[BACK]Return to errata39.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata39.html between version 1.43 and 1.44

version 1.43, 2014/03/31 03:12:47 version 1.44, 2014/03/31 16:02:48
Line 79 
Line 79 
 <ul>  <ul>
   
 <li><a name="023_altivec"></a>  <li><a name="023_altivec"></a>
 <font color="#009000"><strong>023: STABILITY FIX: April 26, 2007</strong></font> &nbsp; <i>PowerPC</i><br>  <font color="#009000"><strong>023: STABILITY FIX: April 26, 2007</strong></font>
   &nbsp; <i>PowerPC</i><br>
 An unhandled AltiVec assist exception can cause a kernel panic.<br>  An unhandled AltiVec assist exception can cause a kernel panic.<br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.9/macppc/023_altivec.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.9/macppc/023_altivec.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li><a name="022_route6"></a>  <li><a name="022_route6"></a>
 <font color="#009000"><strong>022: SECURITY FIX: April 23, 2007</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>022: SECURITY FIX: April 23, 2007</strong></font>
   &nbsp; <i>All architectures</i><br>
 IPv6 type 0 route headers can be used to mount a DoS attack against  IPv6 type 0 route headers can be used to mount a DoS attack against
 hosts and networks.  This is a design flaw in IPv6 and not a bug in  hosts and networks.  This is a design flaw in IPv6 and not a bug in
 OpenBSD.<br>  OpenBSD.<br>
Line 95 
Line 97 
 <p>  <p>
   
 <li><a name="021_xorg"></a>  <li><a name="021_xorg"></a>
 <font color="#009000"><strong>021: SECURITY FIX: April 4, 2007</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>021: SECURITY FIX: April 4, 2007</strong></font>
   &nbsp; <i>All architectures</i><br>
 Multiple vulnerabilities have been discovered in X.Org.<br>  Multiple vulnerabilities have been discovered in X.Org.<br>
 XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,  XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,
 BDFFont parsing integer overflow vulnerability,  BDFFont parsing integer overflow vulnerability,
Line 112 
Line 115 
 <p>  <p>
   
 <li><a name="m_dup1"></a>  <li><a name="m_dup1"></a>
 <font color="#009000"><strong>020: SECURITY FIX: March 7, 2007</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>020: SECURITY FIX: March 7, 2007</strong></font>
   &nbsp; <i>All architectures</i><br>
 <strong>2nd revision, March 17, 2007</strong><br>  <strong>2nd revision, March 17, 2007</strong><br>
 Incorrect mbuf handling for ICMP6 packets.<br>  Incorrect mbuf handling for ICMP6 packets.<br>
 Using  Using
Line 126 
Line 130 
 <p>  <p>
   
 <li><a name="timezone"></a>  <li><a name="timezone"></a>
 <font color="#009000"><strong>019: INTEROPERABILITY FIX: February 4, 2007</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>019: INTEROPERABILITY FIX: February 4, 2007</strong></font>
   &nbsp; <i>All architectures</i><br>
 A US daylight saving time rules change takes effect in 2007.  A US daylight saving time rules change takes effect in 2007.
 <br>  <br>
 <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/019_timezone.patch">  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/019_timezone.patch">
Line 134 
Line 139 
 <p>  <p>
   
 <li><a name="icmp6"></a>  <li><a name="icmp6"></a>
 <font color="#009000"><strong>018: RELIABILITY FIX: January 16, 2007</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>018: RELIABILITY FIX: January 16, 2007</strong></font>
   &nbsp; <i>All architectures</i><br>
 Under some circumstances, processing an ICMP6 echo request would cause  Under some circumstances, processing an ICMP6 echo request would cause
 the kernel to enter an infinite loop.  the kernel to enter an infinite loop.
 <br>  <br>
Line 158 
Line 164 
 <p>  <p>
   
 <li><a name="ldso"></a>  <li><a name="ldso"></a>
 <font color="#009000"><strong>016: SECURITY FIX: November 19, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>016: SECURITY FIX: November 19, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 The ELF  The ELF
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so&amp;sektion=1">ld.so(1)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so&amp;sektion=1">ld.so(1)</a>
 fails to properly sanitize the environment. There is a potential localhost security  fails to properly sanitize the environment. There is a potential localhost security
Line 170 
Line 177 
 <p>  <p>
   
