=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/errata33.html,v retrieving revision 1.65 retrieving revision 1.66 diff -u -r1.65 -r1.66 --- www/errata33.html 2016/03/21 05:46:20 1.65 +++ www/errata33.html 2016/03/22 10:54:42 1.66 @@ -87,7 +87,7 @@ 022: SECURITY FIX: May 5, 2004   All architectures
Pathname validation problems have been found in -cvs(1), +cvs(1), allowing malicious clients to create files outside the repository, allowing malicious servers to overwrite files outside the local CVS tree on the client and allowing clients to check out files outside the CVS @@ -100,7 +100,7 @@ 021: RELIABILITY FIX: March 17, 2004   All architectures
A missing check for a NULL-pointer dereference has been found in -ssl(3). +ssl(3). A remote attacker can use the bug to cause an OpenSSL application to crash; this may lead to a denial of service.
@@ -111,7 +111,7 @@ 020: RELIABILITY FIX: March 17, 2004   All architectures
Defects in the payload validation and processing functions of -isakmpd(8) +isakmpd(8) have been discovered. An attacker could send malformed ISAKMP messages and cause isakmpd to crash or to loop endlessly. This patch fixes these problems and removes some memory leaks. @@ -123,7 +123,7 @@ 019: SECURITY FIX: March 13, 2004   All architectures
Due to a bug in the parsing of Allow/Deny rules for -httpd(8)'s +httpd(8)'s access module, using IP addresses without a netmask on big endian 64-bit platforms causes the rules to fail to match. This only affects sparc64.
@@ -165,7 +165,7 @@ 015: SECURITY FIX: February 5, 2004   All architectures
A reference counting bug exists in the -shmat(2) +shmat(2) system call that could be used by an attacker to write to kernel memory under certain circumstances.
@@ -176,7 +176,7 @@ 014: SECURITY FIX: January 15, 2004   All architectures
Several message handling flaws in -isakmpd(8) +isakmpd(8) have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs.
@@ -187,8 +187,8 @@   All architectures
An improper bounds check makes it possible for a local user to cause a crash by passing the -semctl(2) and -semop(2) functions +semctl(2) and +semop(2) functions certain arguments.
@@ -198,7 +198,7 @@ 012: RELIABILITY FIX: November 20, 2003   All architectures
It is possible for a local user to cause a crash via -sysctl(3) with certain arguments.
+sysctl(3) with certain arguments.
A source code patch exists which remedies this problem.

@@ -208,7 +208,7 @@   i386 only
It is possible for a local user to execute arbitrary code resulting in escalation of privileges due to a stack overrun in -compat_ibcs2(8).
+compat_ibcs2(8).
A source code patch exists which remedies this problem.

@@ -225,7 +225,7 @@   All architectures
A user with write permission to httpd.conf or a .htaccess file can crash -httpd(8) +httpd(8) or potentially run arbitrary code as the user www (although it is believed that ProPolice will prevent code execution).
@@ -245,7 +245,7 @@   All architectures
The use of certain ASN.1 encodings or malformed public keys may allow an attacker to mount a denial of service attack against applications linked with -ssl(3). +ssl(3). This does not affect OpenSSH.
A source code patch exists which remedies this problem. @@ -254,7 +254,7 @@ 006: SECURITY FIX: September 24, 2003   All architectures
Three cases of potential access to freed memory have been found in -pf(4). +pf(4). At least one of them could be used to panic pf with active scrub rules remotely.
A source code patch exists which remedies this problem. @@ -263,7 +263,7 @@ 005: SECURITY FIX: September 17, 2003   All architectures
A buffer overflow in the address parsing in -sendmail(8) +sendmail(8) may allow an attacker to gain root privileges.
A source code patch exists which remedies this problem. @@ -292,7 +292,7 @@ 002: RELIABILITY FIX: August 20, 2003   All architectures
An improper bounds check in the -semget(2) +semget(2) system call can allow a local user to cause a kernel panic.
A source code patch exists which remedies this problem. @@ -301,7 +301,7 @@ 001: SECURITY FIX: August 4, 2003   All architectures
An off-by-one error exists in the C library function -realpath(3). +realpath(3). Since this same bug resulted in a root compromise in the wu-ftpd ftp server it is possible that this bug may allow an attacker to gain escalated privileges on OpenBSD.