[BACK]Return to errata33.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata33.html between version 1.51 and 1.52

version 1.51, 2014/03/31 03:12:47 version 1.52, 2014/03/31 03:36:54
Line 76 
Line 76 
   
 <hr>  <hr>
   
 <a name="all"></a>  
 <h3><font color="#e00000">All architectures</font></h3>  
 <ul>  <ul>
 <li><a name="cvs"></a>  <li><a name="cvs"></a>
 <font color="#009000"><strong>022: SECURITY FIX: May 5, 2004</strong></font><br>  <font color="#009000"><strong>022: SECURITY FIX: May 5, 2004</strong></font> &nbsp; <i>All architectures</i><br>
 Pathname validation problems have been found in  Pathname validation problems have been found in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">cvs(1)</a>,  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">cvs(1)</a>,
 allowing malicious clients to create files outside the repository, allowing  allowing malicious clients to create files outside the repository, allowing
Line 92 
Line 90 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="openssl"></a>  <li><a name="openssl"></a>
 <font color="#009000"><strong>021: RELIABILITY FIX: March 17, 2004</strong></font><br>  <font color="#009000"><strong>021: RELIABILITY FIX: March 17, 2004</strong></font> &nbsp; <i>All architectures</i><br>
 A missing check for a NULL-pointer dereference has been found in  A missing check for a NULL-pointer dereference has been found in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;apropos=0&amp;sektion=3&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">ssl(3)</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;apropos=0&amp;sektion=3&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">ssl(3)</a>.
 A remote attacker can use the bug to cause an OpenSSL application to crash;  A remote attacker can use the bug to cause an OpenSSL application to crash;
Line 102 
Line 100 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="isakmpd2"></a>  <li><a name="isakmpd2"></a>
 <font color="#009000"><strong>020: RELIABILITY FIX: March 17, 2004</strong></font><br>  <font color="#009000"><strong>020: RELIABILITY FIX: March 17, 2004</strong></font> &nbsp; <i>All architectures</i><br>
 Defects in the payload validation and processing functions of  Defects in the payload validation and processing functions of
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>
 have been discovered.  An attacker could send malformed ISAKMP messages and  have been discovered.  An attacker could send malformed ISAKMP messages and
Line 113 
Line 111 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="httpd2"></a>  <li><a name="httpd2"></a>
 <font color="#009000"><strong>019: SECURITY FIX: March 13, 2004</strong></font><br>  <font color="#009000"><strong>019: SECURITY FIX: March 13, 2004</strong></font> &nbsp; <i>All architectures</i><br>
 Due to a bug in the parsing of Allow/Deny rules for  Due to a bug in the parsing of Allow/Deny rules for
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)'s</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)'s</a>
 access module, using IP addresses without a netmask on big endian 64-bit  access module, using IP addresses without a netmask on big endian 64-bit
Line 123 
Line 121 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="tcp"></a>  <li><a name="tcp"></a>
 <font color="#009000"><strong>018: RELIABILITY FIX: March 8, 2004</strong></font><br>  <font color="#009000"><strong>018: RELIABILITY FIX: March 8, 2004</strong></font> &nbsp; <i>All architectures</i><br>
 OpenBSD's TCP/IP stack did not impose limits on how many out-of-order  OpenBSD's TCP/IP stack did not impose limits on how many out-of-order
 TCP segments are queued in the system.  An attacker could  TCP segments are queued in the system.  An attacker could
 send out-of-order TCP segments and trick the system into using all  send out-of-order TCP segments and trick the system into using all
Line 133 
Line 131 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="font"></a>  <li><a name="font"></a>
 <font color="#009000"><strong>017: RELIABILITY FIX: February 14, 2004</strong></font><br>  <font color="#009000"><strong>017: RELIABILITY FIX: February 14, 2004</strong></font> &nbsp; <i>All architectures</i><br>
 Several buffer overflows exist in the code parsing  Several buffer overflows exist in the code parsing
 font.aliases files in XFree86. Thanks to ProPolice, these cannot be  font.aliases files in XFree86. Thanks to ProPolice, these cannot be
 exploited to gain privileges, but they can cause the X server to abort.  exploited to gain privileges, but they can cause the X server to abort.
