[BACK]Return to errata.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata.html between version 1.574 and 1.575

version 1.574, 2006/11/04 03:02:28 version 1.575, 2006/11/04 21:28:18
Line 76 
Line 76 
 <ul>  <ul>
   
 <li><a name="systrace"></a>  <li><a name="systrace"></a>
 <font color="#009000"><strong>003: SECURITY FIX: October 7, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>003: SECURITY FIX: November 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
 Fix for an integer overflow in  Fix for an integer overflow in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&amp;sektion=4">systrace(4)</a>'s  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&amp;sektion=4">systrace(4)</a>'s
 STRIOCREPLACE support, found by  STRIOCREPLACE support, found by
Line 88 
Line 88 
 <p>  <p>
   
 <li><a name="openssl2"></a>  <li><a name="openssl2"></a>
 <font color="#009000"><strong>002: SECURITY FIX: October 7, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>002: SECURITY FIX: November 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
 Several problems have been found in OpenSSL. While parsing certain invalid ASN.1  Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
 structures an error condition is mishandled, possibly resulting in an infinite  structures an error condition is mishandled, possibly resulting in an infinite
 loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL  loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
Line 106 
Line 106 
 <p>  <p>
   
 <li><a name="httpd"></a>  <li><a name="httpd"></a>
 <font color="#009000"><strong>001: SECURITY FIX: October 7, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>001: SECURITY FIX: November 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>
 does not sanitize the Expect header from an HTTP request when it is  does not sanitize the Expect header from an HTTP request when it is
 reflected back in an error message, which might allow cross-site scripting (XSS)  reflected back in an error message, which might allow cross-site scripting (XSS)
Legend:
Removed from v.1.574  
changed lines
  Added in v.1.575