| version 1.44, 2016/02/20 14:18:42 |
version 1.45, 2016/03/21 05:46:20 |
|
|
| <font color="#009000"><strong>020: SECURITY FIX: July 21, 2005</strong></font> |
<font color="#009000"><strong>020: SECURITY FIX: July 21, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A buffer overflow has been found in |
A buffer overflow has been found in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=compress&sektion=3">compress(3)</a> |
<a href="http://man.openbsd.org?query=compress&sektion=3">compress(3)</a> |
| which may be exploitable.<br> |
which may be exploitable.<br> |
| Please note that this fixes a different buffer overflow than the <a href="#libz">previous</a> zlib patch. |
Please note that this fixes a different buffer overflow than the <a href="#libz">previous</a> zlib patch. |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>019: SECURITY FIX: July 6, 2005</strong></font> |
<font color="#009000"><strong>019: SECURITY FIX: July 6, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A buffer overflow has been found in |
A buffer overflow has been found in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=compress&sektion=3">compress(3)</a> |
<a href="http://man.openbsd.org?query=compress&sektion=3">compress(3)</a> |
| which may be exploitable. |
which may be exploitable. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/019_libz.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/019_libz.patch"> |
|
|
| <font color="#009000"><strong>018: SECURITY FIX: June 20, 2005</strong></font> |
<font color="#009000"><strong>018: SECURITY FIX: June 20, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Due to a race condition in its command pathname handling, a user with |
Due to a race condition in its command pathname handling, a user with |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sudo&sektion=8">sudo(8)</a> |
<a href="http://man.openbsd.org?query=sudo&sektion=8">sudo(8)</a> |
| privileges may be able to run arbitrary commands if the user's entry |
privileges may be able to run arbitrary commands if the user's entry |
| is followed by an entry that grants <tt>sudo ALL</tt> privileges to |
is followed by an entry that grants <tt>sudo ALL</tt> privileges to |
| another user. |
another user. |
|
|
| <font color="#009000"><strong>017: RELIABILITY FIX: June 15, 2005</strong></font> |
<font color="#009000"><strong>017: RELIABILITY FIX: June 15, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| As discovered by Stefan Miltchev calling |
As discovered by Stefan Miltchev calling |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getsockopt&sektion=2">getsockopt(2)</a> |
<a href="http://man.openbsd.org?query=getsockopt&sektion=2">getsockopt(2)</a> |
| to get |
to get |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec&sektion=4">ipsec(4)</a> |
<a href="http://man.openbsd.org?query=ipsec&sektion=4">ipsec(4)</a> |
| credentials for a socket can result in a kernel panic. |
credentials for a socket can result in a kernel panic. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/017_getsockopt.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/017_getsockopt.patch"> |
|
|
| <font color="#009000"><strong>016: SECURITY FIX: April 28, 2005</strong></font> |
<font color="#009000"><strong>016: SECURITY FIX: April 28, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix a buffer overflow, memory leaks, and NULL pointer dereference in |
Fix a buffer overflow, memory leaks, and NULL pointer dereference in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&sektion=1">cvs(1)</a> |
<a href="http://man.openbsd.org?query=cvs&sektion=1">cvs(1)</a> |
| . None of these issues are known to be exploitable. |
. None of these issues are known to be exploitable. |
| <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a> |
<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a> |
| . |
. |
|
|
| <font color="#009000"><strong>015: RELIABILITY FIX: April 4, 2005</strong></font> |
<font color="#009000"><strong>015: RELIABILITY FIX: April 4, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Handle an edge condition in |
Handle an edge condition in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tcp&sektion=4">tcp(4)</a> |
<a href="http://man.openbsd.org?query=tcp&sektion=4">tcp(4)</a> |
| timestamps. |
timestamps. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/015_tcp.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/015_tcp.patch"> |
|
|
| <font color="#009000"><strong>014: SECURITY FIX: March 30, 2005</strong></font> |
<font color="#009000"><strong>014: SECURITY FIX: March 30, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Due to buffer overflows in |
Due to buffer overflows in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=telnet&sektion=1">telnet(1)</a>, |
<a href="http://man.openbsd.org?query=telnet&sektion=1">telnet(1)</a>, |
| a malicious server or man-in-the-middle attack could allow execution of |
a malicious server or man-in-the-middle attack could allow execution of |
