[BACK]Return to errata40.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata40.html between version 1.68 and 1.69

version 1.68, 2019/05/27 22:55:20 version 1.69, 2019/05/28 16:32:42
Line 82 
Line 82 
 <a href="stable.html">-stable branch</a>.  <a href="stable.html">-stable branch</a>.
   
 <hr>  <hr>
   
 <ul>  <ul>
   
 <li id="p017_openssl">  <li id="httpd">
 <strong>017: SECURITY FIX: October 10, 2007</strong>  <strong>001: SECURITY FIX: November 4, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.  <a href="https://man.openbsd.org/OpenBSD-4.0/httpd.8">httpd(8)</a>
   does not sanitize the Expect header from an HTTP request when it is
   reflected back in an error message, which might allow cross-site scripting (XSS)
   style attacks.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918">CVE-2006-3918</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/017_openssl.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/001_httpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p016_dhcpd">  <li id="openssl2">
 <strong>016: SECURITY FIX: October 8, 2007</strong>  <strong>002: SECURITY FIX: November 4, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>  Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
 A DHCP client that claimed to require a maximum message size less than  structures an error condition is mishandled, possibly resulting in an infinite
 the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.  loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
   pointer may be dereferenced in the SSL version 2 client code. In addition, many
   applications using OpenSSL do not perform any validation of the lengths of
   public keys being used.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</a>
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/016_dhcpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/002_openssl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p015_file">  <li id="systrace">
 <strong>015: SECURITY FIX: July 9, 2007</strong>  <strong>003: SECURITY FIX: November 4, 2006</strong>
 &nbsp; <i>All Architectures</i><br>  
 Fix possible heap overflow in file(1), aka CVE-2007-1536.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/015_file.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
   
 <li id="p014_xorg">  
 <strong>014: STABILITY FIX: May 9, 2007</strong>  
 &nbsp; <i>All Architectures</i><br>  
 A malicious client can cause a division by zero.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/014_xorg.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
   
 <li id="p013_altivec">  
 <strong>013: STABILITY FIX: April 26, 2007</strong>  
 &nbsp; <i>PowerPC</i><br>  
 An unhandled AltiVec assist exception can cause a kernel panic.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/macppc/013_altivec.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
   
