===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/errata33.html,v
retrieving revision 1.65
retrieving revision 1.66
diff -c -r1.65 -r1.66
*** www/errata33.html 2016/03/21 05:46:20 1.65
--- www/errata33.html 2016/03/22 10:54:42 1.66
***************
*** 87,93 ****
022: SECURITY FIX: May 5, 2004
All architectures
Pathname validation problems have been found in
! cvs(1),
allowing malicious clients to create files outside the repository, allowing
malicious servers to overwrite files outside the local CVS tree on
the client and allowing clients to check out files outside the CVS
--- 87,93 ----
022: SECURITY FIX: May 5, 2004
All architectures
Pathname validation problems have been found in
! cvs(1),
allowing malicious clients to create files outside the repository, allowing
malicious servers to overwrite files outside the local CVS tree on
the client and allowing clients to check out files outside the CVS
***************
*** 100,106 ****
021: RELIABILITY FIX: March 17, 2004
All architectures
A missing check for a NULL-pointer dereference has been found in
! ssl(3).
A remote attacker can use the bug to cause an OpenSSL application to crash;
this may lead to a denial of service.
--- 100,106 ----
021: RELIABILITY FIX: March 17, 2004
All architectures
A missing check for a NULL-pointer dereference has been found in
! ssl(3).
A remote attacker can use the bug to cause an OpenSSL application to crash;
this may lead to a denial of service.
***************
*** 111,117 ****
020: RELIABILITY FIX: March 17, 2004
All architectures
Defects in the payload validation and processing functions of
! isakmpd(8)
have been discovered. An attacker could send malformed ISAKMP messages and
cause isakmpd to crash or to loop endlessly. This patch fixes these problems
and removes some memory leaks.
--- 111,117 ----
020: RELIABILITY FIX: March 17, 2004
All architectures
Defects in the payload validation and processing functions of
! isakmpd(8)
have been discovered. An attacker could send malformed ISAKMP messages and
cause isakmpd to crash or to loop endlessly. This patch fixes these problems
and removes some memory leaks.
***************
*** 123,129 ****
019: SECURITY FIX: March 13, 2004
All architectures
Due to a bug in the parsing of Allow/Deny rules for
! httpd(8)'s
access module, using IP addresses without a netmask on big endian 64-bit
platforms causes the rules to fail to match. This only affects sparc64.
--- 123,129 ----
019: SECURITY FIX: March 13, 2004
All architectures
Due to a bug in the parsing of Allow/Deny rules for
! httpd(8)'s
access module, using IP addresses without a netmask on big endian 64-bit
platforms causes the rules to fail to match. This only affects sparc64.
***************
*** 165,171 ****
015: SECURITY FIX: February 5, 2004
All architectures
A reference counting bug exists in the
! shmat(2)
system call that could be used by an attacker to write to kernel memory
under certain circumstances.
--- 165,171 ----
015: SECURITY FIX: February 5, 2004
All architectures
A reference counting bug exists in the
! shmat(2)
system call that could be used by an attacker to write to kernel memory
under certain circumstances.
***************
*** 176,182 ****
014: SECURITY FIX: January 15, 2004
All architectures
Several message handling flaws in
! isakmpd(8)
have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs.
--- 176,182 ----
014: SECURITY FIX: January 15, 2004
All architectures
Several message handling flaws in
! isakmpd(8)
have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs.
***************
*** 187,194 ****
All architectures
An improper bounds check makes it possible for a local user to cause a crash
by passing the
! semctl(2) and
! semop(2) functions
certain arguments.
--- 187,194 ----
All architectures
An improper bounds check makes it possible for a local user to cause a crash
by passing the
! semctl(2) and
! semop(2) functions
certain arguments.
***************
*** 198,204 ****
012: RELIABILITY FIX: November 20, 2003
All architectures
It is possible for a local user to cause a crash via
! sysctl(3) with certain arguments.
A source code patch exists which remedies this problem.
--- 198,204 ----
012: RELIABILITY FIX: November 20, 2003
All architectures
It is possible for a local user to cause a crash via
! sysctl(3) with certain arguments.
A source code patch exists which remedies this problem.
***************
*** 208,214 ****
i386 only
It is possible for a local user to execute arbitrary code resulting in escalation of
privileges due to a stack overrun in
! compat_ibcs2(8).
A source code patch exists which remedies this problem.
--- 208,214 ----
i386 only
It is possible for a local user to execute arbitrary code resulting in escalation of
privileges due to a stack overrun in
! compat_ibcs2(8).
A source code patch exists which remedies this problem.
***************
*** 225,231 ****
All architectures
A user with write permission to httpd.conf or a .htaccess
file can crash
! httpd(8)
or potentially run arbitrary code as the user www (although it
is believed that ProPolice will prevent code execution).
--- 225,231 ----
All architectures
A user with write permission to httpd.conf or a .htaccess
file can crash
! httpd(8)
or potentially run arbitrary code as the user www (although it
is believed that ProPolice will prevent code execution).
***************
*** 245,251 ****
All architectures
The use of certain ASN.1 encodings or malformed public keys may allow an
attacker to mount a denial of service attack against applications linked with
! ssl(3).
This does not affect OpenSSH.
A source code patch exists which remedies this problem.
--- 245,251 ----
All architectures
The use of certain ASN.1 encodings or malformed public keys may allow an
attacker to mount a denial of service attack against applications linked with
! ssl(3).
This does not affect OpenSSH.
A source code patch exists which remedies this problem.
***************
*** 254,260 ****
006: SECURITY FIX: September 24, 2003
All architectures
Three cases of potential access to freed memory have been found in
! pf(4).
At least one of them could be used to panic pf with active scrub rules remotely.
A source code patch exists which remedies this problem.
--- 254,260 ----
006: SECURITY FIX: September 24, 2003
All architectures
Three cases of potential access to freed memory have been found in
! pf(4).
At least one of them could be used to panic pf with active scrub rules remotely.
A source code patch exists which remedies this problem.
***************
*** 263,269 ****
005: SECURITY FIX: September 17, 2003
All architectures
A buffer overflow in the address parsing in
! sendmail(8)
may allow an attacker to gain root privileges.
A source code patch exists which remedies this problem.
--- 263,269 ----
005: SECURITY FIX: September 17, 2003
All architectures
A buffer overflow in the address parsing in
! sendmail(8)
may allow an attacker to gain root privileges.
A source code patch exists which remedies this problem.
***************
*** 292,298 ****
002: RELIABILITY FIX: August 20, 2003
All architectures
An improper bounds check in the
! semget(2)
system call can allow a local user to cause a kernel panic.
A source code patch exists which remedies this problem.
--- 292,298 ----
002: RELIABILITY FIX: August 20, 2003
All architectures
An improper bounds check in the
! semget(2)
system call can allow a local user to cause a kernel panic.
A source code patch exists which remedies this problem.
***************
*** 301,307 ****
001: SECURITY FIX: August 4, 2003
All architectures
An off-by-one error exists in the C library function
! realpath(3).
Since this same bug resulted in a root compromise in the wu-ftpd ftp server
it is possible that this bug may allow an attacker to gain escalated privileges
on OpenBSD.
--- 301,307 ----
001: SECURITY FIX: August 4, 2003
All architectures
An off-by-one error exists in the C library function
! realpath(3).
Since this same bug resulted in a root compromise in the wu-ftpd ftp server
it is possible that this bug may allow an attacker to gain escalated privileges
on OpenBSD.