[BACK]Return to errata33.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata33.html between version 1.7 and 1.8

version 1.7, 2003/11/21 02:34:01 version 1.8, 2003/11/21 16:55:16
Line 8 
Line 8 
 <meta name="keywords" content="openbsd,cd,errata">  <meta name="keywords" content="openbsd,cd,errata">
 <meta name="distribution" content="global">  <meta name="distribution" content="global">
 <meta name="copyright" content="This document copyright 1997-2003 by OpenBSD.">  <meta name="copyright" content="This document copyright 1997-2003 by OpenBSD.">
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 </head>  </head>
   
 <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#23238E">  <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#23238E">
Line 51 
Line 52 
 consult the <a href="./faq/faq10.html#Patches">OpenBSD FAQ</a>.  consult the <a href="./faq/faq10.html#Patches">OpenBSD FAQ</a>.
 <hr>  <hr>
   
 <dl>  <a name="all"></a>
 <a name=all></a>  <h3><font color="#e00000">All architectures</font></h3>
 <li><h3><font color="#e00000">All architectures</font></h3>  
 <ul>  <ul>
 <a name=sem></a>  <li><a name="sem"></a>
 <li><font color="#009000"><strong>013: RELIABILITY FIX: November 20, 2003</strong></font><br>  <font color="#009000"><strong>013: RELIABILITY FIX: November 20, 2003</strong></font><br>
 An improper bounds check makes it possible for a local user to cause a crash  An improper bounds check makes it possible for a local user to cause a crash
 by passing the  by passing the
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semctl&apropos=0&sektion=2&manpath=OpenBSD+Current&arch=i386&format=html">semctl(2)</a> and  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semctl&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">semctl(2)</a> and
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semop&apropos=0&sektion=2&manpath=OpenBSD+Current&arch=i386&format=html">semop(2)</a> functions  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semop&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">semop(2)</a> functions
 certain arguments.  certain arguments.
 <br>  <br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/013_sem.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/013_sem.patch">
 A source code patch exists which remedies the problem</a>.<br>  A source code patch exists which remedies the problem</a>.<br>
 <p>  <p>
 <a name=uvm></a>  <li><a name="uvm"></a>
 <li><font color="#009000"><strong>012: RELIABILITY FIX: November 20, 2003</strong></font><br>  <font color="#009000"><strong>012: RELIABILITY FIX: November 20, 2003</strong></font><br>
 It is possible for a local user to cause a crash via  It is possible for a local user to cause a crash via
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sysctl&apropos=0&sektion=3&manpath=OpenBSD+Current&arch=i386&format=html">sysctl(3)</a> with certain arguments.<br>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sysctl&amp;apropos=0&amp;sektion=3&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">sysctl(3)</a> with certain arguments.<br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/012_uvm.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/012_uvm.patch">
 A source code patch exists which remedies the problem</a>.<br>  A source code patch exists which remedies the problem</a>.<br>
 <p>  <p>
 <a name=exec></a>  <li><a name="exec"></a>
 <li><font color="#009000"><strong>010: RELIABILITY FIX: November 4, 2003</strong></font><br>  <font color="#009000"><strong>010: RELIABILITY FIX: November 4, 2003</strong></font><br>
 It is possible for a local user to cause a system panic by executing a specially crafted binary with an invalid header.  It is possible for a local user to cause a system panic by executing a specially crafted binary with an invalid header.
 <br>  <br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/010_exec.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/010_exec.patch">
 A source code patch exists which remedies the problem</a>.<br>  A source code patch exists which remedies the problem</a>.<br>
 <p>  <p>
 <a name=httpd></a>  <li><a name="httpd"></a>
 <li><font color="#009000"><strong>009: RELIABILITY FIX: October 29, 2003</strong></font><br>  <font color="#009000"><strong>009: RELIABILITY FIX: October 29, 2003</strong></font><br>
 A user with write permission to <tt>httpd.conf</tt> or a <tt>.htaccess</tt>  A user with write permission to <tt>httpd.conf</tt> or a <tt>.htaccess</tt>
 file can crash  file can crash
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>
Line 91 
Line 91 
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/009_httpd.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/009_httpd.patch">
 A source code patch exists which remedies the problem</a>.<br>  A source code patch exists which remedies the problem</a>.<br>
