[BACK]Return to errata39.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata39.html between version 1.70 and 1.71

version 1.70, 2019/05/27 22:55:20 version 1.71, 2019/05/28 16:32:42
Line 85 
Line 85 
   
 <ul>  <ul>
   
 <li id="p023_altivec">  <li id="sendmail">
 <strong>023: STABILITY FIX: April 26, 2007</strong>  <strong>001: SECURITY FIX: March 25, 2006</strong>
 &nbsp; <i>PowerPC</i><br>  &nbsp; <i>All architectures</i><br>
 An unhandled AltiVec assist exception can cause a kernel panic.<br>  A race condition has been reported to exist in the handling by sendmail of
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/macppc/023_altivec.patch">  asynchronous signals. A remote attacker may be able to execute arbitrary code with the
   privileges of the user running sendmail, typically root. This is the second revision of
   this patch.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/001_sendmail.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p022_route6">  <li id="xorg">
 <strong>022: SECURITY FIX: April 23, 2007</strong>  <strong>002: SECURITY FIX: May 2, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 IPv6 type 0 route headers can be used to mount a DoS attack against  A security vulnerability has been found in the X.Org server --
 hosts and networks.  This is a design flaw in IPv6 and not a bug in  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</a>.
 OpenBSD.<br>  Clients authorized to connect to the X server are able to crash it and to execute
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/022_route6.patch">  malicious code within the X server.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/002_xorg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p021_xorg">  <li id="sendmail2">
 <strong>021: SECURITY FIX: April 4, 2007</strong>  <strong>003: SECURITY FIX: June 15, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Multiple vulnerabilities have been discovered in X.Org.<br>  A potential denial of service problem has been found in sendmail. A malformed MIME
 XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,  message could trigger excessive recursion which will lead to stack exhaustion.
 BDFFont parsing integer overflow vulnerability,  This denial of service attack only affects delivery of mail from the queue and
 fonts.dir file parsing integer overflow vulnerability,  delivery of a malformed message. Other incoming mail is still accepted and
 multiple integer overflows in the XGetPixel() and XInitImage functions  delivered. However, mail messages in the queue may not be reattempted if a
 in ImUtil.c.  malformed MIME message exists.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003">CVE-2007-1003</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351">CVE-2007-1351</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352">CVE-2007-1352</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667">CVE-2007-1667</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/021_xorg.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/003_sendmail2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="m_dup1">  <li id="httpd">
 <strong>020: SECURITY FIX: March 7, 2007</strong>  <strong>004: SECURITY FIX: July 30, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <b>2nd revision, March 17, 2007</b><br>  <a href="https://man.openbsd.org/OpenBSD-3.9/httpd.8">httpd(8)</a>'s
 Incorrect mbuf handling for ICMP6 packets.<br>  mod_rewrite has a potentially exploitable off-by-one buffer overflow.
 Using  The buffer overflow may result in a vulnerability which, in combination
 <a href="https://man.openbsd.org/OpenBSD-3.9/pf.4">pf(4)</a>  with certain types of Rewrite rules in the web server configuration files,
 to avoid the problem packets is an effective workaround until the patch  could be triggered remotely. The default install is not affected by the
 can be installed.<br>  buffer overflow. CVE-2006-3747
 Use "block in inet6" in /etc/pf.conf  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/020_m_dup1.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/004_httpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="timezone">  <li id="sendmail3">
 <strong>019: INTEROPERABILITY FIX: February 4, 2007</strong>  <strong>005: SECURITY FIX: August 25, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A US daylight saving time rules change takes effect in 2007.  A potential denial of service problem has been found in sendmail. A message
   with really long header lines could trigger a use-after-free bug causing
   sendmail to crash.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/019_timezone.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/005_sendmail3.patch">
 A source code patch exists which syncs the timezone data files with tzdata2007a</a>.<br>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="icmp6">  <li id="dhcpd">
 <strong>018: RELIABILITY FIX: January 16, 2007</strong>  <strong>006: SECURITY FIX: August 25, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Under some circumstances, processing an ICMP6 echo request would cause  Due to an off-by-one error in
 the kernel to enter an infinite loop.  <a href="https://man.openbsd.org/OpenBSD-3.9/dhcpd.8">dhcpd(8)</a>,
   it is possible to cause
   <a href="https://man.openbsd.org/OpenBSD-3.9/dhcpd.8">dhcpd(8)</a>
   to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3122">CVE-2006-3122</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/018_icmp6.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/006_dhcpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="agp">  <li id="sem">
 <strong>017: SECURITY FIX: January 3, 2007</strong>  <strong>007: SECURITY FIX: August 25, 2006</strong>
 &nbsp; <i>i386 only</i><br>  &nbsp; <i>All architectures</i><br>
 Insufficient validation in  It is possible to cause the kernel to panic when more than the default number of
 <a href="https://man.openbsd.org/OpenBSD-3.9/vga.4">vga(4)</a>  sempahores have been allocated.
