[BACK]Return to errata38.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata38.html between version 1.71 and 1.72

version 1.71, 2019/05/27 22:55:19 version 1.72, 2019/05/28 16:32:42
Line 85 
Line 85 
   
 <ul>  <ul>
   
 <li id="ssh2">  <li id="perl">
 <strong>020: SECURITY FIX: October 12, 2006</strong>  <strong>001: SECURITY FIX: January 5, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found  A buffer overflow has been found in the Perl interpreter with the sprintf function which
 by Tavis Ormandy) that would cause  may be exploitable under certain conditions.
 <a href="https://man.openbsd.org/OpenBSD-3.8/sshd.8">sshd(8)</a>  
 to spin until the login grace time expired.  
 An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition  
 that could be exploited to perform a pre-authentication denial of service.  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4924">CVE-2006-4924</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5051">CVE-2006-5051</a>  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/020_ssh2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="systrace">  <li id="fd">
 <strong>019: SECURITY FIX: October 7, 2006</strong>  <strong>002: SECURITY FIX: January 5, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix for an integer overflow in  Do not allow users to trick suid programs into re-opening files via /dev/fd.
 <a href="https://man.openbsd.org/OpenBSD-3.8/systrace.4">systrace(4)</a>'s  
 STRIOCREPLACE support, found by  
 Chris Evans. This could be exploited for DoS, limited kmem reads or local  
 privilege escalation.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/019_systrace.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/002_fd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="openssl2">  <li id="i386pmap">
 <strong>018: SECURITY FIX: October 7, 2006</strong>  <strong>003: RELIABILITY FIX: January 13, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>i386 architecture</i><br>
 Several problems have been found in OpenSSL. While parsing certain invalid ASN.1  Change the implementation of i386 W^X so that the "execute line" can move around.
 structures an error condition is mishandled, possibly resulting in an infinite  Before it was limited to being either at 512MB (below which all code normally
 loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL  lands) or at the top of the stack. Now the line can float as
 pointer may be dereferenced in the SSL version 2 client code. In addition, many  <a href="https://man.openbsd.org/OpenBSD-3.8/mprotect.2">mprotect(2)</a>
 applications using OpenSSL do not perform any validation of the lengths of  and
 public keys being used.  <a href="https://man.openbsd.org/OpenBSD-3.8/mmap.2">mmap(2)</a>
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</a>,  requests need it to. This is now implemented using only GDT selectors
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</a>,  instead of the LDT so that it is more robust as well.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</a>  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/018_openssl2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/i386/003_i386pmap.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="httpd2">  <li id="i386machdep">
 <strong>017: SECURITY FIX: October 7, 2006</strong>  <strong>004: RELIABILITY FIX: January 13, 2006</strong>
   &nbsp; <i>i386 architecture</i><br>
   Constrain
   <a href="https://man.openbsd.org/OpenBSD-3.8/i386/i386_set_ioperm.2">i386_set_ioperm(2)</a>
   so even root is blocked from accessing the ioports
   unless the machine is running at lower securelevels or with an open X11 aperture.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/i386/004_i386machdep.patch">
   A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="ssh">
   <strong>005: SECURITY FIX: February 12, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.8/httpd.8">httpd(8)</a>  Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the
 does not sanitize the Expect header from an HTTP request when it is  <a href="https://man.openbsd.org/OpenBSD-3.8/system.3">system(3)</a>
 reflected back in an error message, which might allow cross-site scripting (XSS)  function in
 style attacks.  <a href="https://man.openbsd.org/OpenBSD-3.8/scp.1">scp(1)</a>
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918">CVE-2006-3918</a>  when performing copy operations using filenames that are supplied by the user from the command line.
   This can be exploited to execute shell commands with privileges of the user running
   <a href="https://man.openbsd.org/OpenBSD-3.8/scp.1">scp(1)</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/017_httpd2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/005_ssh.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="openssl">  <li id="sendmail">
 <strong>016: SECURITY FIX: September 8, 2006</strong>  <strong>006: SECURITY FIX: March 25, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is possible for  A race condition has been reported to exist in the handling by sendmail of
 an attacker to construct an invalid signature which OpenSSL would accept as a  asynchronous signals. A remote attacker may be able to execute arbitrary code with the
 valid PKCS#1 v1.5 signature.  privileges of the user running sendmail, typically root.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339">CVE-2006-4339</a>  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/016_openssl.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/006_sendmail.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="bind">  <li id="xorg">
 <strong>015: SECURITY FIX: September 8, 2006</strong>  <strong>007: SECURITY FIX: May 2, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Two Denial of Service issues have been found with BIND.  A security vulnerability has been found in the X.Org server --
 An attacker who can perform recursive lookups on a DNS server and is able  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</a>.
 to send a sufficiently large number of recursive queries, or is able to  Clients authorized to connect to the X server are able to crash it and to execute
 get the DNS server to return more than one SIG(covered) RRsets can stop  malicious code within the X server.
 the functionality of the DNS service.  
