[BACK]Return to errata35.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata35.html between version 1.78 and 1.79

version 1.78, 2019/05/27 22:55:19 version 1.79, 2019/05/28 16:32:42
Line 84 
Line 84 
 <hr>  <hr>
   
 <ul>  <ul>
 <li id="cvs4">  
 <strong>033: SECURITY FIX: April 28, 2005</strong>  <li id="autobook_package">
   <strong>001: BROKEN PACKAGE ON CD: May 4, 2004</strong>&nbsp; <i>macppc only</i><br>
   The powerpc autobook-1.3.tgz package found on CD2 has been found to be corrupt,
   and will not extract.
   A replacement package can be found on the ftp sites.
   <p>
   
   <li id="cvs">
   <strong>002: SECURITY FIX: May 5, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix a buffer overflow, memory leaks, and NULL pointer dereference in  Pathname validation problems have been found in
 <a href="https://man.openbsd.org/OpenBSD-3.5/cvs.1">cvs(1)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/cvs.1">cvs(1)</a>,
 . None of these issues are known to be exploitable.  allowing malicious clients to create files outside the repository, allowing
 <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a>  malicious servers to overwrite files outside the local CVS tree on
 .  the client and allowing clients to check out files outside the CVS
   repository.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/033_cvs4.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/002_cvs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="tcp2">  <li id="gdt">
 <strong>032: RELIABILITY FIX: April 4, 2005</strong>  <strong>003: RELIABILITY FIX: May 5, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Handle an edge condition in  Under load "recent model"
 <a href="https://man.openbsd.org/OpenBSD-3.5/tcp.4">tcp(4)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/gdt.4">gdt(4)</a>
 timestamps.  controllers will lock up.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/032_tcp2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/003_gdt.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="telnet">  <li id="scsi">
 <strong>031: SECURITY FIX: March 30, 2005</strong>  <strong>004: RELIABILITY FIX: May 5, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to buffer overflows in  Restore the ability to negotiate tags/wide/sync with some SCSI controllers ( i.e.
 <a href="https://man.openbsd.org/OpenBSD-3.5/telnet.1">telnet(1)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/siop.4">siop(4)</a>,
 , a malicious server or man-in-the-middle attack could allow execution of  <a href="https://man.openbsd.org/OpenBSD-3.5/trm.4">trm(4)</a>,
 arbitrary code with the privileges of the user invoking  <a href="https://man.openbsd.org/OpenBSD-3.5/iha.4">iha(4)</a>
 <a href="https://man.openbsd.org/OpenBSD-3.5/telnet.1">telnet(1)</a>  ).
 .  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/031_telnet.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/004_scsi.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sack">  <li id="tcp">
 <strong>030: RELIABILITY FIX: March 30, 2005</strong>  <strong>005: RELIABILITY FIX: May 6, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Bugs in the  Reply to in-window SYN with a rate-limited ACK.
 <a href="https://man.openbsd.org/OpenBSD-3.5/tcp.4">tcp(4)</a>  
 stack can lead to memory exhaustion or processing of TCP segments with  
 invalid SACK options and cause a system crash.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/030_sack.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/005_tcp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="copy">  <li id="procfs">
 <strong>029: SECURITY FIX: March 16, 2005</strong>  <strong>006: SECURITY FIX: May 13, 2004</strong>
 &nbsp; <i>amd64 only</i><br>  &nbsp; <i>All architectures</i><br>
 More stringent checking should be done in the  Check for integer overflow in procfs.  Use of procfs is not recommended.
