[BACK]Return to errata34.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata34.html between version 1.61 and 1.62

version 1.61, 2014/03/31 04:11:40 version 1.62, 2014/03/31 16:02:48
Line 78 
Line 78 
   
 <ul>  <ul>
 <li><a name="pfkey"></a>  <li><a name="pfkey"></a>
 <font color="#009000"><strong>035: SECURITY FIX: December 13, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>035: SECURITY FIX: December 13, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 On systems running  On systems running
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>
 it is possible for a local user to cause kernel memory corruption  it is possible for a local user to cause kernel memory corruption
Line 90 
Line 91 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="lynx"></a>  <li><a name="lynx"></a>
 <font color="#009000"><strong>034: RELIABILITY FIX: November 10, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>034: RELIABILITY FIX: November 10, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Due to a bug in  Due to a bug in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=lynx&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">lynx(1)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=lynx&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">lynx(1)</a>
 it is possible for pages such as  it is possible for pages such as
Line 103 
Line 105 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="pppd"></a>  <li><a name="pppd"></a>
 <font color="#009000"><strong>033: RELIABILITY FIX: November 10, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>033: RELIABILITY FIX: November 10, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pppd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">pppd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pppd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">pppd(8)</a>
 contains a bug that allows an attacker to crash his own connection, but it cannot  contains a bug that allows an attacker to crash his own connection, but it cannot
 be used to deny service to other users.  be used to deny service to other users.
Line 112 
Line 115 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="bind"></a>  <li><a name="bind"></a>
 <font color="#009000"><strong>032: RELIABILITY FIX: November 10, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>032: RELIABILITY FIX: November 10, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 BIND contains a bug which results in BIND trying to contact nameservers via IPv6, even in  BIND contains a bug which results in BIND trying to contact nameservers via IPv6, even in
 cases where IPv6 connectivity is non-existent. This results in unnecessary timeouts and  cases where IPv6 connectivity is non-existent. This results in unnecessary timeouts and
 thus slow DNS queries.  thus slow DNS queries.
Line 121 
Line 125 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="radius"></a>  <li><a name="radius"></a>
 <font color="#009000"><strong>031: SECURITY FIX: September 20, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>031: SECURITY FIX: September 20, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Eilko Bos reported that radius authentication, as implemented by  Eilko Bos reported that radius authentication, as implemented by
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=login_radius&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">login_radius(8)</a>,  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=login_radius&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">login_radius(8)</a>,
 was not checking the shared secret used for replies sent by the radius server.  was not checking the shared secret used for replies sent by the radius server.
Line 132 
Line 137 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="xpm"></a>  <li><a name="xpm"></a>
 <font color="#009000"><strong>030: SECURITY FIX: September 16, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>030: SECURITY FIX: September 16, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Chris Evans reported several flaws (stack and integer overflows) in the  Chris Evans reported several flaws (stack and integer overflows) in the
 <a href="http://www.inria.fr/koala/lehors/xpm.html">Xpm</a>  <a href="http://www.inria.fr/koala/lehors/xpm.html">Xpm</a>
 library code that parses image files  library code that parses image files
Line 145 
Line 151 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="httpd4"></a>  <li><a name="httpd4"></a>
 <font color="#009000"><strong>029: SECURITY FIX: September 10, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>029: SECURITY FIX: September 10, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">httpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">httpd(8)</a>
 's mod_rewrite module can be made to write one zero byte in an arbitrary memory  's mod_rewrite module can be made to write one zero byte in an arbitrary memory
 position outside of a char array, causing a DoS or possibly buffer overflows.  position outside of a char array, causing a DoS or possibly buffer overflows.
Line 157 
Line 164 
 <p>  <p>
   
 <li><a name="bridge"></a>  <li><a name="bridge"></a>
 <font color="#009000"><strong>028: RELIABILITY FIX: August 26, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>028: RELIABILITY FIX: August 26, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 As  As
 <a href="http://marc.info/?l=bugtraq&amp;m=109345131508824&amp;w=2">reported</a>  <a href="http://marc.info/?l=bugtraq&amp;m=109345131508824&amp;w=2">reported</a>
 by Vafa Izadinia  by Vafa Izadinia
Line 168 
Line 176 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="icmp"></a>  <li><a name="icmp"></a>
 <font color="#009000"><strong>027: RELIABILITY FIX: August 25, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>027: RELIABILITY FIX: August 25, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Improved verification of ICMP errors in order to minimize the impact of ICMP attacks  Improved verification of ICMP errors in order to minimize the impact of ICMP attacks
 against TCP.  against TCP.
