09420d8b4 100644
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -12134,6 +12134,20 @@ Apologies for any names omitted.
 	old behavior assumes local file access, and is inappropriate
 	with deployment of LDAP and SQL tables. File: smtpd/smtpd_check.c.
 
+20060423
+
+	Bugfix: postcat did not print the attribute value of records
+	containing a named attribute. File: postcat/postcat.c.
+
+20060430
+
+	Bugfix: dangling pointer in a function that has no caller.
+	Found by Coverity. File: tls/tls_prng_exch.c.
+
+	Bugfix: the workaround for CA-2003-07 (Sendmail) did not
+	null terminate the address before logging a warning. Reported
+	by Kris Kennaway. File: global/tok822_parse.c.
+
 Wish list:
 
 	Don't send xforward attributes to every site that announces
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index f05b4952a..ace18a031 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20060418"
+#define MAIL_RELEASE_DATE	"20060430"
 #define MAIL_VERSION_NUMBER	"2.3"
 
 #ifdef SNAPSHOT
diff --git a/postfix/src/global/tok822_parse.c b/postfix/src/global/tok822_parse.c
index 63f998c95..43768027c 100644
--- a/postfix/src/global/tok822_parse.c
+++ b/postfix/src/global/tok822_parse.c
@@ -250,6 +250,7 @@ static void strip_address(VSTRING *vp, ssize_t start, TOK822 *addr)
     /*
      * Emit plain <address>. Discard any comments or phrases.
      */
+    VSTRING_TERMINATE(vp);
     msg_warn("stripping too many comments from address: %.100s...",
 	     printable(vstring_str(vp) + start, '?'));
     vstring_truncate(vp, start);
diff --git a/postfix/src/postcat/postcat.c b/postfix/src/postcat/postcat.c
index c249bfae2..03dacc69d 100644
--- a/postfix/src/postcat/postcat.c
+++ b/postfix/src/postcat/postcat.c
@@ -200,7 +200,9 @@ static void postcat(VSTREAM *fp, VSTRING *buffer, int flags)
 			       asctime(localtime(&time)));
 		break;
 	    }
-	    /* FALLTHROUGH */
+	    vstream_printf("%s: %s=%s\n", rec_type_name(rec_type),
+			   attr_name, attr_value);
+	    break;
 	default:
 	    vstream_printf("%s: %s\n", rec_type_name(rec_type), STR(buffer));
 	    break;
diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c
index 7bfec2a51..e0661dc94 100644
--- a/postfix/src/smtpd/smtpd.c
+++ b/postfix/src/smtpd/smtpd.c
@@ -3335,7 +3335,7 @@ static void smtpd_proto(SMTPD_STATE *state, const char *service)
 	if (SMTPD_STAND_ALONE(state) == 0 && var_smtpd_tls_wrappermode) {
 	    if (smtpd_tls_ctx == 0) {
 		msg_warn("Wrapper-mode request dropped from %s for service %s."
-			 "TLS context initialization failed. For details see"
+			 " TLS context initialization failed. For details see"
 			 " earlier warnings in your logs.",
 			 state->namaddr, state->service);
 		break;
diff --git a/postfix/src/tls/tls_prng_exch.c b/postfix/src/tls/tls_prng_exch.c
index c61817173..9bfe1db19 100644
--- a/postfix/src/tls/tls_prng_exch.c
+++ b/postfix/src/tls/tls_prng_exch.c
@@ -133,10 +133,10 @@ void    tls_prng_exch_close(TLS_PRNG_SRC *eh)
 
     if (close(eh->fd) < 0)
 	msg_fatal("close PRNG exchange file %s: %m", eh->name);
-    myfree(eh->name);
-    myfree((char *) eh);
     if (msg_verbose)
 	msg_info("%s: closed PRNG exchange file %s", myname, eh->name);
+    myfree(eh->name);
+    myfree((char *) eh);
 }
 
 #endif