 <a href="https://man.openbsd.org/OpenBSD-3.5/copy.9">copy(9)</a>  
 functions to prevent their misuse.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/amd64/029_copy.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/006_procfs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="locore">  <li id="cvs2">
 <strong>028: SECURITY FIX: February 28, 2005</strong>  <strong>007: SECURITY FIX: May 20, 2004</strong>
 &nbsp; <i>i386 only</i><br>  &nbsp; <i>All architectures</i><br>
 More stringent checking should be done in the  A heap overflow in the
 <a href="https://man.openbsd.org/OpenBSD-3.5/copy.9">copy(9)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/cvs.1">cvs(1)</a>
 functions to prevent their misuse.  server has been discovered that can be exploited by clients sending
   malformed requests, enabling these clients to run arbitrary code
   with the same privileges as the CVS server program.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/i386/028_locore.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/007_cvs2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="rtt">  <li id="xdm">
 <strong>027: RELIABILITY FIX: January 11, 2005</strong>  <strong>008: SECURITY FIX: May 26, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A bug in the  With the introduction of IPv6 code in
 <a href="https://man.openbsd.org/OpenBSD-3.5/tcp.4">tcp(4)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/xdm.1">xdm(1)</a>,
 stack allows an invalid argument to be used in calculating the TCP  one test on the 'requestPort' resource was deleted by accident. This
 retransmit timeout. By sending packets with specific values in the TCP  makes xdm create the chooser socket even if xdmcp is disabled in
 timestamp option, an attacker can cause a system panic.  xdm-config, by setting requestPort to 0. See
   <a href="http://bugs.xfree86.org/show_bug.cgi?id=1376">XFree86
   bugzilla</a> for details.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/027_rtt.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/008_xdm.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="httpd3">  <li id="kerberos">
 <strong>026: SECURITY FIX: January 12, 2005</strong>  <strong>009: SECURITY FIX: May 30, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.5/httpd.8">httpd(8)</a>  A flaw in the Kerberos V
 's mod_include module fails to properly validate the length of  <a href="https://man.openbsd.org/OpenBSD-3.5/kdc">kdc(8)</a>
 user supplied tag strings prior to copying them to a local buffer,  server could result in the administrator of a Kerberos realm having
 causing a buffer overflow.  the ability to impersonate any principal in any other realm which
   has established a cross-realm trust with their realm. The flaw is due to
   inadequate checking of the "transited" field in a Kerberos request. For
   more details see <a href="http://www.pdc.kth.se/heimdal/advisory/2004-04-01/">
   Heimdal's announcement</a>.
 <br>  <br>
 This would require enabling the XBitHack directive or server-side  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/009_kerberos.patch">
 includes and making use of a malicious document.  A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="fifofs">
   <strong>010: RELIABILITY FIX: June 9, 2004</strong>
   &nbsp; <i>All architectures</i><br>
   A FIFO bug was introduced in OpenBSD 3.5 that occurs when a FIFO is opened in
   non-blocking mode for writing when there are no processes reading the FIFO.
   One program affected by this is the <a href="http://www.qmail.org/">qmail</a>
   mail server which could go into an infinite loop and consume all CPU.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/026_httpd3.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/010_fifofs.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="getcwd">  <li id="cvs3">
 <strong>025: RELIABILITY FIX: January 6, 2005</strong>  <strong>011: SECURITY FIX: June 9, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The  Multiple remote vulnerabilities have been found in the
 <a href="https://man.openbsd.org/OpenBSD-3.5/getcwd.3">getcwd(3)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/cvs.1">cvs(1)</a>
 library function contains a memory management error, which causes failure  server that allow an attacker to crash the server or possibly execute arbitrary
 to retrieve the current working directory if the path is very long.  code with the same privileges as the CVS server program.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/025_getcwd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/011_cvs3.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="pfkey">  <li id="isakmpd">
 <strong>024: SECURITY FIX: December 14, 2004</strong>  <strong>012: SECURITY FIX: June 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 On systems running  As
   <a href="http://seclists.org/lists/fulldisclosure/2004/Jun/0191.html">disclosed</a>
   by Thomas Walpuski
 <a href="https://man.openbsd.org/OpenBSD-3.5/isakmpd.8">isakmpd(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/isakmpd.8">isakmpd(8)</a>
 it is possible for a local user to cause kernel memory corruption  is still vulnerable to unauthorized SA deletion.  An attacker can delete IPsec
 and system panic by setting  tunnels at will.