| arbitrary code with the privileges of the user invoking |
arbitrary code with the privileges of the user invoking |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=telnet&sektion=1">telnet(1)</a>. |
<a href="http://man.openbsd.org?query=telnet&sektion=1">telnet(1)</a>. |
| Noone should use telnet anymore. Please use |
Noone should use telnet anymore. Please use |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1">ssh(1)</a>. |
<a href="http://man.openbsd.org?query=ssh&sektion=1">ssh(1)</a>. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/014_telnet.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/014_telnet.patch"> |
| A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
|
|
| <font color="#009000"><strong>013: RELIABILITY FIX: March 30, 2005</strong></font> |
<font color="#009000"><strong>013: RELIABILITY FIX: March 30, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Bugs in the |
Bugs in the |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tcp&sektion=4">tcp(4)</a> |
<a href="http://man.openbsd.org?query=tcp&sektion=4">tcp(4)</a> |
| stack can lead to memory exhaustion or processing of TCP segments with |
stack can lead to memory exhaustion or processing of TCP segments with |
| invalid SACK options and cause a system crash. |
invalid SACK options and cause a system crash. |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>012: SECURITY FIX: March 16, 2005</strong></font> |
<font color="#009000"><strong>012: SECURITY FIX: March 16, 2005</strong></font> |
| <strong>amd64 only</strong><br> |
<strong>amd64 only</strong><br> |
| More stringent checking should be done in the |
More stringent checking should be done in the |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=copy&sektion=9">copy(9)</a> |
<a href="http://man.openbsd.org?query=copy&sektion=9">copy(9)</a> |
| functions to prevent their misuse. |
functions to prevent their misuse. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/amd64/012_copy.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/amd64/012_copy.patch"> |
|
|
| <font color="#009000"><strong>011: SECURITY FIX: February 28, 2005</strong></font> |
<font color="#009000"><strong>011: SECURITY FIX: February 28, 2005</strong></font> |
| <strong>i386 only</strong><br> |
<strong>i386 only</strong><br> |
| More stringent checking should be done in the |
More stringent checking should be done in the |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=copy&sektion=9">copy(9)</a> |
<a href="http://man.openbsd.org?query=copy&sektion=9">copy(9)</a> |
| functions to prevent their misuse. |
functions to prevent their misuse. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/i386/011_locore.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/i386/011_locore.patch"> |
|
|
| <font color="#009000"><strong>010: RELIABILITY FIX: January 11, 2005</strong></font> |
<font color="#009000"><strong>010: RELIABILITY FIX: January 11, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A bug in the |
A bug in the |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tcp&sektion=4">tcp(4)</a> |
<a href="http://man.openbsd.org?query=tcp&sektion=4">tcp(4)</a> |
| stack allows an invalid argument to be used in calculating the TCP |
stack allows an invalid argument to be used in calculating the TCP |
| retransmit timeout. By sending packets with specific values in the TCP |
retransmit timeout. By sending packets with specific values in the TCP |
| timestamp option, an attacker can cause a system panic. |
timestamp option, an attacker can cause a system panic. |
|
|
| <li id="httpd"> |
<li id="httpd"> |
| <font color="#009000"><strong>009: SECURITY FIX: January 12, 2005</strong></font> |
<font color="#009000"><strong>009: SECURITY FIX: January 12, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&apropos=0&sektion=8&manpath=OpenBSD+Current&arch=i386&format=html">httpd(8)</a> |
<a href="http://man.openbsd.org?query=httpd&apropos=0&sektion=8&manpath=OpenBSD+Current&arch=i386&format=html">httpd(8)</a> |
| 's mod_include module fails to properly validate the length of |
's mod_include module fails to properly validate the length of |
| user supplied tag strings prior to copying them to a local buffer, |
user supplied tag strings prior to copying them to a local buffer, |
| causing a buffer overflow. |
causing a buffer overflow. |
|
|
| <font color="#009000"><strong>008: RELIABILITY FIX: January 6, 2005</strong></font> |
<font color="#009000"><strong>008: RELIABILITY FIX: January 6, 2005</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The |
The |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getcwd&sektion=3">getcwd(3)</a> |
<a href="http://man.openbsd.org?query=getcwd&sektion=3">getcwd(3)</a> |
| library function contains a memory management error, which causes failure |
library function contains a memory management error, which causes failure |
| to retrieve the current working directory if the path is very long. |