 may allow an attacker to gain root privileges if the kernel is compiled with  
 <code>option PCIAGP</code>  
 and the actual device is not an AGP device.  
 The <code>PCIAGP</code> option is present by default on i386  
 kernels only.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/i386/017_agp.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/007_sem.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="ldso">  <li id="isakmpd">
 <strong>016: SECURITY FIX: November 19, 2006</strong>  <strong>008: SECURITY FIX: August 25, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The ELF  A problem in
 <a href="https://man.openbsd.org/OpenBSD-3.9/ld.so.1">ld.so(1)</a>  <a href="https://man.openbsd.org/OpenBSD-3.9/isakmpd.8">isakmpd(8)</a>
 fails to properly sanitize the environment. There is a potential localhost security  caused IPsec to run partly without replay protection. If
 problem in cases we have not found yet.  This patch applies to all ELF-based  <a href="https://man.openbsd.org/OpenBSD-3.9/isakmpd.8">isakmpd(8)</a>
 systems (m68k, m88k, and vax are a.out-based systems).  was acting as responder during SA negotiation, SA's with a replay window of size 0 were created.
   An attacker could reinject sniffed IPsec packets, which will be accepted without checking the
   replay counter.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/016_ldso.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/008_isakmpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="ssh">  <li id="sppp">
 <strong>015: SECURITY FIX: October 12, 2006</strong>  <strong>009: SECURITY FIX: September 2, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found  Due to the failure to correctly validate LCP configuration option lengths,
 by Tavis Ormandy) that would cause  it is possible for an attacker to send LCP packets via an
 <a href="https://man.openbsd.org/OpenBSD-3.9/sshd.8">sshd(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.9/sppp.4">sppp(4)</a>
 to spin until the login grace time expired.  connection causing the kernel to panic.
 An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a>
 that could be exploited to perform a pre-authentication denial of service.  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4924">CVE-2006-4924</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5051">CVE-2006-5051</a>  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/015_ssh.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/009_sppp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="systrace">  <li id="bind">
 <strong>014: SECURITY FIX: October 7, 2006</strong>  <strong>010: SECURITY FIX: September 8, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix for an integer overflow in  Two Denial of Service issues have been found with BIND.
 <a href="https://man.openbsd.org/OpenBSD-3.9/systrace.4">systrace(4)</a>'s  An attacker who can perform recursive lookups on a DNS server and is able
 STRIOCREPLACE support, found by  to send a sufficiently large number of recursive queries, or is able to
 Chris Evans. This could be exploited for DoS, limited kmem reads or local  get the DNS server to return more than one SIG(covered) RRsets can stop
 privilege escalation.  the functionality of the DNS service.
   An attacker querying an authoritative DNS server serving a RFC 2535
   DNSSEC zone may be able to crash the DNS server.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095">CVE-2006-4095</a>
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096">CVE-2006-4096</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/014_systrace.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/010_bind.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="openssl2">  <li id="openssl">
 <strong>013: SECURITY FIX: October 7, 2006</strong>  <strong>011: SECURITY FIX: September 8, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Several problems have been found in OpenSSL. While parsing certain invalid ASN.1  Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is possible for
 structures an error condition is mishandled, possibly resulting in an infinite  an attacker to construct an invalid signature which OpenSSL would accept as a
 loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL  valid PKCS#1 v1.5 signature.