 <a href="https://man.openbsd.org/OpenBSD-3.5/ipsec.4">ipsec(4)</a>  
 credentials on a socket.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/024_pfkey.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/012_isakmpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="lynx">  
 <strong>023: RELIABILITY FIX: November 10, 2004</strong>  <li id="httpd">
   <strong>013: SECURITY FIX: June 12, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to a bug in  Multiple vulnerabilities have been found in
 <a href="https://man.openbsd.org/OpenBSD-3.5/lynx.1">lynx(1)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/httpd.8">httpd(8)</a>
 it is possible for pages such as  / mod_ssl.
 <a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a>  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020">CAN-2003-0020</a>,
 to cause  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987">CAN-2003-0987</a>,
 <a href="https://man.openbsd.org/OpenBSD-3.5/lynx.1">lynx(1)</a>  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488">CAN-2004-0488</a>,
 to exhaust memory and then crash when parsing such pages.  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492">CAN-2004-0492</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/023_lynx.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/013_httpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="pppd">  
 <strong>022: RELIABILITY FIX: November 10, 2004</strong>  <li id="rnd">
   <strong>014: RELIABILITY FIX: July 25, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.5/pppd.8">pppd(8)</a>  Under a certain network load the kernel can run out of stack space.  This was
 contains a bug that allows an attacker to crash his own connection, but it cannot  encountered in an environment using CARP on a VLAN interface.  This issue initially
 be used to deny service to other users.  manifested itself as a FPU related crash on boot up.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/022_pppd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/014_rnd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="bind">  
 <strong>021: RELIABILITY FIX: November 10, 2004</strong>  <li id="icmp">
   <strong>015: RELIABILITY FIX: August 25, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 BIND contains a bug which results in BIND trying to contact nameservers via IPv6, even in  Improved verification of ICMP errors in order to minimize the impact of ICMP attacks
 cases where IPv6 connectivity is non-existent. This results in unnecessary timeouts and  against TCP.
 thus slow DNS queries.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/021_bind.patch">  <a href="http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html">http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html</a>
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/015_icmp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="radius">  
 <strong>020: SECURITY FIX: September 20, 2004</strong>  <li id="bridge">
   <strong>016: RELIABILITY FIX: August 26, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Eilko Bos reported that radius authentication, as implemented by  As
 <a href="https://man.openbsd.org/OpenBSD-3.5/login_radius.8">login_radius(8)</a>,  <a href="https://marc.info/?l=bugtraq&amp;m=109345131508824&amp;w=2">reported</a>
 was not checking the shared secret used for replies sent by the radius server.  by Vafa Izadinia
 This could allow an attacker to spoof a reply granting access to the  <a href="https://man.openbsd.org/OpenBSD-3.5/bridge.4">bridge(4)</a>
 attacker.  Note that OpenBSD does not ship with radius authentication enabled.  with IPsec processing enabled can be crashed remotely by a single ICMP echo traversing the bridge.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/020_radius.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/016_bridge.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="xpm">  
 <strong>019: SECURITY FIX: September 16, 2004</strong>  <li id="libz">
   <strong>017: RELIABILITY FIX: August 29, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Chris Evans reported several flaws (stack and integer overflows) in the  Due to incorrect error handling in zlib an attacker could potentially cause a Denial
 <a href="http://www.inria.fr/koala/lehors/xpm.html">Xpm</a>  of Service attack.
 library code that parses image files  <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0797">CAN-2004-0797</a>
 (<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0687">CAN-2004-0687</a>,  .
 <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0688">CAN-2004-0688</a>).  
