[BACK]Return to errata31.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata31.html between version 1.64 and 1.65

version 1.64, 2014/10/02 14:34:45 version 1.65, 2015/02/14 04:36:51
Line 82 
Line 82 
 <hr>  <hr>
   
 <ul>  <ul>
 <li><a name="sendmail2"></a>  <li id="sendmail2">
 <font color="#009000"><strong>027: SECURITY FIX: March 31, 2003</strong></font>  <font color="#009000"><strong>027: SECURITY FIX: March 31, 2003</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow in the address parsing in  A buffer overflow in the address parsing in
Line 91 
Line 91 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/027_sendmail.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/027_sendmail.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="kerberos"></a>  <li id="kerberos">
 <font color="#009000"><strong>026: SECURITY FIX: March 24, 2003</strong></font>  <font color="#009000"><strong>026: SECURITY FIX: March 24, 2003</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The cryptographic weaknesses in the Kerberos v4 protocol can be exploited  The cryptographic weaknesses in the Kerberos v4 protocol can be exploited
Line 100 
Line 100 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/026_kerberos.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/026_kerberos.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="kpr"></a>  <li id="kpr">
 <font color="#009000"><strong>025: SECURITY FIX: March 19, 2003</strong></font>  <font color="#009000"><strong>025: SECURITY FIX: March 19, 2003</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 OpenSSL is vulnerable to an extension of the ``Bleichenbacher'' attack designed  OpenSSL is vulnerable to an extension of the ``Bleichenbacher'' attack designed
Line 109 
Line 109 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/025_kpr.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/025_kpr.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="blinding"></a>  <li id="blinding">
 <font color="#009000"><strong>024: SECURITY FIX: March 18, 2003</strong></font>  <font color="#009000"><strong>024: SECURITY FIX: March 18, 2003</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Various SSL and TLS operations in OpenSSL are vulnerable to timing attacks.  Various SSL and TLS operations in OpenSSL are vulnerable to timing attacks.
Line 117 
Line 117 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/024_blinding.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/024_blinding.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="lprm"></a>  <li id="lprm">
 <font color="#009000"><strong>023: SECURITY FIX: March 5, 2003</strong></font>  <font color="#009000"><strong>023: SECURITY FIX: March 5, 2003</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A fix for an  A fix for an
Line 127 
Line 127 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/023_lprm.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/023_lprm.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sendmail"></a>  <li id="sendmail">
 <font color="#009000"><strong>022: SECURITY FIX: March 3, 2003</strong></font>  <font color="#009000"><strong>022: SECURITY FIX: March 3, 2003</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow in the envelope comments processing in  A buffer overflow in the envelope comments processing in
Line 136 
Line 136 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/022_sendmail.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/022_sendmail.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="ssl2"></a>  <li id="ssl2">
 <font color="#009000"><strong>021: SECURITY FIX: February 23, 2003</strong></font>  <font color="#009000"><strong>021: SECURITY FIX: February 23, 2003</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 In  In
Line 146 
Line 146 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/021_ssl.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/021_ssl.patch">
 A source code patch exists which fixes these two issues</a>.  A source code patch exists which fixes these two issues</a>.
 <p>  <p>
 <li><a name="cvs"></a>  <li id="cvs">
 <font color="#009000"><strong>020: SECURITY FIX: January 20, 2003</strong></font>  <font color="#009000"><strong>020: SECURITY FIX: January 20, 2003</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A double free in  A double free in
Line 159 
Line 159 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/020_cvs.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/020_cvs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="named"></a>  <li id="named">
 <font color="#009000"><strong>019: SECURITY FIX: November 14, 2002</strong></font>  <font color="#009000"><strong>019: SECURITY FIX: November 14, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow in  A buffer overflow in
Line 170 
Line 170 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/019_named.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/019_named.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="kernresource"></a>  <li id="kernresource">
 <font color="#009000"><strong>018: SECURITY FIX: November 6, 2002</strong></font>  <font color="#009000"><strong>018: SECURITY FIX: November 6, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Incorrect argument checking in the  Incorrect argument checking in the
Line 179 
Line 179 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/018_kernresource.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/018_kernresource.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="smrsh"></a>  <li id="smrsh">
 <font color="#009000"><strong>017: SECURITY FIX: November 6, 2002</strong></font>  <font color="#009000"><strong>017: SECURITY FIX: November 6, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 An attacker can bypass the restrictions imposed by sendmail's restricted shell,  An attacker can bypass the restrictions imposed by sendmail's restricted shell,
Line 188 
Line 188 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/017_smrsh.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/017_smrsh.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="kadmin"></a>  <li id="kadmin">
 <font color="#009000"><strong>016: SECURITY FIX: October 21, 2002</strong></font>  <font color="#009000"><strong>016: SECURITY FIX: October 21, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur in the  A buffer overflow can occur in the
Line 197 
Line 197 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/016_kadmin.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/016_kadmin.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="kerntime"></a>  <li id="kerntime">
 <font color="#009000"><strong>015: SECURITY FIX: October 2, 2002</strong></font>  <font color="#009000"><strong>015: SECURITY FIX: October 2, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Incorrect argument checking in the  Incorrect argument checking in the
Line 205 
Line 205 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/015_kerntime.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/015_kerntime.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="scarg"></a>  <li id="scarg">
 <font color="#009000"><strong>014: SECURITY FIX: August 11, 2002</strong></font>  <font color="#009000"><strong>014: SECURITY FIX: August 11, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 An insufficient boundary check in the  An insufficient boundary check in the
Line 215 
Line 215 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/014_scarg.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/014_scarg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="ssl"></a>  <li id="ssl">
 <font color="#009000"><strong>013: SECURITY FIX: July 30, 2002</strong></font>  <font color="#009000"><strong>013: SECURITY FIX: July 30, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the  Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the
Line 228 
Line 228 
 <br>  <br>
 This is the second version of the patch.  This is the second version of the patch.
