===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/errata40.html,v
retrieving revision 1.41
retrieving revision 1.42
diff -c -r1.41 -r1.42
*** www/errata40.html	2014/03/31 03:12:47	1.41
--- www/errata40.html	2014/03/31 16:02:48	1.42
***************
*** 79,85 ****
  <ul>
  
  <li><a name="017_openssl"></a>
! <font color="#009000"><strong>017: SECURITY FIX: October 10, 2007</strong></font> &nbsp; <i>All architectures</i><br>
  The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.
  <br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/017_openssl.patch">
--- 79,86 ----
  <ul>
  
  <li><a name="017_openssl"></a>
! <font color="#009000"><strong>017: SECURITY FIX: October 10, 2007</strong></font>
! &nbsp; <i>All architectures</i><br>
  The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.
  <br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/017_openssl.patch">
***************
*** 87,93 ****
  <p>
  
  <li><a name="016_dhcpd"></a>
! <font color="#009000"><strong>016: SECURITY FIX: October 8, 2007</strong></font> &nbsp; <i>All architectures</i><br>
  Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>
  A DHCP client that claimed to require a maximum message size less than
  the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.
--- 88,95 ----
  <p>
  
  <li><a name="016_dhcpd"></a>
! <font color="#009000"><strong>016: SECURITY FIX: October 8, 2007</strong></font>
! &nbsp; <i>All architectures</i><br>
  Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>
  A DHCP client that claimed to require a maximum message size less than
  the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.
***************
*** 97,124 ****
  <p>
  
  <li><a name="015_file"></a>
! <font color="#009000"><strong>015: SECURITY FIX: July 9, 2007</strong></font> &nbsp; <i>All Architectures</i><br>
  Fix possible heap overflow in file(1), aka CVE-2007-1536.<br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/015_file.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
  <li><a name="014_xorg"></a>
! <font color="#009000"><strong>014: STABILITY FIX: May 9, 2007</strong></font> &nbsp; <i>All Architectures</i><br>
  A malicious client can cause a division by zero.<br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/014_xorg.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
  <li><a name="013_altivec"></a>
! <font color="#009000"><strong>013: STABILITY FIX: April 26, 2007</strong></font> &nbsp; <i>PowerPC</i><br>
  An unhandled AltiVec assist exception can cause a kernel panic.<br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/macppc/013_altivec.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
  <li><a name="012_route6"></a>
! <font color="#009000"><strong>012: SECURITY FIX: April 23, 2007</strong></font> &nbsp; <i>All architectures</i><br>
  IPv6 type 0 route headers can be used to mount a DoS attack against
  hosts and networks.  This is a design flaw in IPv6 and not a bug in
  OpenBSD.<br>
--- 99,130 ----
  <p>
  
  <li><a name="015_file"></a>
! <font color="#009000"><strong>015: SECURITY FIX: July 9, 2007</strong></font>
! &nbsp; <i>All Architectures</i><br>
  Fix possible heap overflow in file(1), aka CVE-2007-1536.<br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/015_file.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
  <li><a name="014_xorg"></a>
! <font color="#009000"><strong>014: STABILITY FIX: May 9, 2007</strong></font>
! &nbsp; <i>All Architectures</i><br>
  A malicious client can cause a division by zero.<br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/014_xorg.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
  <li><a name="013_altivec"></a>
! <font color="#009000"><strong>013: STABILITY FIX: April 26, 2007</strong></font>
! &nbsp; <i>PowerPC</i><br>
  An unhandled AltiVec assist exception can cause a kernel panic.<br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/macppc/013_altivec.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
  <li><a name="012_route6"></a>
! <font color="#009000"><strong>012: SECURITY FIX: April 23, 2007</strong></font>
! &nbsp; <i>All architectures</i><br>
  IPv6 type 0 route headers can be used to mount a DoS attack against
  hosts and networks.  This is a design flaw in IPv6 and not a bug in
  OpenBSD.<br>
***************
*** 127,133 ****
  <p>
  
  <li><a name="011_xorg"></a>
! <font color="#009000"><strong>011: SECURITY FIX: April 4, 2007</strong></font> &nbsp; <i>All architectures</i><br>
  Multiple vulnerabilities have been discovered in X.Org.<br>
  XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,
  BDFFont parsing integer overflow vulnerability,
--- 133,140 ----
  <p>
  
  <li><a name="011_xorg"></a>
! <font color="#009000"><strong>011: SECURITY FIX: April 4, 2007</strong></font>
! &nbsp; <i>All architectures</i><br>
  Multiple vulnerabilities have been discovered in X.Org.<br>
  XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,
  BDFFont parsing integer overflow vulnerability,
***************
*** 144,150 ****
  <p>
  
  <li><a name="m_dup1"></a>
! <font color="#009000"><strong>010: SECURITY FIX: March 7, 2007</strong></font> &nbsp; <i>All architectures</i><br>
  <strong>2nd revision, March 17, 2007</strong><br>
  Incorrect mbuf handling for ICMP6 packets.<br>
  Using
--- 151,158 ----
  <p>
  
  <li><a name="m_dup1"></a>
! <font color="#009000"><strong>010: SECURITY FIX: March 7, 2007</strong></font>
! &nbsp; <i>All architectures</i><br>
  <strong>2nd revision, March 17, 2007</strong><br>
  Incorrect mbuf handling for ICMP6 packets.<br>
  Using
***************
*** 158,164 ****
  <p>
  