 An attacker querying an authoritative DNS server serving a RFC 2535  
 DNSSEC zone may be able to crash the DNS server.  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095">CVE-2006-4095</a>  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096">CVE-2006-4096</a>  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/015_bind.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/007_xorg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sppp">  <li id="sendmail2">
 <strong>014: SECURITY FIX: September 2, 2006</strong>  <strong>008: SECURITY FIX: June 15, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to the failure to correctly validate LCP configuration option lengths,  A potential denial of service problem has been found in sendmail. A malformed MIME
 it is possible for an attacker to send LCP packets via an  message could trigger excessive recursion which will lead to stack exhaustion.
 <a href="https://man.openbsd.org/OpenBSD-3.8/sppp.4">sppp(4)</a>  This denial of service attack only affects delivery of mail from the queue and
 connection causing the kernel to panic.  delivery of a malformed message. Other incoming mail is still accepted and
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a>  delivered. However, mail messages in the queue may not be reattempted if a
   malformed MIME message exists.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/014_sppp.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/008_sendmail2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="isakmpd">  <li id="httpd">
 <strong>013: SECURITY FIX: August 25, 2006</strong>  <strong>009: SECURITY FIX: July 30, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A problem in  <a href="https://man.openbsd.org/OpenBSD-3.8/httpd.8">httpd(8)</a>'s
 <a href="https://man.openbsd.org/OpenBSD-3.8/isakmpd.8">isakmpd(8)</a>  mod_rewrite has a potentially exploitable off-by-one buffer overflow.
 caused IPsec to run partly without replay protection. If  The buffer overflow may result in a vulnerability which, in combination
 <a href="https://man.openbsd.org/OpenBSD-3.8/isakmpd.8">isakmpd(8)</a>  with certain types of Rewrite rules in the web server configuration files,
 was acting as responder during SA negotiation, SA's with a replay window of size 0 were created.  could be triggered remotely. The default install is not affected by the
 An attacker could reinject sniffed IPsec packets, which will be accepted without checking the  buffer overflow. CVE-2006-3747
 replay counter.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/013_isakmpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/009_httpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sem">  <li id="sendmail3">
 <strong>012: SECURITY FIX: August 25, 2006</strong>  <strong>010: SECURITY FIX: August 25, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 It is possible to cause the kernel to panic when more than the default number of  A potential denial of service problem has been found in sendmail. A message
 sempahores have been allocated.  with really long header lines could trigger a use-after-free bug causing
   sendmail to crash.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/012_sem.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/010_sendmail3.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Line 226 
Line 223 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sendmail3">  <li id="sem">
 <strong>010: SECURITY FIX: August 25, 2006</strong>  <strong>012: SECURITY FIX: August 25, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A potential denial of service problem has been found in sendmail. A message  It is possible to cause the kernel to panic when more than the default number of
 with really long header lines could trigger a use-after-free bug causing  sempahores have been allocated.
 sendmail to crash.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/010_sendmail3.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/012_sem.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="httpd">  <li id="isakmpd">
 <strong>009: SECURITY FIX: July 30, 2006</strong>  <strong>013: SECURITY FIX: August 25, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.8/httpd.8">httpd(8)</a>'s  A problem in
 mod_rewrite has a potentially exploitable off-by-one buffer overflow.  <a href="https://man.openbsd.org/OpenBSD-3.8/isakmpd.8">isakmpd(8)</a>
 The buffer overflow may result in a vulnerability which, in combination  caused IPsec to run partly without replay protection. If
 with certain types of Rewrite rules in the web server configuration files,  <a href="https://man.openbsd.org/OpenBSD-3.8/isakmpd.8">isakmpd(8)</a>
 could be triggered remotely. The default install is not affected by the  was acting as responder during SA negotiation, SA's with a replay window of size 0 were created.
 buffer overflow. CVE-2006-3747  An attacker could reinject sniffed IPsec packets, which will be accepted without checking the
   replay counter.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/009_httpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/013_isakmpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sendmail2">  <li id="sppp">
 <strong>008: SECURITY FIX: June 15, 2006</strong>  <strong>014: SECURITY FIX: September 2, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A potential denial of service problem has been found in sendmail. A malformed MIME  Due to the failure to correctly validate LCP configuration option lengths,
 message could trigger excessive recursion which will lead to stack exhaustion.  it is possible for an attacker to send LCP packets via an
 This denial of service attack only affects delivery of mail from the queue and  <a href="https://man.openbsd.org/OpenBSD-3.8/sppp.4">sppp(4)</a>
 delivery of a malformed message. Other incoming mail is still accepted and  connection causing the kernel to panic.
 delivered. However, mail messages in the queue may not be reattempted if a  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a>
 malformed MIME message exists.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/008_sendmail2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/014_sppp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="xorg">  <li id="bind">
 <strong>007: SECURITY FIX: May 2, 2006</strong>  <strong>015: SECURITY FIX: September 8, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A security vulnerability has been found in the X.Org server --  Two Denial of Service issues have been found with BIND.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</a>.  An attacker who can perform recursive lookups on a DNS server and is able
 Clients authorized to connect to the X server are able to crash it and to execute  to send a sufficiently large number of recursive queries, or is able to
 malicious code within the X server.  get the DNS server to return more than one SIG(covered) RRsets can stop
   the functionality of the DNS service.