 Some of these would be exploitable when parsing malicious image files in  
 an application that handles XPM images, if they could escape ProPolice.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/019_xpm.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/017_libz.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="httpd2">  <li id="httpd2">
 <strong>018: SECURITY FIX: September 10, 2004</strong>  <strong>018: SECURITY FIX: September 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
Line 281 
Line 305 
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/018_httpd2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/018_httpd2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="libz">  
 <strong>017: RELIABILITY FIX: August 29, 2004</strong>  <li id="xpm">
   <strong>019: SECURITY FIX: September 16, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to incorrect error handling in zlib an attacker could potentially cause a Denial  Chris Evans reported several flaws (stack and integer overflows) in the
 of Service attack.  <a href="http://www.inria.fr/koala/lehors/xpm.html">Xpm</a>
 <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0797">CAN-2004-0797</a>  library code that parses image files
 .  (<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0687">CAN-2004-0687</a>,
   <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0688">CAN-2004-0688</a>).
   Some of these would be exploitable when parsing malicious image files in
   an application that handles XPM images, if they could escape ProPolice.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/017_libz.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/019_xpm.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="bridge">  
 <strong>016: RELIABILITY FIX: August 26, 2004</strong>  <li id="radius">
   <strong>020: SECURITY FIX: September 20, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 As  Eilko Bos reported that radius authentication, as implemented by
 <a href="https://marc.info/?l=bugtraq&amp;m=109345131508824&amp;w=2">reported</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/login_radius.8">login_radius(8)</a>,
 by Vafa Izadinia  was not checking the shared secret used for replies sent by the radius server.
 <a href="https://man.openbsd.org/OpenBSD-3.5/bridge.4">bridge(4)</a>  This could allow an attacker to spoof a reply granting access to the
 with IPsec processing enabled can be crashed remotely by a single ICMP echo traversing the bridge.  attacker.  Note that OpenBSD does not ship with radius authentication enabled.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/016_bridge.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/020_radius.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="icmp">  
 <strong>015: RELIABILITY FIX: August 25, 2004</strong>  <li id="bind">
   <strong>021: RELIABILITY FIX: November 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Improved verification of ICMP errors in order to minimize the impact of ICMP attacks  BIND contains a bug which results in BIND trying to contact nameservers via IPv6, even in
 against TCP.  cases where IPv6 connectivity is non-existent. This results in unnecessary timeouts and
   thus slow DNS queries.
 <br>  <br>
 <a href="http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html">http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html</a>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/021_bind.patch">
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/015_icmp.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="rnd">  
 <strong>014: RELIABILITY FIX: July 25, 2004</strong>  <li id="pppd">
   <strong>022: RELIABILITY FIX: November 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Under a certain network load the kernel can run out of stack space.  This was  <a href="https://man.openbsd.org/OpenBSD-3.5/pppd.8">pppd(8)</a>
 encountered in an environment using CARP on a VLAN interface.  This issue initially  contains a bug that allows an attacker to crash his own connection, but it cannot
 manifested itself as a FPU related crash on boot up.  be used to deny service to other users.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/014_rnd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/022_pppd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="httpd">  
 <strong>013: SECURITY FIX: June 12, 2004</strong>  <li id="lynx">
   <strong>023: RELIABILITY FIX: November 10, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Multiple vulnerabilities have been found in  Due to a bug in
 <a href="https://man.openbsd.org/OpenBSD-3.5/httpd.8">httpd(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/lynx.1">lynx(1)</a>
 / mod_ssl.  it is possible for pages such as
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020">CAN-2003-0020</a>,  <a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a>
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987">CAN-2003-0987</a>,  to cause
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488">CAN-2004-0488</a>,  <a href="https://man.openbsd.org/OpenBSD-3.5/lynx.1">lynx(1)</a>
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492">CAN-2004-0492</a>.  to exhaust memory and then crash when parsing such pages.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/013_httpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/023_lynx.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="isakmpd">  
 <strong>012: SECURITY FIX: June 10, 2004</strong>  
   
   
   <li id="cvs4">
   <strong>033: SECURITY FIX: April 28, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 As  Fix a buffer overflow, memory leaks, and NULL pointer dereference in
 <a href="http://seclists.org/lists/fulldisclosure/2004/Jun/0191.html">disclosed</a>  
 by Thomas Walpuski  
 <a href="https://man.openbsd.org/OpenBSD-3.5/isakmpd.8">isakmpd(8)</a>  
 is still vulnerable to unauthorized SA deletion.  An attacker can delete IPsec  
 tunnels at will.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/012_isakmpd.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
 <li id="cvs3">  
 <strong>011: SECURITY FIX: June 9, 2004</strong>  
 &nbsp; <i>All architectures</i><br>  
 Multiple remote vulnerabilities have been found in the  
 <a href="https://man.openbsd.org/OpenBSD-3.5/cvs.1">cvs(1)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/cvs.1">cvs(1)</a>
 server that allow an attacker to crash the server or possibly execute arbitrary  . None of these issues are known to be exploitable.