 <br>  <br>
Line 178 
Line 187 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="rnd"></a>  <li><a name="rnd"></a>
 <font color="#009000"><strong>026: RELIABILITY FIX: Jul 25, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>026: RELIABILITY FIX: Jul 25, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Under a certain network load the kernel can run out of stack space.  This was  Under a certain network load the kernel can run out of stack space.  This was
 encountered in an environment using CARP on a VLAN interface.  This issue initially  encountered in an environment using CARP on a VLAN interface.  This issue initially
 manifested itself as a FPU related crash on boot up.  manifested itself as a FPU related crash on boot up.
Line 187 
Line 197 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="httpd3"></a>  <li><a name="httpd3"></a>
 <font color="#009000"><strong>025: SECURITY FIX: June 12, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>025: SECURITY FIX: June 12, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Multiple vulnerabilities have been found in  Multiple vulnerabilities have been found in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">httpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">httpd(8)</a>
 / mod_ssl.  / mod_ssl.
Line 200 
Line 211 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="isakmpd3"></a>  <li><a name="isakmpd3"></a>
 <font color="#009000"><strong>024: SECURITY FIX: June 10, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>024: SECURITY FIX: June 10, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 As  As
 <a href="http://seclists.org/lists/fulldisclosure/2004/Jun/0191.html">disclosed</a>  <a href="http://seclists.org/lists/fulldisclosure/2004/Jun/0191.html">disclosed</a>
 by Thomas Walpuski  by Thomas Walpuski
Line 212 
Line 224 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="cvs3"></a>  <li><a name="cvs3"></a>
 <font color="#009000"><strong>023: SECURITY FIX: June 9, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>023: SECURITY FIX: June 9, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Multiple remote vulnerabilities have been found in the  Multiple remote vulnerabilities have been found in the
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">cvs(1)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">cvs(1)</a>
 server that allow an attacker to crash the server or possibly execute arbitrary  server that allow an attacker to crash the server or possibly execute arbitrary
Line 222 
Line 235 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="kerberos"></a>  <li><a name="kerberos"></a>
 <font color="#00900"><strong>022: SECURITY FIX: May 30, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#00900"><strong>022: SECURITY FIX: May 30, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 A flaw in the Kerberos V  A flaw in the Kerberos V
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=kdc">kdc(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=kdc">kdc(8)</a>
 server could result in the administrator of a Kerberos realm having  server could result in the administrator of a Kerberos realm having
Line 236 
Line 250 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="cvs2"></a>  <li><a name="cvs2"></a>
 <font color="#009000"><strong>021: SECURITY FIX: May 20, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>021: SECURITY FIX: May 20, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 A heap overflow in the  A heap overflow in the
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">cvs(1)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">cvs(1)</a>
 server has been discovered that can be exploited by clients sending  server has been discovered that can be exploited by clients sending
Line 247 
Line 262 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="procfs"></a>  <li><a name="procfs"></a>
 <font color="#009000"><strong>020: SECURITY FIX: May 13, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>020: SECURITY FIX: May 13, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Check for integer overflow in procfs.  Use of procfs is not recommended.  Check for integer overflow in procfs.  Use of procfs is not recommended.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/020_procfs.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/020_procfs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="tcp2"></a>  <li><a name="tcp2"></a>
 <font color="#009000"><strong>019: RELIABILITY FIX: May 6, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>019: RELIABILITY FIX: May 6, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Reply to in-window SYN with a rate-limited ACK.  Reply to in-window SYN with a rate-limited ACK.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/019_tcp2.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/019_tcp2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="gdt"></a>  <li><a name="gdt"></a>
 <font color="#009000"><strong>018: RELIABILITY FIX: May 5, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>018: RELIABILITY FIX: May 5, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Under load "recent model"  Under load "recent model"
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=gdt&amp;apropos=0&amp;sektion=4&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">gdt(4)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=gdt&amp;apropos=0&amp;sektion=4&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">gdt(4)</a>
 controllers will lock up.  controllers will lock up.
Line 270 
Line 288 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="cvs"></a>  <li><a name="cvs"></a>
 <font color="#009000"><strong>017: SECURITY FIX: May 5, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>017: SECURITY FIX: May 5, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Pathname validation problems have been found in  Pathname validation problems have been found in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">cvs(1)</a>,  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&amp;apropos=0&amp;sektion=1&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">cvs(1)</a>,
 allowing malicious clients to create files outside the repository, allowing  allowing malicious clients to create files outside the repository, allowing
Line 282 
Line 301 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="openssl"></a>  <li><a name="openssl"></a>
 <font color="#009000"><strong>016: RELIABILITY FIX: March 17, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>016: RELIABILITY FIX: March 17, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 A missing check for a NULL-pointer dereference has been found in  A missing check for a NULL-pointer dereference has been found in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;apropos=0&amp;sektion=3&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">ssl(3)</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;apropos=0&amp;sektion=3&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">ssl(3)</a>.