 pointer may be dereferenced in the SSL version 2 client code. In addition, many  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339">CVE-2006-4339</a>
 applications using OpenSSL do not perform any validation of the lengths of  
 public keys being used.  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</a>  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/013_openssl2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/011_openssl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Line 243 
Line 242 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="openssl">  <li id="openssl2">
 <strong>011: SECURITY FIX: September 8, 2006</strong>  <strong>013: SECURITY FIX: October 7, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is possible for  Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
 an attacker to construct an invalid signature which OpenSSL would accept as a  structures an error condition is mishandled, possibly resulting in an infinite
 valid PKCS#1 v1.5 signature.  loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339">CVE-2006-4339</a>  pointer may be dereferenced in the SSL version 2 client code. In addition, many
   applications using OpenSSL do not perform any validation of the lengths of
   public keys being used.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/011_openssl.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/013_openssl2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="bind">  <li id="systrace">
 <strong>010: SECURITY FIX: September 8, 2006</strong>  <strong>014: SECURITY FIX: October 7, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Two Denial of Service issues have been found with BIND.  Fix for an integer overflow in
 An attacker who can perform recursive lookups on a DNS server and is able  <a href="https://man.openbsd.org/OpenBSD-3.9/systrace.4">systrace(4)</a>'s
 to send a sufficiently large number of recursive queries, or is able to  STRIOCREPLACE support, found by
 get the DNS server to return more than one SIG(covered) RRsets can stop  Chris Evans. This could be exploited for DoS, limited kmem reads or local
 the functionality of the DNS service.  privilege escalation.
 An attacker querying an authoritative DNS server serving a RFC 2535  
 DNSSEC zone may be able to crash the DNS server.  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095">CVE-2006-4095</a>  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096">CVE-2006-4096</a>  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/010_bind.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/014_systrace.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sppp">  <li id="ssh">
 <strong>009: SECURITY FIX: September 2, 2006</strong>  <strong>015: SECURITY FIX: October 12, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to the failure to correctly validate LCP configuration option lengths,  Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found
 it is possible for an attacker to send LCP packets via an  by Tavis Ormandy) that would cause
 <a href="https://man.openbsd.org/OpenBSD-3.9/sppp.4">sppp(4)</a>  <a href="https://man.openbsd.org/OpenBSD-3.9/sshd.8">sshd(8)</a>
 connection causing the kernel to panic.  to spin until the login grace time expired.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4304">CVE-2006-4304</a>  An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition
   that could be exploited to perform a pre-authentication denial of service.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4924">CVE-2006-4924</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5051">CVE-2006-5051</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/009_sppp.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/015_ssh.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="isakmpd">  <li id="ldso">
 <strong>008: SECURITY FIX: August 25, 2006</strong>  <strong>016: SECURITY FIX: November 19, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A problem in  The ELF
 <a href="https://man.openbsd.org/OpenBSD-3.9/isakmpd.8">isakmpd(8)</a>  <a href="https://man.openbsd.org/OpenBSD-3.9/ld.so.1">ld.so(1)</a>
 caused IPsec to run partly without replay protection. If  fails to properly sanitize the environment. There is a potential localhost security
 <a href="https://man.openbsd.org/OpenBSD-3.9/isakmpd.8">isakmpd(8)</a>  problem in cases we have not found yet.  This patch applies to all ELF-based
 was acting as responder during SA negotiation, SA's with a replay window of size 0 were created.  systems (m68k, m88k, and vax are a.out-based systems).
 An attacker could reinject sniffed IPsec packets, which will be accepted without checking the  
 replay counter.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/008_isakmpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/016_ldso.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sem">  <li id="agp">
 <strong>007: SECURITY FIX: August 25, 2006</strong>  <strong>017: SECURITY FIX: January 3, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>i386 only</i><br>
 It is possible to cause the kernel to panic when more than the default number of  Insufficient validation in
 sempahores have been allocated.  <a href="https://man.openbsd.org/OpenBSD-3.9/vga.4">vga(4)</a>
   may allow an attacker to gain root privileges if the kernel is compiled with
   <code>option PCIAGP</code>
   and the actual device is not an AGP device.