 <li><a name="ssh"></a>  <li><a name="ssh"></a>
 <font color="#009000"><strong>015: SECURITY FIX: October 12, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>015: SECURITY FIX: October 12, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found  Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found
 by Tavis Ormandy) that would cause  by Tavis Ormandy) that would cause
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>
Line 185 
Line 193 
 <p>  <p>
   
 <li><a name="systrace"></a>  <li><a name="systrace"></a>
 <font color="#009000"><strong>014: SECURITY FIX: October 7, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>014: SECURITY FIX: October 7, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 Fix for an integer overflow in  Fix for an integer overflow in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&amp;sektion=4">systrace(4)</a>'s  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&amp;sektion=4">systrace(4)</a>'s
 STRIOCREPLACE support, found by  STRIOCREPLACE support, found by
Line 197 
Line 206 
 <p>  <p>
   
 <li><a name="openssl2"></a>  <li><a name="openssl2"></a>
 <font color="#009000"><strong>013: SECURITY FIX: October 7, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>013: SECURITY FIX: October 7, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 Several problems have been found in OpenSSL. While parsing certain invalid ASN.1  Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
 structures an error condition is mishandled, possibly resulting in an infinite  structures an error condition is mishandled, possibly resulting in an infinite
 loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL  loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
Line 214 
Line 224 
 <p>  <p>
   
 <li><a name="httpd2"></a>  <li><a name="httpd2"></a>
 <font color="#009000"><strong>012: SECURITY FIX: October 7, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>012: SECURITY FIX: October 7, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>
 does not sanitize the Expect header from an HTTP request when it is  does not sanitize the Expect header from an HTTP request when it is
 reflected back in an error message, which might allow cross-site scripting (XSS)  reflected back in an error message, which might allow cross-site scripting (XSS)
Line 226 
Line 237 
 <p>  <p>
   
 <li><a name="openssl"></a>  <li><a name="openssl"></a>
 <font color="#009000"><strong>011: SECURITY FIX: September 8, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>011: SECURITY FIX: September 8, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is possible for  Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is possible for
 an attacker to construct an invalid signature which OpenSSL would accept as a  an attacker to construct an invalid signature which OpenSSL would accept as a
 valid PKCS#1 v1.5 signature.  valid PKCS#1 v1.5 signature.
Line 237 
Line 249 
 <p>  <p>
   
 <li><a name="bind"></a>  <li><a name="bind"></a>
 <font color="#009000"><strong>010: SECURITY FIX: September 8, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>010: SECURITY FIX: September 8, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 Two Denial of Service issues have been found with BIND.  Two Denial of Service issues have been found with BIND.
 An attacker who can perform recursive lookups on a DNS server and is able  An attacker who can perform recursive lookups on a DNS server and is able
 to send a sufficiently large number of recursive queries, or is able to  to send a sufficiently large number of recursive queries, or is able to
Line 253 
Line 266 
 <p>  <p>
   
 <li><a name="sppp"></a>  <li><a name="sppp"></a>
 <font color="#009000"><strong>009: SECURITY FIX: September 2, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>009: SECURITY FIX: September 2, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 Due to the failure to correctly validate LCP configuration option lengths,  Due to the failure to correctly validate LCP configuration option lengths,
 it is possible for an attacker to send LCP packets via an  it is possible for an attacker to send LCP packets via an
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sppp&amp;sektion=4">sppp(4)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sppp&amp;sektion=4">sppp(4)</a>
Line 265 
Line 279 
 <p>  <p>
   
 <li><a name="isakmpd"></a>  <li><a name="isakmpd"></a>
 <font color="#009000"><strong>008: SECURITY FIX: August 25, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>008: SECURITY FIX: August 25, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 A problem in  A problem in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;sektion=8">isakmpd(8)</a>  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd&amp;sektion=8">isakmpd(8)</a>
 caused IPsec to run partly without replay protection. If  caused IPsec to run partly without replay protection. If
Line 279 
Line 294 
 <p>  <p>
   