 A remote attacker can use the bug to cause an OpenSSL application to crash;  A remote attacker can use the bug to cause an OpenSSL application to crash;
Line 292 
Line 312 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="isakmpd2"></a>  <li><a name="isakmpd2"></a>
 <font color="#009000"><strong>015: RELIABILITY FIX: March 17, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>015: RELIABILITY FIX: March 17, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Defects in the payload validation and processing functions of  Defects in the payload validation and processing functions of
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>
 have been discovered.  An attacker could send malformed ISAKMP messages and  have been discovered.  An attacker could send malformed ISAKMP messages and
Line 303 
Line 324 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="httpd2"></a>  <li><a name="httpd2"></a>
 <font color="#009000"><strong>014: SECURITY FIX: March 13, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>014: SECURITY FIX: March 13, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Due to a bug in the parsing of Allow/Deny rules for  Due to a bug in the parsing of Allow/Deny rules for
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)'s</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)'s</a>
 access module, using IP addresses without a netmask on big endian 64-bit  access module, using IP addresses without a netmask on big endian 64-bit
Line 313 
Line 335 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="tcp"></a>  <li><a name="tcp"></a>
 <font color="#009000"><strong>013: RELIABILITY FIX: March 8, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>013: RELIABILITY FIX: March 8, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 OpenBSD's TCP/IP stack did not impose limits on how many out-of-order  OpenBSD's TCP/IP stack did not impose limits on how many out-of-order
 TCP segments are queued in the system.  An attacker could  TCP segments are queued in the system.  An attacker could
 send out-of-order TCP segments and trick the system into using all  send out-of-order TCP segments and trick the system into using all
Line 323 
Line 346 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="font"></a>  <li><a name="font"></a>
 <font color="#009000"><strong>012: RELIABILITY FIX: February 14, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>012: RELIABILITY FIX: February 14, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Several buffer overflows exist in the code parsing  Several buffer overflows exist in the code parsing
 font.aliases files in XFree86. Thanks to ProPolice, these cannot be  font.aliases files in XFree86. Thanks to ProPolice, these cannot be
 exploited to gain privileges, but they can cause the X server to abort.  exploited to gain privileges, but they can cause the X server to abort.
Line 332 
Line 356 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="ip6"></a>  <li><a name="ip6"></a>
 <font color="#009000"><strong>011: SECURITY FIX: February 8, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>011: SECURITY FIX: February 8, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 An IPv6 MTU handling problem exists that could be used by an attacker  An IPv6 MTU handling problem exists that could be used by an attacker
 to cause a denial of service attack against hosts with reachable IPv6  to cause a denial of service attack against hosts with reachable IPv6
 TCP ports.  TCP ports.
Line 341 
Line 366 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sysvshm"></a>  <li><a name="sysvshm"></a>
 <font color="#009000"><strong>010: SECURITY FIX: February 5, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>010: SECURITY FIX: February 5, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 A reference counting bug exists in the  A reference counting bug exists in the
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=shmat&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;format=html">shmat(2)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=shmat&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;format=html">shmat(2)</a>
 system call that could be used by an attacker to write to kernel memory  system call that could be used by an attacker to write to kernel memory
Line 351 
Line 377 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="isakmpd"></a>  <li><a name="isakmpd"></a>
 <font color="#009000"><strong>009: SECURITY FIX: January 13, 2004</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>009: SECURITY FIX: January 13, 2004</strong></font>
   &nbsp; <i>All architectures</i><br>
 Several message handling flaws in  Several message handling flaws in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;apropos=0&amp;sektion=8&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">isakmpd(8)</a>
 have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs. The patch also  have been reported by Thomas Walpuski. These allow an attacker to delete arbitrary SAs. The patch also
Line 362 
Line 389 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="sem"></a>  <li><a name="sem"></a>
 <font color="#009000"><strong>008: RELIABILITY FIX: November 20, 2003</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>008: RELIABILITY FIX: November 20, 2003</strong></font>
   &nbsp; <i>All architectures</i><br>
 An improper bounds check makes it possible for a local user to cause a crash  An improper bounds check makes it possible for a local user to cause a crash
 by passing the  by passing the
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semctl&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">semctl(2)</a> and  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=semctl&amp;apropos=0&amp;sektion=2&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">semctl(2)</a> and
Line 373 
Line 401 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="uvm"></a>  <li><a name="uvm"></a>
 <font color="#009000"><strong>007: RELIABILITY FIX: November 20, 2003</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>007: RELIABILITY FIX: November 20, 2003</strong></font>
   &nbsp; <i>All architectures</i><br>
 It is possible for a local user to cause a crash via  It is possible for a local user to cause a crash via
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sysctl&amp;apropos=0&amp;sektion=3&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">sysctl(3)</a> with certain arguments.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sysctl&amp;apropos=0&amp;sektion=3&amp;manpath=OpenBSD+Current&amp;arch=i386&amp;format=html">sysctl(3)</a> with certain arguments.
