===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/errata.html,v
retrieving revision 1.399
retrieving revision 1.400
diff -c -r1.399 -r1.400
*** www/errata.html	2002/06/26 11:01:06	1.399
--- www/errata.html	2002/06/26 19:07:53	1.400
***************
*** 49,54 ****
--- 49,60 ----
  <a name=all></a>
  <li><h3><font color=#e00000>All architectures</font></h3>
  <ul>
+ <a name=modssl></a>
+ <li><font color=#009000><strong>008: SECURITY FIX: June 26, 2002</strong></font><br>
+ A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd
+ module, leading to possible remote crash.
+ <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/008_mod_ssl.patch">A source code patch exists which remedies the problem</a>.
+ <p>
  <a name=resolver></a>
  <li><font color=#009000><strong>007: SECURITY FIX: June 25, 2002</strong></font><br>
  A potential buffer overflow in the DNS resolver has been found.<br>
***************
*** 56,68 ****
  <p>
  <a name=sshd></a>
  <li><font color=#009000><strong>006: SECURITY FIX: June 24, 2002</strong></font><br>
! An (as yet) undisclosed bug exists in OpenSSH, which a patch is not forthcoming
! for yet -- no patch exists yet!<br>
! However, upgrading to <a href="http://www.openssh.com/openbsd.html">OpenSSH 3.3</a>
! with the <strong>UsePrivilegeSeparation</strong> option enabled will block this
! problem.<br>
! All users are advised to update immediately, and keep an eye out for
! an upcoming OpenSSH 3.4 release on Monday containing a real fix.
  <p>
  <a name=httpd></a>
  <li><font color=#009000><strong>005: SECURITY FIX: June 19, 2002</strong></font><br>
--- 62,73 ----
  <p>
  <a name=sshd></a>
  <li><font color=#009000><strong>006: SECURITY FIX: June 24, 2002</strong></font><br>
! All versions of OpenSSH's sshd between 2.9.9 and 3.3 contain an input validation
! error that can result in an integer overflow and privilege escalation.
! This problem is fixed in <a href="http://www.openssh.com/openbsd.html">OpenSSH
! 3.4</a>, and a patch for the vulnerable releases is available as part of the
! <a href="http://www.openssh.com/txt/preauth.adv">security advisory</a>.
! <br>
  <p>
  <a name=httpd></a>
  <li><font color=#009000><strong>005: SECURITY FIX: June 19, 2002</strong></font><br>
***************
*** 185,191 ****
  
  <a href=index.html><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a> 
  <a href=mailto:www@openbsd.org>www@openbsd.org</a>
! <br><small>$OpenBSD: errata.html,v 1.399 2002/06/26 11:01:06 espie Exp $</small>
  
  </body>
  </html>
--- 190,196 ----
  
  <a href=index.html><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a> 
  <a href=mailto:www@openbsd.org>www@openbsd.org</a>
! <br><small>$OpenBSD: errata.html,v 1.400 2002/06/26 19:07:53 miod Exp $</small>
  
  </body>
  </html>