   An attacker querying an authoritative DNS server serving a RFC 2535
   DNSSEC zone may be able to crash the DNS server.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095">CVE-2006-4095</a>
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096">CVE-2006-4096</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/007_xorg.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/015_bind.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sendmail">  <li id="openssl">
 <strong>006: SECURITY FIX: March 25, 2006</strong>  <strong>016: SECURITY FIX: September 8, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A race condition has been reported to exist in the handling by sendmail of  Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is possible for
 asynchronous signals. A remote attacker may be able to execute arbitrary code with the  an attacker to construct an invalid signature which OpenSSL would accept as a
 privileges of the user running sendmail, typically root.  valid PKCS#1 v1.5 signature.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339">CVE-2006-4339</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/006_sendmail.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/016_openssl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="ssh">  <li id="httpd2">
 <strong>005: SECURITY FIX: February 12, 2006</strong>  <strong>017: SECURITY FIX: October 7, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the  <a href="https://man.openbsd.org/OpenBSD-3.8/httpd.8">httpd(8)</a>
 <a href="https://man.openbsd.org/OpenBSD-3.8/system.3">system(3)</a>  does not sanitize the Expect header from an HTTP request when it is
 function in  reflected back in an error message, which might allow cross-site scripting (XSS)
 <a href="https://man.openbsd.org/OpenBSD-3.8/scp.1">scp(1)</a>  style attacks.
 when performing copy operations using filenames that are supplied by the user from the command line.  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918">CVE-2006-3918</a>
 This can be exploited to execute shell commands with privileges of the user running  
 <a href="https://man.openbsd.org/OpenBSD-3.8/scp.1">scp(1)</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/005_ssh.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/017_httpd2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="i386machdep">  <li id="openssl2">
 <strong>004: RELIABILITY FIX: January 13, 2006</strong>  <strong>018: SECURITY FIX: October 7, 2006</strong>
 &nbsp; <i>i386 architecture</i><br>  &nbsp; <i>All architectures</i><br>
 Constrain  Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
 <a href="https://man.openbsd.org/OpenBSD-3.8/i386/i386_set_ioperm.2">i386_set_ioperm(2)</a>  structures an error condition is mishandled, possibly resulting in an infinite
 so even root is blocked from accessing the ioports  loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
 unless the machine is running at lower securelevels or with an open X11 aperture.  pointer may be dereferenced in the SSL version 2 client code. In addition, many
   applications using OpenSSL do not perform any validation of the lengths of
   public keys being used.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/i386/004_i386machdep.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/018_openssl2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="i386pmap">  <li id="systrace">
 <strong>003: RELIABILITY FIX: January 13, 2006</strong>  <strong>019: SECURITY FIX: October 7, 2006</strong>
 &nbsp; <i>i386 architecture</i><br>  
 Change the implementation of i386 W^X so that the "execute line" can move around.  
 Before it was limited to being either at 512MB (below which all code normally  
 lands) or at the top of the stack. Now the line can float as  
 <a href="https://man.openbsd.org/OpenBSD-3.8/mprotect.2">mprotect(2)</a>  
 and  
 <a href="https://man.openbsd.org/OpenBSD-3.8/mmap.2">mmap(2)</a>  
 requests need it to. This is now implemented using only GDT selectors  
 instead of the LDT so that it is more robust as well.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/i386/003_i386pmap.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
   
 <li id="fd">  
 <strong>002: SECURITY FIX: January 5, 2006</strong>  
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Do not allow users to trick suid programs into re-opening files via /dev/fd.  Fix for an integer overflow in
   <a href="https://man.openbsd.org/OpenBSD-3.8/systrace.4">systrace(4)</a>'s
   STRIOCREPLACE support, found by
   Chris Evans. This could be exploited for DoS, limited kmem reads or local
   privilege escalation.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/002_fd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/019_systrace.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="perl">  <li id="ssh2">
 <strong>001: SECURITY FIX: January 5, 2006</strong>  <strong>020: SECURITY FIX: October 12, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A buffer overflow has been found in the Perl interpreter with the sprintf function which  Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found
 may be exploitable under certain conditions.  by Tavis Ormandy) that would cause
   <a href="https://man.openbsd.org/OpenBSD-3.8/sshd.8">sshd(8)</a>
   to spin until the login grace time expired.
   An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition
   that could be exploited to perform a pre-authentication denial of service.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4924">CVE-2006-4924</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5051">CVE-2006-5051</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/020_ssh2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Legend:
Removed from v.1.71  
changed lines
  Added in v.1.72