 code with the same privileges as the CVS server program.  <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a>
   .
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/011_cvs3.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/033_cvs4.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="fifofs">  
 <strong>010: RELIABILITY FIX: June 9, 2004</strong>  
   <li id="tcp2">
   <strong>032: RELIABILITY FIX: April 4, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A FIFO bug was introduced in OpenBSD 3.5 that occurs when a FIFO is opened in  Handle an edge condition in
 non-blocking mode for writing when there are no processes reading the FIFO.  <a href="https://man.openbsd.org/OpenBSD-3.5/tcp.4">tcp(4)</a>
 One program affected by this is the <a href="http://www.qmail.org/">qmail</a>  timestamps.
 mail server which could go into an infinite loop and consume all CPU.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/010_fifofs.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/032_tcp2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="kerberos">  
 <strong>009: SECURITY FIX: May 30, 2004</strong>  
   <li id="telnet">
   <strong>031: SECURITY FIX: March 30, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A flaw in the Kerberos V  Due to buffer overflows in
 <a href="https://man.openbsd.org/OpenBSD-3.5/kdc">kdc(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/telnet.1">telnet(1)</a>
 server could result in the administrator of a Kerberos realm having  , a malicious server or man-in-the-middle attack could allow execution of
 the ability to impersonate any principal in any other realm which  arbitrary code with the privileges of the user invoking
 has established a cross-realm trust with their realm. The flaw is due to  <a href="https://man.openbsd.org/OpenBSD-3.5/telnet.1">telnet(1)</a>
 inadequate checking of the "transited" field in a Kerberos request. For  .
 more details see <a href="http://www.pdc.kth.se/heimdal/advisory/2004-04-01/">  
 Heimdal's announcement</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/009_kerberos.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/031_telnet.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="xdm">  
 <strong>008: SECURITY FIX: May 26, 2004</strong>  
   <li id="sack">
   <strong>030: RELIABILITY FIX: March 30, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 With the introduction of IPv6 code in  Bugs in the
 <a href="https://man.openbsd.org/OpenBSD-3.5/xdm.1">xdm(1)</a>,  <a href="https://man.openbsd.org/OpenBSD-3.5/tcp.4">tcp(4)</a>
 one test on the 'requestPort' resource was deleted by accident. This  stack can lead to memory exhaustion or processing of TCP segments with
 makes xdm create the chooser socket even if xdmcp is disabled in  invalid SACK options and cause a system crash.