Line 142 
Line 140 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="ip6"></a>  <li><a name="ip6"></a>
 <font color="#009000"><strong>016: SECURITY FIX: February 8, 2004</strong></font><br>  <font color="#009000"><strong>016: SECURITY FIX: February 8, 2004</strong></font> &nbsp; <i>All architectures</i><br>
 An IPv6 MTU handling problem exists that could be used by an attacker  An IPv6 MTU handling problem exists that could be used by an attacker
 to cause a denial of service attack against hosts with reachable IPv6  to cause a denial of service attack against hosts with reachable IPv6
 TCP ports.  TCP ports.
Line 151 
Line 149 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sysvshm"></a>  <li><a name="sysvshm"></a>
 <font color="#009000"><strong>015: SECURITY FIX: February 5, 2004</strong></font><br>  <font color="#009000"><strong>015: SECURITY FIX: February 5, 2004</strong></font> &nbsp; <i>All architectures</i><br>
 A reference counting bug exists in the  A reference counting bug exists in the
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=shmat&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;format=html">shmat(2)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=shmat&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;format=html">shmat(2)</a>
 system call that could be used by an attacker to write to kernel memory  system call that could be used by an attacker to write to kernel memory
Line 161 
Line 159 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="isakmpd"></a>  <li><a name="isakmpd"></a>
 <font color="#009000"><strong>014: SECURITY FIX: January 15, 2004</strong></font><br>  <font color="#009000"><strong>014: SECURITY FIX: January 15, 2004</strong></font> &nbsp; <i>All architectures</i><br>
 Several message handling flaws in  Several message handling flaws in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>
 have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs.  have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs.
Line 170 
Line 168 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sem"></a>  <li><a name="sem"></a>
 <font color="#009000"><strong>013: RELIABILITY FIX: November 20, 2003</strong></font><br>  <font color="#009000"><strong>013: RELIABILITY FIX: November 20, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 An improper bounds check makes it possible for a local user to cause a crash  An improper bounds check makes it possible for a local user to cause a crash
 by passing the  by passing the
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semctl&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">semctl(2)</a> and  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semctl&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">semctl(2)</a> and
Line 181 
Line 179 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="uvm"></a>  <li><a name="uvm"></a>
 <font color="#009000"><strong>012: RELIABILITY FIX: November 20, 2003</strong></font><br>  <font color="#009000"><strong>012: RELIABILITY FIX: November 20, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 It is possible for a local user to cause a crash via  It is possible for a local user to cause a crash via
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sysctl&amp;apropos=0&amp;sektion=3&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">sysctl(3)</a> with certain arguments.<br>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sysctl&amp;apropos=0&amp;sektion=3&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">sysctl(3)</a> with certain arguments.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/012_uvm.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/012_uvm.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="exec"></a>  <li><a name="exec"></a>
 <font color="#009000"><strong>010: RELIABILITY FIX: November 4, 2003</strong></font><br>  <font color="#009000"><strong>010: RELIABILITY FIX: November 4, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 It is possible for a local user to cause a system panic by executing a specially crafted binary with an invalid header.  It is possible for a local user to cause a system panic by executing a specially crafted binary with an invalid header.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/010_exec.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/010_exec.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="httpd"></a>  <li><a name="httpd"></a>
 <font color="#009000"><strong>009: RELIABILITY FIX: October 29, 2003</strong></font><br>  <font color="#009000"><strong>009: RELIABILITY FIX: October 29, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 A user with write permission to <tt>httpd.conf</tt> or a <tt>.htaccess</tt>  A user with write permission to <tt>httpd.conf</tt> or a <tt>.htaccess</tt>
 file can crash  file can crash
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>
Line 206 
Line 204 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="arp"></a>  <li><a name="arp"></a>
 <font color="#009000"><strong>008: RELIABILITY FIX: October 1, 2003</strong></font><br>  <font color="#009000"><strong>008: RELIABILITY FIX: October 1, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 It is possible for a local user to cause a system panic by flooding it with spoofed ARP  It is possible for a local user to cause a system panic by flooding it with spoofed ARP
 requests.<br>  requests.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/008_arp.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/008_arp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="asn1"></a>  <li><a name="asn1"></a>
 <font color="#009000"><strong>007: SECURITY FIX: October 1, 2003</strong></font><br>  <font color="#009000"><strong>007: SECURITY FIX: October 1, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 The use of certain ASN.1 encodings or malformed public keys may allow an  The use of certain ASN.1 encodings or malformed public keys may allow an
 attacker to mount a denial of service attack against applications linked with  attacker to mount a denial of service attack against applications linked with
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;sektion=3">ssl(3)</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;sektion=3">ssl(3)</a>.