 <li id="p012_route6">  
 <strong>012: SECURITY FIX: April 23, 2007</strong>  
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 IPv6 type 0 route headers can be used to mount a DoS attack against  Fix for an integer overflow in
 hosts and networks.  This is a design flaw in IPv6 and not a bug in  <a href="https://man.openbsd.org/OpenBSD-4.0/systrace.4">systrace(4)</a>'s
 OpenBSD.<br>  STRIOCREPLACE support, found by
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/012_route6.patch">  Chris Evans. This could be exploited for DoS, limited kmem reads or local
   privilege escalation.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/003_systrace.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p011_xorg">  <li id="arc">
 <strong>011: SECURITY FIX: April 4, 2007</strong>  <strong>004: RELIABILITY FIX: November 7, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Multiple vulnerabilities have been discovered in X.Org.<br>  Due to a bug in the
 XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,  <a href="https://man.openbsd.org/OpenBSD-4.0/arc.4">arc(4)</a>
 BDFFont parsing integer overflow vulnerability,  RAID driver the driver will not properly synchronize the cache to the logical volumes
 fonts.dir file parsing integer overflow vulnerability,  upon system shut down. The result being that the mounted file systems within the logical
 multiple integer overflows in the XGetPixel() and XInitImage functions  volumes will not be properly marked as being clean and fsck will be run for the subsequent
 in ImUtil.c.  boot up.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003">CVE-2007-1003</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351">CVE-2007-1351</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352">CVE-2007-1352</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667">CVE-2007-1667</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/011_xorg.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/004_arc.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="m_dup1">  <li id="ldso">
 <strong>010: SECURITY FIX: March 7, 2007</strong>  <strong>005: SECURITY FIX: November 19, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <b>2nd revision, March 17, 2007</b><br>  The ELF
 Incorrect mbuf handling for ICMP6 packets.<br>  <a href="https://man.openbsd.org/OpenBSD-4.0/ld.so.1">ld.so(1)</a>
 Using  fails to properly sanitize the environment. There is a potential localhost security
 <a href="https://man.openbsd.org/OpenBSD-4.0/pf.4">pf(4)</a>  problem in cases we have not found yet.  This patch applies to all ELF-based
 to avoid the problem packets is an effective workaround until the patch  systems (m68k, m88k, and vax are a.out-based systems).
 can be installed.<br>  
 Use "block in inet6" in /etc/pf.conf  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/010_m_dup1.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/005_ldso.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="timezone">  <li id="ports-tar">
 <strong>009: INTEROPERABILITY FIX: February 4, 2007</strong>  <strong>006: FTP DISTRIBUTION ERROR: December 4, 2006</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A US daylight saving time rules change takes effect in 2007.  The <b>src.tar.gz</b> and <b>ports.tar.gz</b> archives
   released on FTP were created incorrectly, a week after the 4.0 release. The
   archives on the CD sets are correct; this only affects people who downloaded
   them from a <a href="ftp.html">mirror</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/009_timezone.patch">  The archives have been corrected. The correct MD5 of
 A source code patch exists which syncs the timezone data files with tzdata2007a</a>.<br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/4.0/ports.tar.gz">
 <p>  ports.tar.gz</a> is eff352b4382a7fb7ffce1e8b37e9eb56, and for
   <a href="https://ftp.openbsd.org/pub/OpenBSD/4.0/src.tar.gz">
 <li id="icmp6">  src.tar.gz</a> it is b8d7a0dc6f3d27a5377a23d69c40688e.
 <strong>008: RELIABILITY FIX: January 16, 2007</strong>  
 &nbsp; <i>All architectures</i><br>  
 Under some circumstances, processing an ICMP6 echo request would cause  
 the kernel to enter an infinite loop.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/008_icmp6.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  <p>
   
 <li id="agp">  <li id="agp">
Line 206 
Line 186 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="ports-tar">  <li id="icmp6">
 <strong>006: FTP DISTRIBUTION ERROR: December 4, 2006</strong>  <strong>008: RELIABILITY FIX: January 16, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The <b>src.tar.gz</b> and <b>ports.tar.gz</b> archives  Under some circumstances, processing an ICMP6 echo request would cause
 released on FTP were created incorrectly, a week after the 4.0 release. The  the kernel to enter an infinite loop.
 archives on the CD sets are correct; this only affects people who downloaded  
 them from a <a href="ftp.html">mirror</a>.  
 <br>  <br>
 The archives have been corrected. The correct MD5 of  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/008_icmp6.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/4.0/ports.tar.gz">  A source code patch exists which remedies this problem.</a>
 ports.tar.gz</a> is eff352b4382a7fb7ffce1e8b37e9eb56, and for  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/4.0/src.tar.gz">  
 src.tar.gz</a> it is b8d7a0dc6f3d27a5377a23d69c40688e.  
 <br>  
 <p>  <p>
   
 <li id="ldso">  <li id="timezone">
 <strong>005: SECURITY FIX: November 19, 2006</strong>  <strong>009: INTEROPERABILITY FIX: February 4, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The ELF  A US daylight saving time rules change takes effect in 2007.
 <a href="https://man.openbsd.org/OpenBSD-4.0/ld.so.1">ld.so(1)</a>  
 fails to properly sanitize the environment. There is a potential localhost security  
 problem in cases we have not found yet.  This patch applies to all ELF-based  
 systems (m68k, m88k, and vax are a.out-based systems).  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/005_ldso.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/009_timezone.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which syncs the timezone data files with tzdata2007a</a>.<br>
 <p>  <p>
   
