===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/59.html,v
retrieving revision 1.17
retrieving revision 1.18
diff -c -r1.17 -r1.18
*** www/59.html	2016/02/03 15:00:51	1.17
--- www/59.html	2016/02/03 16:40:02	1.18
***************
*** 130,136 ****
        <ul>
        <li>Qualys Security identified vulnerabilities in the
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>
!         client experimential support for resuming SSH-connections (roaming).
          In the default configuration, this could potentially leak client keys
          to a hostile server.  The authentication of the server host key
          prevents exploitation by a man-in-the-middle, so this information leak
--- 130,136 ----
        <ul>
        <li>Qualys Security identified vulnerabilities in the
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>
!         client experimental support for resuming SSH-connections (roaming).
          In the default configuration, this could potentially leak client keys
          to a hostile server.  The authentication of the server host key
          prevents exploitation by a man-in-the-middle, so this information leak
***************
*** 149,173 ****
          forwarding for cases when the X server disables the <tt>SECURITY</tt>
          extension.
        <li>Fix an out of-bound read access in the packet handling code.
!       <li>Further use of explicit_bzero has been added in various buffer
!         handling code paths to guard against compilers aggressively doing
!         dead-store removal.
        </ul>
      <li>The following significant bugs have been fixed in this release:
        <ul>
        <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
!         add compatability workarounds for FuTTY.
        <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
!         refine compatability workarounds for WinSCP.
        <li>Fix a number of memory faults (double-free, free of uninitialised
          memory, etc) in
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>
          and
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&amp;sektion=1">ssh-keygen(1)</a>.
!       <li>Correctly interpret the 'first_kex_follows' option during the intial
!         key exchange.
        </ul>
      </ul>
  <p>
--- 149,174 ----
          forwarding for cases when the X server disables the <tt>SECURITY</tt>
          extension.
        <li>Fix an out of-bound read access in the packet handling code.
!       <li>Further use of
!         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=bzero&amp;sektion=3">explicit_bzero(3)</a>
!         has been added in various buffer handling code paths to guard against
!         compilers aggressively doing dead-store removal.
        </ul>
      <li>The following significant bugs have been fixed in this release:
        <ul>
        <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
!         add compatibility workarounds for FuTTY.
        <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
!         refine compatibility workarounds for WinSCP.
        <li>Fix a number of memory faults (double-free, free of uninitialised
          memory, etc) in
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>
          and
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&amp;sektion=1">ssh-keygen(1)</a>.
!       <li>Correctly interpret the <tt>first_kex_follows</tt> option during the
!         initial key exchange.
        </ul>
      </ul>
  <p>
***************
*** 198,206 ****
        <li>Fixed an up-to 7 byte overflow in RC4 when len is not a multiple of
          <tt>sizeof(RC4_CHUNK)</tt>.
        <li>Added <tt>EVP_aead_chacha20_poly1305_ietf()</tt> which matches the
!         AEAD construction introduced in RFC 7539, which is different than that
!         already used in TLS with <tt>EVP_aead_chacha20_poly1305()</tt>.
!       <li>More man pages converted from pod to mdoc format.
        <li>Added <tt>COMODO RSA Certification Authority</tt> and
          <tt>QuoVadis</tt> root certificates to <tt>cert.pem</tt>.
        <li>Removed Remhve "<tt>C=US, O=VeriSign, Inc., OU=Class 3 Public Primary
--- 199,210 ----
        <li>Fixed an up-to 7 byte overflow in RC4 when len is not a multiple of
          <tt>sizeof(RC4_CHUNK)</tt>.
        <li>Added <tt>EVP_aead_chacha20_poly1305_ietf()</tt> which matches the
!         <tt>AEAD</tt> construction introduced in RFC 7539, which is different
!         than that already used in TLS with
!         <tt>EVP_aead_chacha20_poly1305()</tt>.
!       <li>More man pages converted from pod to
! 	<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=mdoc&amp;sektion=7">mdoc(7)</a>
!         format.
        <li>Added <tt>COMODO RSA Certification Authority</tt> and
          <tt>QuoVadis</tt> root certificates to <tt>cert.pem</tt>.