 <p>  <p>
 <a name=arp></a>  <li><a name="arp"></a>
 <li><font color="#009000"><strong>008: RELIABILITY FIX: October 1, 2003</strong></font><br>  <font color="#009000"><strong>008: RELIABILITY FIX: October 1, 2003</strong></font><br>
 It is possible for a local user to cause a system panic by flooding it with spoofed ARP  It is possible for a local user to cause a system panic by flooding it with spoofed ARP
 requests.<br>  requests.<br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/008_arp.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/008_arp.patch">
 A source code patch exists which remedies the problem</a>.<br>  A source code patch exists which remedies the problem</a>.<br>
 <p>  <p>
 <a name=asn1></a>  <li><a name="asn1"></a>
 <li><font color="#009000"><strong>007: SECURITY FIX: October 1, 2003</strong></font><br>  <font color="#009000"><strong>007: SECURITY FIX: October 1, 2003</strong></font><br>
 The use of certain ASN.1 encodings or malformed public keys may allow an  The use of certain ASN.1 encodings or malformed public keys may allow an
 attacker to mount a denial of service attack against applications linked with  attacker to mount a denial of service attack against applications linked with
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;sektion=3">ssl(3)</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;sektion=3">ssl(3)</a>.
Line 107 
Line 107 
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/007_asn1.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/007_asn1.patch">
 A source code patch exists which remedies the problem</a>.<br>  A source code patch exists which remedies the problem</a>.<br>
 <p>  <p>
 <a name=pfnorm></a>  <li><a name="pfnorm"></a>
 <li><font color="#009000"><strong>006: SECURITY FIX: September 24, 2003</strong></font><br>  <font color="#009000"><strong>006: SECURITY FIX: September 24, 2003</strong></font><br>
 Three cases of potential access to freed memory have been found in  Three cases of potential access to freed memory have been found in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pf&amp;sektion=4">pf(4)</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pf&amp;sektion=4">pf(4)</a>.
 At least one of them could be used to panic pf with active scrub rules remotely.<br>  At least one of them could be used to panic pf with active scrub rules remotely.<br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/006_pfnorm.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/006_pfnorm.patch">
 A source code patch exists which remedies the problem</a>.<br>  A source code patch exists which remedies the problem</a>.<br>
 <p>  <p>
 <a name=sendmail></a>  <li><a name="sendmail"></a>
 <li><font color="#009000"><strong>005: SECURITY FIX: September 17, 2003</strong></font><br>  <font color="#009000"><strong>005: SECURITY FIX: September 17, 2003</strong></font><br>
 A buffer overflow in the address parsing in  A buffer overflow in the address parsing in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sendmail&amp;sektion=8">sendmail(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sendmail&amp;sektion=8">sendmail(8)</a>
 may allow an attacker to gain root privileges.<br>  may allow an attacker to gain root privileges.<br>
Line 125 
Line 125 
 NOTE: this is the <em>second</em> revision of the patch that fixes an additional  NOTE: this is the <em>second</em> revision of the patch that fixes an additional
 problem.  problem.
 <p>  <p>
 <a name=sshbuffer></a>  <li><a name="sshbuffer"></a>
 <li><font color="#009000"><strong>004: SECURITY FIX: September 16, 2003</strong></font><br>  <font color="#009000"><strong>004: SECURITY FIX: September 16, 2003</strong></font><br>
 All versions of OpenSSH's sshd prior to 3.7 contain a buffer management error.  All versions of OpenSSH's sshd prior to 3.7 contain a buffer management error.
 It is unclear whether or not this bug is exploitable.<br>  It is unclear whether or not this bug is exploitable.<br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/004_sshbuffer.patch">A  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/004_sshbuffer.patch">A
Line 134 
Line 134 
 NOTE: this is the <em>second</em> revision of the patch that fixes an additional  NOTE: this is the <em>second</em> revision of the patch that fixes an additional
 problem.  problem.
 <p>  <p>
 <a name=sysvsem></a>  <li><a name="sysvsem"></a>
 <li><font color="#009000"><strong>003: SECURITY FIX: September 10, 2003</strong></font><br>  <font color="#009000"><strong>003: SECURITY FIX: September 10, 2003</strong></font><br>
 Root may be able to reduce the security level by taking advantage of  Root may be able to reduce the security level by taking advantage of