to retrieve the current working directory if the path is very long. |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>007: SECURITY FIX: December 14, 2004</strong></font> |
<font color="#009000"><strong>007: SECURITY FIX: December 14, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| On systems running |
On systems running |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a> |
<a href="http://man.openbsd.org?query=isakmpd&sektion=8">isakmpd(8)</a> |
| it is possible for a local user to cause kernel memory corruption |
it is possible for a local user to cause kernel memory corruption |
| and system panic by setting |
and system panic by setting |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec&sektion=4&manpath=OpenBSD+Current&&format=html">ipsec(4)</a> |
<a href="http://man.openbsd.org?query=ipsec&sektion=4&manpath=OpenBSD+Current&&format=html">ipsec(4)</a> |
| credentials on a socket. |
credentials on a socket. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/007_pfkey.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/007_pfkey.patch"> |
|
|
| <font color="#009000"><strong>006: RELIABILITY FIX: November 21, 2004</strong></font> |
<font color="#009000"><strong>006: RELIABILITY FIX: November 21, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix for transmit side breakage on macppc and mbuf leaks with |
Fix for transmit side breakage on macppc and mbuf leaks with |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=xl&sektion=4">xl(4)</a>. |
<a href="http://man.openbsd.org?query=xl&sektion=4">xl(4)</a>. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/006_xl.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/006_xl.patch"> |
| A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
|
|
| <font color="#009000"><strong>005: RELIABILITY FIX: November 21, 2004</strong></font> |
<font color="#009000"><strong>005: RELIABILITY FIX: November 21, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Wrong calculation of NAT-D payloads may cause interoperability problems between |
Wrong calculation of NAT-D payloads may cause interoperability problems between |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&sektion=8">isakmpd(8)</a> |
<a href="http://man.openbsd.org?query=isakmpd&sektion=8">isakmpd(8)</a> |
| and other ISAKMP/IKE implementations. |
and other ISAKMP/IKE implementations. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/005_isakmpd.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/005_isakmpd.patch"> |
|
|
| <font color="#009000"><strong>004: RELIABILITY FIX: November 10, 2004</strong></font> |
<font color="#009000"><strong>004: RELIABILITY FIX: November 10, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Due to a bug in |
Due to a bug in |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=lynx&sektion=1">lynx(1)</a> |
<a href="http://man.openbsd.org?query=lynx&sektion=1">lynx(1)</a> |
| it is possible for pages such as |
it is possible for pages such as |
| <a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a> |
<a href="http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html">this</a> |
| to cause |
to cause |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=lynx&sektion=1">lynx(1)</a> |
<a href="http://man.openbsd.org?query=lynx&sektion=1">lynx(1)</a> |
| to exhaust memory and then crash when parsing such pages. |
to exhaust memory and then crash when parsing such pages. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/004_lynx.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/004_lynx.patch"> |
|
|
| <li id="pppd"> |
<li id="pppd"> |
| <font color="#009000"><strong>003: RELIABILITY FIX: November 10, 2004</strong></font> |
<font color="#009000"><strong>003: RELIABILITY FIX: November 10, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=pppd&sektion=8">pppd(8)</a> |
<a href="http://man.openbsd.org?query=pppd&sektion=8">pppd(8)</a> |
| contains a bug that allows an attacker to crash his own connection, but it cannot |
contains a bug that allows an attacker to crash his own connection, but it cannot |
| be used to deny service to other users. |
be used to deny service to other users. |
| <br> |
<br> |
|
|
| <font color="#009000"><strong>001: RELIABILITY FIX: November 10, 2004</strong></font> |
<font color="#009000"><strong>001: RELIABILITY FIX: November 10, 2004</strong></font> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix detection of tape blocksize during device open. Corrects problem with |
Fix detection of tape blocksize during device open. Corrects problem with |
| <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=restore&sektion=8">restore(8)</a>. |
<a href="http://man.openbsd.org?query=restore&sektion=8">restore(8)</a>. |
| <br> |
<br> |
| <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/001_st.patch"> |
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/001_st.patch"> |
| A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
![[BACK]](/icons/back.gif){kind=icon}
Return to errata36.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www