[BACK]Return to errata37.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata37.html between version 1.51 and 1.52

version 1.51, 2016/03/21 05:46:20 version 1.52, 2016/03/22 10:54:42
Line 111 
Line 111 
 <font color="#009000"><strong>011: SECURITY FIX: February 12, 2006</strong></font>  <font color="#009000"><strong>011: SECURITY FIX: February 12, 2006</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the  Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the
 <a href="http://man.openbsd.org?query=system&amp;sektion=3">system(3)</a>  <a href="http://man.openbsd.org/?query=system&amp;sektion=3">system(3)</a>
 function in  function in
 <a href="http://man.openbsd.org?query=scp&amp;sektion=1">scp(1)</a>  <a href="http://man.openbsd.org/?query=scp&amp;sektion=1">scp(1)</a>
 when performing copy operations using filenames that are supplied by the user from the command line.  when performing copy operations using filenames that are supplied by the user from the command line.
 This can be exploited to execute shell commands with privileges of the user running  This can be exploited to execute shell commands with privileges of the user running
 <a href="http://man.openbsd.org?query=scp&amp;sektion=1">scp(1)</a>.  <a href="http://man.openbsd.org/?query=scp&amp;sektion=1">scp(1)</a>.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/011_ssh.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/011_ssh.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
Line 126 
Line 126 
 <font color="#009000"><strong>010: RELIABILITY FIX: January 13, 2006</strong></font>  <font color="#009000"><strong>010: RELIABILITY FIX: January 13, 2006</strong></font>
 &nbsp; <i>i386 architecture</i><br>  &nbsp; <i>i386 architecture</i><br>
 Constrain  Constrain
 <a href="http://man.openbsd.org?query=i386_set_ioperm&amp;arch=i386&amp;sektion=2">i386_set_ioperm(2)</a>  <a href="http://man.openbsd.org/?query=i386_set_ioperm&amp;arch=i386&amp;sektion=2">i386_set_ioperm(2)</a>
 so even root is blocked from accessing the ioports  so even root is blocked from accessing the ioports
 unless the machine is running at lower securelevels or with an open X11 aperture.  unless the machine is running at lower securelevels or with an open X11 aperture.
 <br>  <br>
Line 140 
Line 140 
 Change the implementation of i386 W^X so that the "execute line" can move around.  Change the implementation of i386 W^X so that the "execute line" can move around.
 Before it was limited to being either at 512MB (below which all code normally  Before it was limited to being either at 512MB (below which all code normally
 lands) or at the top of the stack. Now the line can float as  lands) or at the top of the stack. Now the line can float as
 <a href="http://man.openbsd.org?query=mprotect&amp;sektion=2">mprotect(2)</a>  <a href="http://man.openbsd.org/?query=mprotect&amp;sektion=2">mprotect(2)</a>
 and  and
 <a href="http://man.openbsd.org?query=mmap&amp;sektion=2">mmap(2)</a>  <a href="http://man.openbsd.org/?query=mmap&amp;sektion=2">mmap(2)</a>
 requests need it to. This is now implemented using only GDT selectors  requests need it to. This is now implemented using only GDT selectors
 instead of the LDT so that it is more robust as well.  instead of the LDT so that it is more robust as well.
 <br>  <br>
Line 173 
Line 173 
 <font color="#009000"><strong>006: RELIABILITY FIX: November 5, 2005</strong></font>  <font color="#009000"><strong>006: RELIABILITY FIX: November 5, 2005</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to wrong advertisement of RFC 3947 compliance interoperability problems with  Due to wrong advertisement of RFC 3947 compliance interoperability problems with
 <a href="http://man.openbsd.org?query=isakmpd&sektion=8">isakmpd(8)</a>  <a href="http://man.openbsd.org/?query=isakmpd&sektion=8">isakmpd(8)</a>
 may occur.  may occur.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/006_nat-t.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/006_nat-t.patch">
Line 184 
Line 184 
 <font color="#009000"><strong>005: SECURITY FIX: July 21, 2005</strong></font>  <font color="#009000"><strong>005: SECURITY FIX: July 21, 2005</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow has been found in  A buffer overflow has been found in
 <a href="http://man.openbsd.org?query=compress&sektion=3">compress(3)</a>  <a href="http://man.openbsd.org/?query=compress&sektion=3">compress(3)</a>
 which may be exploitable.<br>  which may be exploitable.<br>
 Please note that this fixes a different buffer overflow than the <a href="#libz">previous</a> zlib patch.  Please note that this fixes a different buffer overflow than the <a href="#libz">previous</a> zlib patch.
 <br>  <br>
Line 196 
Line 196 
 <font color="#009000"><strong>004: SECURITY FIX: July 6, 2005</strong></font>  <font color="#009000"><strong>004: SECURITY FIX: July 6, 2005</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow has been found in  A buffer overflow has been found in
 <a href="http://man.openbsd.org?query=compress&sektion=3">compress(3)</a>  <a href="http://man.openbsd.org/?query=compress&sektion=3">compress(3)</a>
 which may be exploitable.  which may be exploitable.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/004_libz.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/004_libz.patch">
Line 207 
Line 207 
 <font color="#009000"><strong>003: SECURITY FIX: June 20, 2005</strong></font>  <font color="#009000"><strong>003: SECURITY FIX: June 20, 2005</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to a race condition in its command pathname handling, a user with  Due to a race condition in its command pathname handling, a user with
 <a href="http://man.openbsd.org?query=sudo&sektion=8">sudo(8)</a>  <a href="http://man.openbsd.org/?query=sudo&sektion=8">sudo(8)</a>
 privileges may be able to run arbitrary commands if the user's entry  privileges may be able to run arbitrary commands if the user's entry
 is followed by an entry that grants <tt>sudo ALL</tt> privileges to  is followed by an entry that grants <tt>sudo ALL</tt> privileges to
 another user.  another user.
Line 220 
Line 220 
 <font color="#009000"><strong>002: RELIABILITY FIX: June 15, 2005</strong></font>  <font color="#009000"><strong>002: RELIABILITY FIX: June 15, 2005</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 As discovered by Stefan Miltchev calling  As discovered by Stefan Miltchev calling
 <a href="http://man.openbsd.org?query=getsockopt&sektion=2">getsockopt(2)</a>  <a href="http://man.openbsd.org/?query=getsockopt&sektion=2">getsockopt(2)</a>
 to get  to get
 <a href="http://man.openbsd.org?query=ipsec&sektion=4">ipsec(4)</a>  <a href="http://man.openbsd.org/?query=ipsec&sektion=4">ipsec(4)</a>
 credentials for a socket can result in a kernel panic.  credentials for a socket can result in a kernel panic.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/002_getsockopt.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/002_getsockopt.patch">
Line 234 
Line 234 
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
   
 Fix a buffer overflow, memory leaks, and NULL pointer dereference in  Fix a buffer overflow, memory leaks, and NULL pointer dereference in
 <a href="http://man.openbsd.org?query=cvs&sektion=1">cvs(1)</a>  <a href="http://man.openbsd.org/?query=cvs&sektion=1">cvs(1)</a>
 . None of these issues are known to be exploitable.  . None of these issues are known to be exploitable.
 <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a>  <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753">CAN-2005-0753</a>
 .  .
Legend:
Removed from v.1.51  
changed lines
  Added in v.1.52