        <li>Removed Remhve "<tt>C=US, O=VeriSign, Inc., OU=Class 3 Public Primary
***************
*** 232,239 ****
        <li>SSLv3 is now permanently removed from the tree.
        <li>The <tt>libtls</tt> API is changed from the 2.2.x series:
          <ul>
!           <li>The tls_read/write functions now work better with external event
!             libraries.
            <li>Client-side verification is now supported, with the client
              supplying the certificate to the server.
            <li>Also, when using <tt>tls_connect_fds</tt>,
--- 236,243 ----
        <li>SSLv3 is now permanently removed from the tree.
        <li>The <tt>libtls</tt> API is changed from the 2.2.x series:
          <ul>
!           <li>The <tt>tls_read</tt>/<tt>write</tt> functions now work better
!             with external event libraries.
            <li>Client-side verification is now supported, with the client
              supplying the certificate to the server.
            <li>Also, when using <tt>tls_connect_fds</tt>,
***************
*** 244,251 ****
        <li>New interface <tt>OPENSSL_cpu_caps</tt> is provided that does not
          allow software to inadvertently modify cpu capability flags.
          <tt>OPENSSL_ia32cap</tt> and <tt>OPENSSL_ia32cap_loc</tt> are removed.
!       <li>The <tt>out_len</tt> argument of AEAD changed from <tt>ssize_t</tt>
!         to <tt>size_t</tt>.
        <li>Deduplicated DTLS code, sharing bugfixes and improvements with TLS.
        <li>Converted
  	<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=nc&amp;sektion=1">nc(1)</a>
--- 248,255 ----
        <li>New interface <tt>OPENSSL_cpu_caps</tt> is provided that does not
          allow software to inadvertently modify cpu capability flags.
          <tt>OPENSSL_ia32cap</tt> and <tt>OPENSSL_ia32cap_loc</tt> are removed.
!       <li>The <tt>out_len</tt> argument of <tt>AEAD</tt> changed from
!         <tt>ssize_t</tt> to <tt>size_t</tt>.
        <li>Deduplicated DTLS code, sharing bugfixes and improvements with TLS.
        <li>Converted
  	<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=nc&amp;sektion=1">nc(1)</a>
***************
*** 263,276 ****
        <li>Added ability to check certificate validity times with
          <tt>libtls</tt>, <tt>tls_peer_cert_notbefore</tt> and
          <tt>tls_peer_cert_notafter</tt>.
!       <li>Changed tls_connect_servername to use the first address that
!         resolves with getaddrinfo().
        <li>Remove broken conditional <tt>EVP_CHECK_DES_KEY</tt> code
          (non-functional since initial commit in 2004).
        <li>Reject too small bits value in <tt>BN_generate_prime_ex()</tt>,
          so that it does not risk becoming negative in
          <tt>probable_prime_dh_safe()</tt>.
!       <li>Changed format of LIBRESSL_VERSION_NUMBER to match that of
          <tt>OPENSSL_VERSION_NUMBER</tt>.
        <li>Avoid a potential undefined C99+ behavior due to shift overflow in
          <tt>AES_decrypt</tt>.
--- 267,281 ----
        <li>Added ability to check certificate validity times with
          <tt>libtls</tt>, <tt>tls_peer_cert_notbefore</tt> and
          <tt>tls_peer_cert_notafter</tt>.
!       <li>Changed <tt>tls_connect_servername</tt> to use the first address that
!         resolves with
! 	<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getaddrinfo&amp;sektion=3">getaddrinfo(3)</a>.
        <li>Remove broken conditional <tt>EVP_CHECK_DES_KEY</tt> code
          (non-functional since initial commit in 2004).
        <li>Reject too small bits value in <tt>BN_generate_prime_ex()</tt>,
          so that it does not risk becoming negative in
          <tt>probable_prime_dh_safe()</tt>.
!       <li>Changed format of <tt>LIBRESSL_VERSION_NUMBER</tt> to match that of
          <tt>OPENSSL_VERSION_NUMBER</tt>.
        <li>Avoid a potential undefined C99+ behavior due to shift overflow in
          <tt>AES_decrypt</tt>.