 <p>  <p>
 <li><a name="xdr"></a>  <li id="xdr">
 <font color="#009000"><strong>012: SECURITY FIX: July 29, 2002</strong></font>  <font color="#009000"><strong>012: SECURITY FIX: July 29, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur in the  A buffer overflow can occur in the
Line 239 
Line 239 
 <br>  <br>
 This is the second version of the patch.  This is the second version of the patch.
 <p>  <p>
 <li><a name="pppd"></a>  <li id="pppd">
 <font color="#009000"><strong>011: SECURITY FIX: July 29, 2002</strong></font>  <font color="#009000"><strong>011: SECURITY FIX: July 29, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A race condition exists in the  A race condition exists in the
Line 248 
Line 248 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/011_pppd.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/011_pppd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="isakmpd"></a>  <li id="isakmpd">
 <font color="#009000"><strong>010: RELIABILITY FIX: July 5, 2002</strong></font>  <font color="#009000"><strong>010: RELIABILITY FIX: July 5, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Receiving IKE payloads out of sequence can cause  Receiving IKE payloads out of sequence can cause
Line 258 
Line 258 
 <br>  <br>
 This is the second version of the patch.  This is the second version of the patch.
 <p>  <p>
 <li><a name="ktrace"></a>  <li id="ktrace">
 <font color="#009000"><strong>009: SECURITY FIX: June 27, 2002</strong></font>  <font color="#009000"><strong>009: SECURITY FIX: June 27, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The kernel would let any user <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ktrace&amp;sektion=2">ktrace(2)</a> set[ug]id processes.<br>  The kernel would let any user <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ktrace&amp;sektion=2">ktrace(2)</a> set[ug]id processes.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/009_ktrace.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/009_ktrace.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="modssl"></a>  <li id="modssl">
 <font color="#009000"><strong>008: SECURITY FIX: June 26, 2002</strong></font>  <font color="#009000"><strong>008: SECURITY FIX: June 26, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd  A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd
Line 273 
Line 273 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/008_mod_ssl.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/008_mod_ssl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="resolver"></a>  <li id="resolver">
 <font color="#009000"><strong>007: SECURITY FIX: June 25, 2002</strong></font>  <font color="#009000"><strong>007: SECURITY FIX: June 25, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A potential buffer overflow in the DNS resolver has been found.<br>  A potential buffer overflow in the DNS resolver has been found.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/007_resolver.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/007_resolver.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sshd"></a>  <li id="sshd">
 <font color="#009000"><strong>006: SECURITY FIX: June 24, 2002</strong></font>  <font color="#009000"><strong>006: SECURITY FIX: June 24, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation  All versions of OpenSSH's sshd between 2.3.1 and 3.3 contain an input validation
Line 289 
Line 289 
 3.4</a>, and a patch for the vulnerable releases is available as part of the  3.4</a>, and a patch for the vulnerable releases is available as part of the
 <a href="http://www.openssh.com/txt/preauth.adv">security advisory</a>.  <a href="http://www.openssh.com/txt/preauth.adv">security advisory</a>.
 <p>  <p>
 <li><a name="httpd"></a>  <li id="httpd">
 <font color="#009000"><strong>005: SECURITY FIX: June 19, 2002</strong></font>  <font color="#009000"><strong>005: SECURITY FIX: June 19, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow can occur during the interpretation of chunked  A buffer overflow can occur during the interpretation of chunked
Line 297 
Line 297 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/005_httpd.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/005_httpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sshbsdauth"></a>  <li id="sshbsdauth">
 <font color="#009000"><strong>004: SECURITY FIX: May 22, 2002</strong></font>  <font color="#009000"><strong>004: SECURITY FIX: May 22, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Under certain conditions, on systems using YP with netgroups in the  Under certain conditions, on systems using YP with netgroups in the
Line 310 
Line 310 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/004_sshbsdauth.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/004_sshbsdauth.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="fdalloc2"></a>  <li id="fdalloc2">
 <font color="#009000"><strong>003: SECURITY FIX: May 8, 2002</strong></font>  <font color="#009000"><strong>003: SECURITY FIX: May 8, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A race condition exists where an attacker could fill the file descriptor  A race condition exists where an attacker could fill the file descriptor
Line 319 
Line 319 
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/003_fdalloc2.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/003_fdalloc2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sudo"></a>  <li id="sudo">
 <font color="#009000"><strong>002: SECURITY FIX: April 25, 2002</strong></font>  <font color="#009000"><strong>002: SECURITY FIX: April 25, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A bug in <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sudo&amp;sektion=8">sudo(8)</a> may allow an attacker to corrupt the heap by specifying a custom prompt.<br>  A bug in <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sudo&amp;sektion=8">sudo(8)</a> may allow an attacker to corrupt the heap by specifying a custom prompt.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/002_sudo.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/002_sudo.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sshafs"></a>  <li id="sshafs">
 <font color="#009000"><strong>001: SECURITY FIX: April 22, 2002</strong></font>  <font color="#009000"><strong>001: SECURITY FIX: April 22, 2002</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A local user can gain super-user privileges due to a buffer overflow  A local user can gain super-user privileges due to a buffer overflow
Legend:
Removed from v.1.64  
changed lines
  Added in v.1.65