   The <code>PCIAGP</code> option is present by default on i386
   kernels only.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/007_sem.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/i386/017_agp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="dhcpd">  <li id="icmp6">
 <strong>006: SECURITY FIX: August 25, 2006</strong>  <strong>018: RELIABILITY FIX: January 16, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to an off-by-one error in  Under some circumstances, processing an ICMP6 echo request would cause
 <a href="https://man.openbsd.org/OpenBSD-3.9/dhcpd.8">dhcpd(8)</a>,  the kernel to enter an infinite loop.
 it is possible to cause  
 <a href="https://man.openbsd.org/OpenBSD-3.9/dhcpd.8">dhcpd(8)</a>  
 to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option.  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3122">CVE-2006-3122</a>  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/006_dhcpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/018_icmp6.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sendmail3">  <li id="timezone">
 <strong>005: SECURITY FIX: August 25, 2006</strong>  <strong>019: INTEROPERABILITY FIX: February 4, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A potential denial of service problem has been found in sendmail. A message  A US daylight saving time rules change takes effect in 2007.
 with really long header lines could trigger a use-after-free bug causing  
 sendmail to crash.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/005_sendmail3.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/019_timezone.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which syncs the timezone data files with tzdata2007a</a>.<br>
 <p>  <p>
   
 <li id="httpd">  <li id="m_dup1">
 <strong>004: SECURITY FIX: July 30, 2006</strong>  <strong>020: SECURITY FIX: March 7, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-3.9/httpd.8">httpd(8)</a>'s  <b>2nd revision, March 17, 2007</b><br>
 mod_rewrite has a potentially exploitable off-by-one buffer overflow.  Incorrect mbuf handling for ICMP6 packets.<br>
 The buffer overflow may result in a vulnerability which, in combination  Using
 with certain types of Rewrite rules in the web server configuration files,  <a href="https://man.openbsd.org/OpenBSD-3.9/pf.4">pf(4)</a>
 could be triggered remotely. The default install is not affected by the  to avoid the problem packets is an effective workaround until the patch
 buffer overflow. CVE-2006-3747  can be installed.<br>
   Use "block in inet6" in /etc/pf.conf
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/004_httpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/020_m_dup1.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sendmail2">  <li id="p021_xorg">
 <strong>003: SECURITY FIX: June 15, 2006</strong>  <strong>021: SECURITY FIX: April 4, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A potential denial of service problem has been found in sendmail. A malformed MIME  Multiple vulnerabilities have been discovered in X.Org.<br>
 message could trigger excessive recursion which will lead to stack exhaustion.  XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,
 This denial of service attack only affects delivery of mail from the queue and  BDFFont parsing integer overflow vulnerability,
 delivery of a malformed message. Other incoming mail is still accepted and  fonts.dir file parsing integer overflow vulnerability,
 delivered. However, mail messages in the queue may not be reattempted if a  multiple integer overflows in the XGetPixel() and XInitImage functions
 malformed MIME message exists.  in ImUtil.c.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003">CVE-2007-1003</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351">CVE-2007-1351</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352">CVE-2007-1352</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667">CVE-2007-1667</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/003_sendmail2.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/021_xorg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="xorg">  <li id="p022_route6">
 <strong>002: SECURITY FIX: May 2, 2006</strong>  <strong>022: SECURITY FIX: April 23, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A security vulnerability has been found in the X.Org server --  IPv6 type 0 route headers can be used to mount a DoS attack against
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526">CVE-2006-1526</a>.  hosts and networks.  This is a design flaw in IPv6 and not a bug in
 Clients authorized to connect to the X server are able to crash it and to execute  OpenBSD.<br>
 malicious code within the X server.  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/022_route6.patch">
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/002_xorg.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="sendmail">  <li id="p023_altivec">
 <strong>001: SECURITY FIX: March 25, 2006</strong>  <strong>023: STABILITY FIX: April 26, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>PowerPC</i><br>
 A race condition has been reported to exist in the handling by sendmail of  An unhandled AltiVec assist exception can cause a kernel panic.<br>
 asynchronous signals. A remote attacker may be able to execute arbitrary code with the  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/macppc/023_altivec.patch">
 privileges of the user running sendmail, typically root. This is the second revision of  
 this patch.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/001_sendmail.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Legend:
Removed from v.1.70  
changed lines
  Added in v.1.71