www/errata.html - diff

Return to errata.html CVS log

Up to [local] / www

Diff for /www/errata.html between version 1.585 and 1.586

-version 1.585, 2007/02/06 16:29:50
+version 1.586, 2007/03/06 01:58:04
 Line 15
 Line 15
 Line 15
  <a href="index.html"><img alt="[OpenBSD]" height="30" width="141" src="images/smalltitle.gif" border="0"></a>
  <h2><font color="#0000e0">
- This is the OpenBSD 4.0 release errata &amp; patch list:
+ This is the OpenBSD 4.1 release errata &amp; patch list:
  </font></h2>
 Line 42
 Line 42
 Line 42
  <a href="errata36.html">3.6</a>,
  <a href="errata37.html">3.7</a>,
  <a href="errata38.html">3.8</a>,
- <a href="errata39.html">3.9</a>.
+ <a href="errata39.html">3.9</a>,
+ <a href="errata40.html">4.0</a>.
  <br>
  <hr>
-Line 51
+Line 52
 Line 51
 Line 52
  This file is updated once a day.
  <p> The patches below are available in CVS via the
- <code>OPENBSD_4_0</code> <a href="stable.html">patch branch</a>.
+ <code>OPENBSD_4_1</code> <a href="stable.html">patch branch</a>.
  <p>
  For more detailed information on how to install patches to OpenBSD, please
-Line 67
+Line 68
 Line 67
 Line 68
  <a name="hp300"></a>
  <a name="hppa"></a>
  <a name="i386"></a>
+ <a name="landisk"></a>
  <a name="luna88k"></a>
  <a name="mac68k"></a>
  <a name="macppc"></a>
-Line 80
+Line 82
 Line 80
 Line 82
  <ul>
- <li><a name="timezone"></a>
- <font color="#009000"><strong>009: INTEROPERABILITY FIX: February 4, 2007</strong></font> &nbsp; <i>All architectures</i><br>
- A US daylight saving time rules change takes effect in 2007.
- <br>
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/009_timezone.patch">
- A source code patch exists which syncs the timezone data files with tzdata2007a</a>.<br>
- <p>
- <li><a name="icmp6"></a>
- <font color="#009000"><strong>008: RELIABILITY FIX: January 16, 2007</strong></font> &nbsp; <i>All architectures</i><br>
- Under some circumstances, processing an ICMP6 echo request would cause
- the kernel to enter an infinite loop.
- <br>
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/008_icmp6.patch">
- A source code patch exists which remedies this problem</a>.<br>
- <p>
- <li><a name="agp"></a>
- <font color="#009000"><strong>007: SECURITY FIX: January 3, 2007</strong></font>
- &nbsp; <i>i386 only</i><br>
- Insufficient validation in
- <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=vga&amp;sektion=4">vga(4)</a>
- may allow an attacker to gain root privileges if the kernel is compiled with
- <tt>option PCIAGP</tt>
- and the actual device is not an AGP device.
- The <tt>PCIAGP</tt> option is present by default on i386
- kernels only.
- <br>
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/i386/007_agp.patch">
- A source code patch exists which remedies this problem</a>.<br>
- <p>
- <li><a name="ports-tar"></a>
- <font color="#009000"><strong>006: FTP DISTRIBUTION ERROR: December 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
- The <strong>src.tar.gz</strong> and <strong>ports.tar.gz</strong> archives
- released on FTP were created incorrectly, a week after the 4.0 release. The
- archives on the CD sets are correct; this only affects people who downloaded
- them from a <a href="ftp.html">mirror</a>.
- <br>
- The archives have been corrected. The correct MD5 of
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/4.0/ports.tar.gz">
- ports.tar.gz</a> is eff352b4382a7fb7ffce1e8b37e9eb56, and for
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/4.0/src.tar.gz">
- src.tar.gz</a> it is b8d7a0dc6f3d27a5377a23d69c40688e.
- <br>
- <p>
- <li><a name="ldso"></a>
- <font color="#009000"><strong>005: SECURITY FIX: November 19, 2006</strong></font> &nbsp; <i>All architectures</i><br>
- The ELF
- <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so&amp;sektion=1">ld.so(1)</a>
- fails to properly sanitize the environment. There is a potential localhost security
- problem in cases we have not found yet.  This patch applies to all ELF-based
- systems (m68k, m88k, and vax are a.out-based systems).
- <br>
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/005_ldso.patch">
- A source code patch exists which remedies this problem</a>.<br>
- <p>
- <li><a name="arc"></a>
- <font color="#009000"><strong>004: RELIABILITY FIX: November 7, 2006</strong></font> &nbsp; <i>All architectures</i><br>
- Due to a bug in the
- <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=arc&amp;sektion=4">arc(4)</a>
- RAID driver the driver will not properly synchronize the cache to the logical volumes
- upon system shut down. The result being that the mounted file systems within the logical
- volumes will not be properly marked as being clean and fsck will be run for the subsequent
- boot up.
- <br>
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/004_arc.patch">
- A source code patch exists which remedies this problem</a>.<br>
- <p>
- <li><a name="systrace"></a>
- <font color="#009000"><strong>003: SECURITY FIX: November 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
- Fix for an integer overflow in
- <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&amp;sektion=4">systrace(4)</a>'s
- STRIOCREPLACE support, found by
- Chris Evans. This could be exploited for DoS, limited kmem reads or local
- privilege escalation.
- <br>
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/003_systrace.patch">
- A source code patch exists which remedies this problem</a>.<br>
- <p>
- <li><a name="openssl2"></a>
- <font color="#009000"><strong>002: SECURITY FIX: November 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
- Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
- structures an error condition is mishandled, possibly resulting in an infinite
- loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
- pointer may be dereferenced in the SSL version 2 client code. In addition, many
- applications using OpenSSL do not perform any validation of the lengths of
- public keys being used.
- <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</a>,
- <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</a>,
- <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</a>,
- <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</a>
- <br>
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/002_openssl.patch">
- A source code patch exists which remedies this problem</a>.<br>
- <p>
- <li><a name="httpd"></a>
- <font color="#009000"><strong>001: SECURITY FIX: November 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
- <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>
- does not sanitize the Expect header from an HTTP request when it is
- reflected back in an error message, which might allow cross-site scripting (XSS)
- style attacks.
- <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918">CVE-2006-3918</a>
- <br>
- <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/001_httpd.patch">
- A source code patch exists which remedies this problem</a>.<br>
- <p>
  </ul>
  <br>
-Line 221
+Line 109
 Line 221
 Line 109
  <a href="errata36.html">3.6</a>,
  <a href="errata37.html">3.7</a>,
  <a href="errata38.html">3.8</a>,
- <a href="errata39.html">3.9</a>.
+ <a href="errata39.html">3.9</a>,
+ <a href="errata40.html">4.0</a>.
  <br>
  <hr>