 <br>  <br>
Line 381 
Line 410 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="ibcs2"></a>  <li><a name="ibcs2"></a>
 <font color="#009000"><strong>006: SECURITY FIX: November 17, 2003</strong></font> &nbsp; <i>i386 only</a><br>  <font color="#009000"><strong>006: SECURITY FIX: November 17, 2003</strong></font>
   &nbsp; <i>i386 only</a><br>
 It may be possible for a local user to overrun the stack in  It may be possible for a local user to overrun the stack in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=compat_ibcs2&amp;sektion=8&amp;apropos=0&amp;manpath=OpenBSD+Current&amp;arch=i386">compat_ibcs2(8)</a>.<br>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=compat_ibcs2&amp;sektion=8&amp;apropos=0&amp;manpath=OpenBSD+Current&amp;arch=i386">compat_ibcs2(8)</a>.<br>
 ProPolice catches this, turning a potential privilege escalation into a denial  ProPolice catches this, turning a potential privilege escalation into a denial
Line 393 
Line 423 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="exec"></a>  <li><a name="exec"></a>
 <font color="#009000"><strong>005: RELIABILITY FIX: November 4, 2003</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>005: RELIABILITY FIX: November 4, 2003</strong></font>
   &nbsp; <i>All architectures</i><br>
 It is possible for a local user to cause a system panic by executing a specially crafted binary with an invalid header.  It is possible for a local user to cause a system panic by executing a specially crafted binary with an invalid header.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/005_exec.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/005_exec.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="httpd"></a>  <li><a name="httpd"></a>
 <font color="#009000"><strong>004: RELIABILITY FIX: November 1, 2003</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>004: RELIABILITY FIX: November 1, 2003</strong></font>
   &nbsp; <i>All architectures</i><br>
 A user with write permission to <tt>httpd.conf</tt> or a <tt>.htaccess</tt>  A user with write permission to <tt>httpd.conf</tt> or a <tt>.htaccess</tt>
 file can crash  file can crash
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>
Line 411 
Line 443 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="arp"></a>  <li><a name="arp"></a>
 <font color="#009000"><strong>003: RELIABILITY FIX: November 1, 2003</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>003: RELIABILITY FIX: November 1, 2003</strong></font>
   &nbsp; <i>All architectures</i><br>
 It is possible for a local user to cause a system panic by flooding it with spoofed ARP  It is possible for a local user to cause a system panic by flooding it with spoofed ARP
 requests.<br>  requests.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/003_arp.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/003_arp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="asn1"></a>  <li><a name="asn1"></a>
 <font color="#009000"><strong>002: SECURITY FIX: November 1, 2003</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>002: SECURITY FIX: November 1, 2003</strong></font>
   &nbsp; <i>All architectures</i><br>
 The use of certain ASN.1 encodings or malformed public keys may allow an  The use of certain ASN.1 encodings or malformed public keys may allow an
 attacker to mount a denial of service attack against applications linked with  attacker to mount a denial of service attack against applications linked with
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;sektion=3">ssl(3)</a>.  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&amp;sektion=3">ssl(3)</a>.
Line 427 
Line 461 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li><a name="cd_booklet"></a>  <li><a name="cd_booklet"></a>
 <font color="#009000"><strong>001: DOCUMENTATION FIX: November 1, 2003</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>001: DOCUMENTATION FIX: November 1, 2003</strong></font>
   &nbsp; <i>All architectures</i><br>
 The CD insert documentation has an incorrect example for package installation.<br>  The CD insert documentation has an incorrect example for package installation.<br>
 Where it is written:<p>  Where it is written:<p>
 <strong>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  <strong>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Legend:
Removed from v.1.61  
changed lines
  Added in v.1.62