 xdm-config, by setting requestPort to 0. See  
 <a href="http://bugs.xfree86.org/show_bug.cgi?id=1376">XFree86  
 bugzilla</a> for details.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/008_xdm.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/030_sack.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="cvs2">  
 <strong>007: SECURITY FIX: May 20, 2004</strong>  
 &nbsp; <i>All architectures</i><br>  <li id="copy">
 A heap overflow in the  <strong>029: SECURITY FIX: March 16, 2005</strong>
 <a href="https://man.openbsd.org/OpenBSD-3.5/cvs.1">cvs(1)</a>  &nbsp; <i>amd64 only</i><br>
 server has been discovered that can be exploited by clients sending  More stringent checking should be done in the
 malformed requests, enabling these clients to run arbitrary code  <a href="https://man.openbsd.org/OpenBSD-3.5/copy.9">copy(9)</a>
 with the same privileges as the CVS server program.  functions to prevent their misuse.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/007_cvs2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/amd64/029_copy.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="procfs">  
 <strong>006: SECURITY FIX: May 13, 2004</strong>  
 &nbsp; <i>All architectures</i><br>  <li id="locore">
 Check for integer overflow in procfs.  Use of procfs is not recommended.  <strong>028: SECURITY FIX: February 28, 2005</strong>
   &nbsp; <i>i386 only</i><br>
   More stringent checking should be done in the
   <a href="https://man.openbsd.org/OpenBSD-3.5/copy.9">copy(9)</a>
   functions to prevent their misuse.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/006_procfs.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/i386/028_locore.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="tcp">  
 <strong>005: RELIABILITY FIX: May 6, 2004</strong>  
   <li id="rtt">
   <strong>027: RELIABILITY FIX: January 11, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Reply to in-window SYN with a rate-limited ACK.  A bug in the
   <a href="https://man.openbsd.org/OpenBSD-3.5/tcp.4">tcp(4)</a>
   stack allows an invalid argument to be used in calculating the TCP
   retransmit timeout. By sending packets with specific values in the TCP
   timestamp option, an attacker can cause a system panic.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/005_tcp.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/027_rtt.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="scsi">  
 <strong>004: RELIABILITY FIX: May 5, 2004</strong>  
   <li id="httpd3">
   <strong>026: SECURITY FIX: January 12, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Restore the ability to negotiate tags/wide/sync with some SCSI controllers ( i.e.  <a href="https://man.openbsd.org/OpenBSD-3.5/httpd.8">httpd(8)</a>
 <a href="https://man.openbsd.org/OpenBSD-3.5/siop.4">siop(4)</a>,  's mod_include module fails to properly validate the length of
 <a href="https://man.openbsd.org/OpenBSD-3.5/trm.4">trm(4)</a>,  user supplied tag strings prior to copying them to a local buffer,
 <a href="https://man.openbsd.org/OpenBSD-3.5/iha.4">iha(4)</a>  causing a buffer overflow.
 ).  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/004_scsi.patch">  This would require enabling the XBitHack directive or server-side
   includes and making use of a malicious document.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/026_httpd3.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="gdt">  
 <strong>003: RELIABILITY FIX: May 5, 2004</strong>  
   <li id="getcwd">
   <strong>025: RELIABILITY FIX: January 6, 2005</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Under load "recent model"  The
 <a href="https://man.openbsd.org/OpenBSD-3.5/gdt.4">gdt(4)</a>  <a href="https://man.openbsd.org/OpenBSD-3.5/getcwd.3">getcwd(3)</a>
 controllers will lock up.  library function contains a memory management error, which causes failure
   to retrieve the current working directory if the path is very long.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/003_gdt.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/025_getcwd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
 <li id="cvs">  
 <strong>002: SECURITY FIX: May 5, 2004</strong>  <li id="pfkey">
   <strong>024: SECURITY FIX: December 14, 2004</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Pathname validation problems have been found in  On systems running
 <a href="https://man.openbsd.org/OpenBSD-3.5/cvs.1">cvs(1)</a>,  <a href="https://man.openbsd.org/OpenBSD-3.5/isakmpd.8">isakmpd(8)</a>
 allowing malicious clients to create files outside the repository, allowing  it is possible for a local user to cause kernel memory corruption
 malicious servers to overwrite files outside the local CVS tree on  and system panic by setting
 the client and allowing clients to check out files outside the CVS  <a href="https://man.openbsd.org/OpenBSD-3.5/ipsec.4">ipsec(4)</a>
 repository.  credentials on a socket.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/002_cvs.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/024_pfkey.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  
 <li id="autobook_package">  
 <strong>001: BROKEN PACKAGE ON CD: May 4, 2004</strong>&nbsp; <i>macppc only</i><br>  
 The powerpc autobook-1.3.tgz package found on CD2 has been found to be corrupt,  
 and will not extract.  
 A replacement package can be found on the ftp sites.  
 <p>  <p>
   
 </ul>  </ul>
Legend:
Removed from v.1.78  
changed lines
  Added in v.1.79