 <li id="arc">  <li id="m_dup1">
 <strong>004: RELIABILITY FIX: November 7, 2006</strong>  <strong>010: SECURITY FIX: March 7, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Due to a bug in the  <b>2nd revision, March 17, 2007</b><br>
 <a href="https://man.openbsd.org/OpenBSD-4.0/arc.4">arc(4)</a>  Incorrect mbuf handling for ICMP6 packets.<br>
 RAID driver the driver will not properly synchronize the cache to the logical volumes  Using
 upon system shut down. The result being that the mounted file systems within the logical  <a href="https://man.openbsd.org/OpenBSD-4.0/pf.4">pf(4)</a>
 volumes will not be properly marked as being clean and fsck will be run for the subsequent  to avoid the problem packets is an effective workaround until the patch
 boot up.  can be installed.<br>
   Use "block in inet6" in /etc/pf.conf
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/004_arc.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/010_m_dup1.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="systrace">  <li id="p011_xorg">
 <strong>003: SECURITY FIX: November 4, 2006</strong>  <strong>011: SECURITY FIX: April 4, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix for an integer overflow in  Multiple vulnerabilities have been discovered in X.Org.<br>
 <a href="https://man.openbsd.org/OpenBSD-4.0/systrace.4">systrace(4)</a>'s  XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,
 STRIOCREPLACE support, found by  BDFFont parsing integer overflow vulnerability,
 Chris Evans. This could be exploited for DoS, limited kmem reads or local  fonts.dir file parsing integer overflow vulnerability,
 privilege escalation.  multiple integer overflows in the XGetPixel() and XInitImage functions
   in ImUtil.c.
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003">CVE-2007-1003</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351">CVE-2007-1351</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352">CVE-2007-1352</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667">CVE-2007-1667</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/003_systrace.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/011_xorg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="openssl2">  <li id="p012_route6">
 <strong>002: SECURITY FIX: November 4, 2006</strong>  <strong>012: SECURITY FIX: April 23, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Several problems have been found in OpenSSL. While parsing certain invalid ASN.1  IPv6 type 0 route headers can be used to mount a DoS attack against
 structures an error condition is mishandled, possibly resulting in an infinite  hosts and networks.  This is a design flaw in IPv6 and not a bug in
 loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL  OpenBSD.<br>
 pointer may be dereferenced in the SSL version 2 client code. In addition, many  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/012_route6.patch">
 applications using OpenSSL do not perform any validation of the lengths of  A source code patch exists which remedies this problem.</a>
 public keys being used.  <p>
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937">CVE-2006-2937</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738">CVE-2006-3738</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343">CVE-2006-4343</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940">CVE-2006-2940</a>  
 <br>  
   
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/002_openssl.patch">  <li id="p013_altivec">
   <strong>013: STABILITY FIX: April 26, 2007</strong>
   &nbsp; <i>PowerPC</i><br>
   An unhandled AltiVec assist exception can cause a kernel panic.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/macppc/013_altivec.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="httpd">  <li id="p014_xorg">
 <strong>001: SECURITY FIX: November 4, 2006</strong>  <strong>014: STABILITY FIX: May 9, 2007</strong>
   &nbsp; <i>All Architectures</i><br>
   A malicious client can cause a division by zero.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/014_xorg.patch">
   A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="p015_file">
   <strong>015: SECURITY FIX: July 9, 2007</strong>
   &nbsp; <i>All Architectures</i><br>
   Fix possible heap overflow in file(1), aka CVE-2007-1536.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/015_file.patch">
   A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="p016_dhcpd">
   <strong>016: SECURITY FIX: October 8, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 <a href="https://man.openbsd.org/OpenBSD-4.0/httpd.8">httpd(8)</a>  Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>
 does not sanitize the Expect header from an HTTP request when it is  A DHCP client that claimed to require a maximum message size less than
 reflected back in an error message, which might allow cross-site scripting (XSS)  the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.
 style attacks.  <br>
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918">CVE-2006-3918</a>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/016_dhcpd.patch">
   A source code patch exists which remedies this problem.</a>
   <p>
   
   <li id="p017_openssl">
   <strong>017: SECURITY FIX: October 10, 2007</strong>
   &nbsp; <i>All architectures</i><br>
   The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/001_httpd.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/017_openssl.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Legend:
Removed from v.1.68  
changed lines
  Added in v.1.69