=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/errata39.html,v retrieving revision 1.53 retrieving revision 1.54 diff -u -r1.53 -r1.54 --- www/errata39.html 2016/02/20 14:18:42 1.53 +++ www/errata39.html 2016/03/21 05:46:20 1.54 @@ -126,7 +126,7 @@ 2nd revision, March 17, 2007
Incorrect mbuf handling for ICMP6 packets.
Using -pf(4) +pf(4) to avoid the problem packets is an effective workaround until the patch can be installed.
Use "block in inet6" in /etc/pf.conf @@ -158,7 +158,7 @@ 017: SECURITY FIX: January 3, 2007   i386 only
Insufficient validation in -vga(4) +vga(4) may allow an attacker to gain root privileges if the kernel is compiled with option PCIAGP and the actual device is not an AGP device. @@ -173,7 +173,7 @@ 016: SECURITY FIX: November 19, 2006   All architectures
The ELF -ld.so(1) +ld.so(1) fails to properly sanitize the environment. There is a potential localhost security problem in cases we have not found yet. This patch applies to all ELF-based systems (m68k, m88k, and vax are a.out-based systems). @@ -187,7 +187,7 @@   All architectures
Fix 2 security bugs found in OpenSSH. A pre-authentication denial of service (found by Tavis Ormandy) that would cause -sshd(8) +sshd(8) to spin until the login grace time expired. An unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition that could be exploited to perform a pre-authentication denial of service. @@ -202,7 +202,7 @@ 014: SECURITY FIX: October 7, 2006   All architectures
Fix for an integer overflow in -systrace(4)'s +systrace(4)'s STRIOCREPLACE support, found by Chris Evans. This could be exploited for DoS, limited kmem reads or local privilege escalation. @@ -232,7 +232,7 @@
  • 012: SECURITY FIX: October 7, 2006   All architectures
    -httpd(8) +httpd(8) does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks. @@ -276,7 +276,7 @@   All architectures
    Due to the failure to correctly validate LCP configuration option lengths, it is possible for an attacker to send LCP packets via an -sppp(4) +sppp(4) connection causing the kernel to panic. CVE-2006-4304
    @@ -288,9 +288,9 @@ 008: SECURITY FIX: August 25, 2006   All architectures
    A problem in -isakmpd(8) +isakmpd(8) caused IPsec to run partly without replay protection. If -isakmpd(8) +isakmpd(8) was acting as responder during SA negotiation, SA's with a replay window of size 0 were created. An attacker could reinject sniffed IPsec packets, which will be accepted without checking the replay counter. @@ -313,9 +313,9 @@ 006: SECURITY FIX: August 25, 2006   All architectures
    Due to an off-by-one error in -dhcpd(8), +dhcpd(8), it is possible to cause -dhcpd(8) +dhcpd(8) to exit by sending a DHCPDISCOVER packet with a 32-byte client identifier option. CVE-2006-3122
    @@ -337,7 +337,7 @@
  • 004: SECURITY FIX: July 30, 2006   All architectures
    -httpd(8)'s +httpd(8)'s mod_rewrite has a potentially exploitable off-by-one buffer overflow. The buffer overflow may result in a vulnerability which, in combination with certain types of Rewrite rules in the web server configuration files,