  <li><a name="timezone"></a>
! <font color="#009000"><strong>009: INTEROPERABILITY FIX: February 4, 2007</strong></font> &nbsp; <i>All architectures</i><br>
  A US daylight saving time rules change takes effect in 2007.
  <br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/009_timezone.patch">
--- 166,173 ----
  <p>
  
  <li><a name="timezone"></a>
! <font color="#009000"><strong>009: INTEROPERABILITY FIX: February 4, 2007</strong></font>
! &nbsp; <i>All architectures</i><br>
  A US daylight saving time rules change takes effect in 2007.
  <br>
  <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/009_timezone.patch">
***************
*** 166,172 ****
  <p>
  
  <li><a name="icmp6"></a>
! <font color="#009000"><strong>008: RELIABILITY FIX: January 16, 2007</strong></font> &nbsp; <i>All architectures</i><br>
  Under some circumstances, processing an ICMP6 echo request would cause
  the kernel to enter an infinite loop.
  <br>
--- 175,182 ----
  <p>
  
  <li><a name="icmp6"></a>
! <font color="#009000"><strong>008: RELIABILITY FIX: January 16, 2007</strong></font>
! &nbsp; <i>All architectures</i><br>
  Under some circumstances, processing an ICMP6 echo request would cause
  the kernel to enter an infinite loop.
  <br>
***************
*** 190,196 ****
  <p>
  
  <li><a name="ports-tar"></a>
! <font color="#009000"><strong>006: FTP DISTRIBUTION ERROR: December 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
  The <strong>src.tar.gz</strong> and <strong>ports.tar.gz</strong> archives
  released on FTP were created incorrectly, a week after the 4.0 release. The
  archives on the CD sets are correct; this only affects people who downloaded
--- 200,207 ----
  <p>
  
  <li><a name="ports-tar"></a>
! <font color="#009000"><strong>006: FTP DISTRIBUTION ERROR: December 4, 2006</strong></font>
! &nbsp; <i>All architectures</i><br>
  The <strong>src.tar.gz</strong> and <strong>ports.tar.gz</strong> archives
  released on FTP were created incorrectly, a week after the 4.0 release. The
  archives on the CD sets are correct; this only affects people who downloaded
***************
*** 205,211 ****
  <p>
  
  <li><a name="ldso"></a>
! <font color="#009000"><strong>005: SECURITY FIX: November 19, 2006</strong></font> &nbsp; <i>All architectures</i><br>
  The ELF
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so&amp;sektion=1">ld.so(1)</a>
  fails to properly sanitize the environment. There is a potential localhost security
--- 216,223 ----
  <p>
  
  <li><a name="ldso"></a>
! <font color="#009000"><strong>005: SECURITY FIX: November 19, 2006</strong></font>
! &nbsp; <i>All architectures</i><br>
  The ELF
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so&amp;sektion=1">ld.so(1)</a>
  fails to properly sanitize the environment. There is a potential localhost security
***************
*** 217,223 ****
  <p>
  
  <li><a name="arc"></a>
! <font color="#009000"><strong>004: RELIABILITY FIX: November 7, 2006</strong></font> &nbsp; <i>All architectures</i><br>
  Due to a bug in the
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=arc&amp;sektion=4">arc(4)</a>
  RAID driver the driver will not properly synchronize the cache to the logical volumes
--- 229,236 ----
  <p>
  
  <li><a name="arc"></a>
! <font color="#009000"><strong>004: RELIABILITY FIX: November 7, 2006</strong></font>
! &nbsp; <i>All architectures</i><br>
  Due to a bug in the
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=arc&amp;sektion=4">arc(4)</a>
  RAID driver the driver will not properly synchronize the cache to the logical volumes
***************
*** 230,236 ****
  <p>
  
  <li><a name="systrace"></a>
! <font color="#009000"><strong>003: SECURITY FIX: November 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
  Fix for an integer overflow in
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&amp;sektion=4">systrace(4)</a>'s
  STRIOCREPLACE support, found by
--- 243,250 ----
  <p>
  
  <li><a name="systrace"></a>
! <font color="#009000"><strong>003: SECURITY FIX: November 4, 2006</strong></font>
! &nbsp; <i>All architectures</i><br>
  Fix for an integer overflow in
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&amp;sektion=4">systrace(4)</a>'s
  STRIOCREPLACE support, found by
***************
*** 242,248 ****
  <p>
  
  <li><a name="openssl2"></a>
! <font color="#009000"><strong>002: SECURITY FIX: November 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
  Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
  structures an error condition is mishandled, possibly resulting in an infinite
  loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
--- 256,263 ----
  <p>
  
  <li><a name="openssl2"></a>
! <font color="#009000"><strong>002: SECURITY FIX: November 4, 2006</strong></font>
! &nbsp; <i>All architectures</i><br>
  Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
  structures an error condition is mishandled, possibly resulting in an infinite
  loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
***************
*** 260,266 ****
  <p>
  
  <li><a name="httpd"></a>
! <font color="#009000"><strong>001: SECURITY FIX: November 4, 2006</strong></font> &nbsp; <i>All architectures</i><br>
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>
  does not sanitize the Expect header from an HTTP request when it is
  reflected back in an error message, which might allow cross-site scripting (XSS)
--- 275,282 ----
  <p>
  
  <li><a name="httpd"></a>
! <font color="#009000"><strong>001: SECURITY FIX: November 4, 2006</strong></font>
! &nbsp; <i>All architectures</i><br>
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=httpd&amp;sektion=8">httpd(8)</a>
  does not sanitize the Expect header from an HTTP request when it is
  reflected back in an error message, which might allow cross-site scripting (XSS)