Line 222 
Line 220 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="pfnorm"></a>  <li><a name="pfnorm"></a>
 <font color="#009000"><strong>006: SECURITY FIX: September 24, 2003</strong></font><br>  <font color="#009000"><strong>006: SECURITY FIX: September 24, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 Three cases of potential access to freed memory have been found in  Three cases of potential access to freed memory have been found in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pf&amp;sektion=4">pf(4)</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pf&amp;sektion=4">pf(4)</a>.
 At least one of them could be used to panic pf with active scrub rules remotely.<br>  At least one of them could be used to panic pf with active scrub rules remotely.<br>
Line 230 
Line 228 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sendmail"></a>  <li><a name="sendmail"></a>
 <font color="#009000"><strong>005: SECURITY FIX: September 17, 2003</strong></font><br>  <font color="#009000"><strong>005: SECURITY FIX: September 17, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 A buffer overflow in the address parsing in  A buffer overflow in the address parsing in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sendmail&amp;sektion=8">sendmail(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sendmail&amp;sektion=8">sendmail(8)</a>
 may allow an attacker to gain root privileges.<br>  may allow an attacker to gain root privileges.<br>
Line 240 
Line 238 
 problem.  problem.
 <p>  <p>
 <li><a name="sshbuffer"></a>  <li><a name="sshbuffer"></a>
 <font color="#009000"><strong>004: SECURITY FIX: September 16, 2003</strong></font><br>  <font color="#009000"><strong>004: SECURITY FIX: September 16, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 All versions of OpenSSH's sshd prior to 3.7 contain a buffer management error.  All versions of OpenSSH's sshd prior to 3.7 contain a buffer management error.
 It is unclear whether or not this bug is exploitable.<br>  It is unclear whether or not this bug is exploitable.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/004_sshbuffer.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/004_sshbuffer.patch">
Line 249 
Line 247 
 problem.  problem.
 <p>  <p>
 <li><a name="sysvsem"></a>  <li><a name="sysvsem"></a>
 <font color="#009000"><strong>003: SECURITY FIX: September 10, 2003</strong></font><br>  <font color="#009000"><strong>003: SECURITY FIX: September 10, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 Root may be able to reduce the security level by taking advantage of  Root may be able to reduce the security level by taking advantage of
 an integer overflow when the semaphore limits are made very large.<br>  an integer overflow when the semaphore limits are made very large.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/003_sysvsem.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/003_sysvsem.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="semget"></a>  <li><a name="semget"></a>
 <font color="#009000"><strong>002: RELIABILITY FIX: August 20, 2003</strong></font><br>  <font color="#009000"><strong>002: RELIABILITY FIX: August 20, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 An improper bounds check in the  An improper bounds check in the
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semget&amp;sektion=2">semget(2)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semget&amp;sektion=2">semget(2)</a>
 system call can allow a local user to cause a kernel panic.<br>  system call can allow a local user to cause a kernel panic.<br>
Line 264 
Line 262 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="realpath"></a>  <li><a name="realpath"></a>
 <font color="#009000"><strong>001: SECURITY FIX: August 4, 2003</strong></font><br>  <font color="#009000"><strong>001: SECURITY FIX: August 4, 2003</strong></font> &nbsp; <i>All architectures</i><br>
 An off-by-one error exists in the C library function  An off-by-one error exists in the C library function
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=realpath&amp;sektion=3">realpath(3)</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=realpath&amp;sektion=3">realpath(3)</a>.
 Since this same bug resulted in a root compromise in the wu-ftpd ftp server  Since this same bug resulted in a root compromise in the wu-ftpd ftp server
Legend:
Removed from v.1.51  
changed lines
  Added in v.1.52