 an integer overflow when the semaphore limits are made very large.<br>  an integer overflow when the semaphore limits are made very large.<br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/003_sysvsem.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/003_sysvsem.patch">
 A source code patch exists which remedies the problem</a>.  A source code patch exists which remedies the problem</a>.
 <p>  <p>
 <a name=semget></a>  <li><a name="semget"></a>
 <li><font color="#009000"><strong>002: RELIABILITY FIX: August 20, 2003</strong></font><br>  <font color="#009000"><strong>002: RELIABILITY FIX: August 20, 2003</strong></font><br>
 An improper bounds check in the  An improper bounds check in the
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semget&amp;sektion=2">semget(2)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semget&amp;sektion=2">semget(2)</a>
 system call can allow a local user to cause a kernel panic.<br>  system call can allow a local user to cause a kernel panic.<br>
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/002_semget.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/002_semget.patch">
 A source code patch exists which remedies the problem</a>.  A source code patch exists which remedies the problem</a>.
 <a name=realpath></a>  <a name="realpath"></a>
 <p>  <p>
 <li><font color="#009000"><strong>001: SECURITY FIX: August 4, 2003</strong></font><br>  <li><font color="#009000"><strong>001: SECURITY FIX: August 4, 2003</strong></font><br>
 An off-by-one error exists in the C library function  An off-by-one error exists in the C library function
Line 161 
Line 161 
 <p>  <p>
 </ul>  </ul>
 <p>  <p>
 <a name=i386></a>  <a name="i386"></a>
 <li><h3><font color="#e00000">i386</font></h3>  <h3><font color="#e00000">i386</font></h3>
 <ul>  <ul>
 <a name=ibcs2></a>  <li><a name="ibcs2"></a>
 <li><font color="#009000"><strong>011: SECURITY FIX: November 17, 2003</strong></font><br>  <font color="#009000"><strong>011: SECURITY FIX: November 17, 2003</strong></font><br>
 It is possible for a local user to execute arbitrary code resulting in escalation of  It is possible for a local user to execute arbitrary code resulting in escalation of
 privileges due to a stack overrun in  privileges due to a stack overrun in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=compat_ibcs2&sektion=8&apr  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=compat_ibcs2&amp;sektion=8&amp;apropos=0&amp;manpath=OpenBSD+Current&amp;arch=i386">compat_ibcs2(8)</a>.<br>
 opos=0&manpath=OpenBSD+Current&arch=i386">compat_ibcs2(8)</a>.<br>  
 <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/i386/011_ibcs2.patch">  <a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/i386/011_ibcs2.patch">
 A source code patch exists which remedies the problem</a>.<br>  A source code patch exists which remedies the problem</a>.<br>
 <p>  <p>
 </ul>  </ul>
 <p>  <p>
 <a name=alpha></a>  <a name="alpha"></a>
 <li><h3><font color="#e00000">alpha</font></h3>  <h3><font color="#e00000">alpha</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 </ul>  </ul>
 <p>  <p>
 <a name=mac68k></a>  <a name="mac68k"></a>
 <li><h3><font color="#e00000">mac68k</font></h3>  <h3><font color="#e00000">mac68k</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 </ul>  </ul>
 <p>  <p>
 <a name=sparc></a>  <a name="sparc"></a>
 <li><h3><font color="#e00000">sparc</font></h3>  <h3><font color="#e00000">sparc</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 </ul>  </ul>
 <p>  <p>
 <a name=sparc64></a>  <a name="sparc64"></a>
 <li><h3><font color="#e00000">sparc64</font></h3>  <h3><font color="#e00000">sparc64</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 </ul>  </ul>
 <p>  <p>
 <a name=hppa></a>  <a name="hppa"></a>
 <li><h3><font color="#e00000">hppa</font></h3>  <h3><font color="#e00000">hppa</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 </ul>  </ul>
 <p>  <p>
 <a name=hp300></a>  <a name="hp300"></a>
 <li><h3><font color="#e00000">hp300</font></h3>  <h3><font color="#e00000">hp300</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 </ul>  </ul>
 <p>  <p>
 <a name=mvme68k></a>  <a name="mvme68k"></a>
 <li><h3><font color="#e00000">mvme68k</font></h3>  <h3><font color="#e00000">mvme68k</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 </ul>  </ul>
 <p>  <p>
 <a name=macppc></a>  <a name="macppc"></a>
 <li><h3><font color="#e00000">macppc</font></h3>  <h3><font color="#e00000">macppc</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 </ul>  </ul>
 <p>  <p>
 <a name=vax></a>  <a name="vax"></a>
 <li><h3><font color="#e00000">vax</font></h3>  <h3><font color="#e00000">vax</font></h3>
 <ul>  <ul>
 <li>No problems identified yet.  <li>No problems identified yet.
 </ul>  </ul>
   
 </dl>  
 <br>  <br>
   
 <hr>  <hr>
Legend:
Removed from v.1.7  
changed lines
  Added in v.1.8