 <li><a name="sem"></a>  <li><a name="sem"></a>
 <font color="#009000"><strong>007: SECURITY FIX: August 25, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>007: SECURITY FIX: August 25, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 It is possible to cause the kernel to panic when more than the default number of  It is possible to cause the kernel to panic when more than the default number of
 sempahores have been allocated.  sempahores have been allocated.
 <br>  <br>
Line 288 
Line 304 
 <p>  <p>
   
 <li><a name="dhcpd"></a>  <li><a name="dhcpd"></a>
 <font color="#009000"><strong>006: SECURITY FIX: August 25, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>006: SECURITY FIX: August 25, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 Due to an off-by-one error in  Due to an off-by-one error in
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dhcpd&amp;sektion=8">dhcpd(8)</a>,  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dhcpd&amp;sektion=8">dhcpd(8)</a>,
 it is possible to cause  it is possible to cause
Line 301 
Line 318 
 <p>  <p>
   
 <li><a name="sendmail3"></a>  <li><a name="sendmail3"></a>
 <font color="#009000"><strong>005: SECURITY FIX: August 25, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>005: SECURITY FIX: August 25, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 A potential denial of service problem has been found in sendmail. A message  A potential denial of service problem has been found in sendmail. A message
 with really long header lines could trigger a use-after-free bug causing  with really long header lines could trigger a use-after-free bug causing
 sendmail to crash.  sendmail to crash.
Line 311 
Line 329 
 <p>  <p>
   
 <li><a name="httpd"></a>  <li><a name="httpd"></a>
 <font color="#009000"><strong>004: SECURITY FIX: July 30, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>004: SECURITY FIX: July 30, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>'s  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>'s
 mod_rewrite has a potentially exploitable off-by-one buffer overflow.  mod_rewrite has a potentially exploitable off-by-one buffer overflow.
 The buffer overflow may result in a vulnerability which, in combination  The buffer overflow may result in a vulnerability which, in combination
Line 324 
Line 343 
 <p>  <p>
   
 <li><a name="sendmail2"></a>  <li><a name="sendmail2"></a>
 <font color="#009000"><strong>003: SECURITY FIX: June 15, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>003: SECURITY FIX: June 15, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 A potential denial of service problem has been found in sendmail. A malformed MIME  A potential denial of service problem has been found in sendmail. A malformed MIME
 message could trigger excessive recursion which will lead to stack exhaustion.  message could trigger excessive recursion which will lead to stack exhaustion.
 This denial of service attack only affects delivery of mail from the queue and  This denial of service attack only affects delivery of mail from the queue and
Line 337 
Line 357 
 <p>  <p>
   
 <li><a name="xorg"></a>  <li><a name="xorg"></a>
 <font color="#009000"><strong>002: SECURITY FIX: May 2, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>002: SECURITY FIX: May 2, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 A security vulnerability has been found in the X.Org server --  A security vulnerability has been found in the X.Org server --
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</a>.  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</a>.
 Clients authorized to connect to the X server are able to crash it and to execute  Clients authorized to connect to the X server are able to crash it and to execute
Line 348 
Line 369 
 <p>  <p>
   
 <li><a name="sendmail"></a>  <li><a name="sendmail"></a>
 <font color="#009000"><strong>001: SECURITY FIX: March 25, 2006</strong></font> &nbsp; <i>All architectures</i><br>  <font color="#009000"><strong>001: SECURITY FIX: March 25, 2006</strong></font>
   &nbsp; <i>All architectures</i><br>
 A race condition has been reported to exist in the handling by sendmail of  A race condition has been reported to exist in the handling by sendmail of
 asynchronous signals. A remote attacker may be able to execute arbitrary code with the  asynchronous signals. A remote attacker may be able to execute arbitrary code with the
 privileges of the user running sendmail, typically root. This is the second revision of  privileges of the user running sendmail, typically root. This is the second revision of
Legend:
Removed from v.1.43  
changed lines
  Added in v.1.44