=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/errata40.html,v retrieving revision 1.68 retrieving revision 1.69 diff -c -r1.68 -r1.69 *** www/errata40.html 2019/05/27 22:55:20 1.68 --- www/errata40.html 2019/05/28 16:32:42 1.69 *************** *** 82,194 **** -stable branch.

! 017: SECURITY FIX: October 10, 2007 All architectures
! The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.
! A source code patch exists which remedies this problem.
!
! 016: SECURITY FIX: October 8, 2007 All architectures
! Malicious DHCP clients could cause dhcpd(8) to corrupt its stack
! A DHCP client that claimed to require a maximum message size less than ! the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.
! A source code patch exists which remedies this problem.
!
! 015: SECURITY FIX: July 9, 2007 ! All Architectures
! Fix possible heap overflow in file(1), aka CVE-2007-1536.
! ! A source code patch exists which remedies this problem. !
! !
! 014: STABILITY FIX: May 9, 2007 ! All Architectures
! A malicious client can cause a division by zero.
! ! A source code patch exists which remedies this problem. !
! !
! 013: STABILITY FIX: April 26, 2007 ! PowerPC
! An unhandled AltiVec assist exception can cause a kernel panic.
! ! A source code patch exists which remedies this problem. !
! !
! 012: SECURITY FIX: April 23, 2007 All architectures
! IPv6 type 0 route headers can be used to mount a DoS attack against ! hosts and networks. This is a design flaw in IPv6 and not a bug in ! OpenBSD.
! A source code patch exists which remedies this problem.
!
! 011: SECURITY FIX: April 4, 2007 All architectures
! Multiple vulnerabilities have been discovered in X.Org.
! XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability, ! BDFFont parsing integer overflow vulnerability, ! fonts.dir file parsing integer overflow vulnerability, ! multiple integer overflows in the XGetPixel() and XInitImage functions ! in ImUtil.c. ! CVE-2007-1003, ! CVE-2007-1351, ! CVE-2007-1352, ! CVE-2007-1667.
! A source code patch exists which remedies this problem.
!
! 010: SECURITY FIX: March 7, 2007 All architectures
! 2nd revision, March 17, 2007
! Incorrect mbuf handling for ICMP6 packets.
! Using ! pf(4) ! to avoid the problem packets is an effective workaround until the patch ! can be installed.
! Use "block in inet6" in /etc/pf.conf
! A source code patch exists which remedies this problem.
!
! 009: INTEROPERABILITY FIX: February 4, 2007 All architectures
! A US daylight saving time rules change takes effect in 2007.
! ! A source code patch exists which syncs the timezone data files with tzdata2007a.
!
! !
! 008: RELIABILITY FIX: January 16, 2007 ! All architectures
! Under some circumstances, processing an ICMP6 echo request would cause ! the kernel to enter an infinite loop.
- - A source code patch exists which remedies this problem.
--- 82,174 ---- -stable branch.
- ! 001: SECURITY FIX: November 4, 2006 All architectures
  ! httpd(8) ! does not sanitize the Expect header from an HTTP request when it is ! reflected back in an error message, which might allow cross-site scripting (XSS) ! style attacks. ! CVE-2006-3918
  ! A source code patch exists which remedies this problem.
  !
- ! 002: SECURITY FIX: November 4, 2006 All architectures
  ! Several problems have been found in OpenSSL. While parsing certain invalid ASN.1 ! structures an error condition is mishandled, possibly resulting in an infinite ! loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL ! pointer may be dereferenced in the SSL version 2 client code. In addition, many ! applications using OpenSSL do not perform any validation of the lengths of ! public keys being used. ! CVE-2006-2937, ! CVE-2006-3738, ! CVE-2006-4343, ! CVE-2006-2940
  ! A source code patch exists which remedies this problem.
  !
- ! 003: SECURITY FIX: November 4, 2006 All architectures
  ! Fix for an integer overflow in ! systrace(4)'s ! STRIOCREPLACE support, found by ! Chris Evans. This could be exploited for DoS, limited kmem reads or local ! privilege escalation. !
  ! A source code patch exists which remedies this problem.
  !
- ! 004: RELIABILITY FIX: November 7, 2006 All architectures
  ! Due to a bug in the ! arc(4) ! RAID driver the driver will not properly synchronize the cache to the logical volumes ! upon system shut down. The result being that the mounted file systems within the logical ! volumes will not be properly marked as being clean and fsck will be run for the subsequent ! boot up.
  ! A source code patch exists which remedies this problem.
  !
- ! 005: SECURITY FIX: November 19, 2006 All architectures
  ! The ELF ! ld.so(1) ! fails to properly sanitize the environment. There is a potential localhost security ! problem in cases we have not found yet. This patch applies to all ELF-based ! systems (m68k, m88k, and vax are a.out-based systems).
  ! A source code patch exists which remedies this problem.
  !
- ! 006: FTP DISTRIBUTION ERROR: December 4, 2006 All architectures
  ! The src.tar.gz and ports.tar.gz archives ! released on FTP were created incorrectly, a week after the 4.0 release. The ! archives on the CD sets are correct; this only affects people who downloaded ! them from a mirror.
  ! The archives have been corrected. The correct MD5 of ! ! ports.tar.gz is eff352b4382a7fb7ffce1e8b37e9eb56, and for ! ! src.tar.gz it is b8d7a0dc6f3d27a5377a23d69c40688e.
- *************** *** 206,297 **** A source code patch exists which remedies this problem.
  !
- ! 006: FTP DISTRIBUTION ERROR: December 4, 2006 All architectures
  ! The src.tar.gz and ports.tar.gz archives ! released on FTP were created incorrectly, a week after the 4.0 release. The ! archives on the CD sets are correct; this only affects people who downloaded ! them from a mirror.
  ! The archives have been corrected. The correct MD5 of ! ! ports.tar.gz is eff352b4382a7fb7ffce1e8b37e9eb56, and for ! ! src.tar.gz it is b8d7a0dc6f3d27a5377a23d69c40688e. !
  
  !
- ! 005: SECURITY FIX: November 19, 2006 All architectures
  ! The ELF ! ld.so(1) ! fails to properly sanitize the environment. There is a potential localhost security ! problem in cases we have not found yet. This patch applies to all ELF-based ! systems (m68k, m88k, and vax are a.out-based systems).
  ! ! A source code patch exists which remedies this problem.
  !
- ! 004: RELIABILITY FIX: November 7, 2006 All architectures
  ! Due to a bug in the ! arc(4) ! RAID driver the driver will not properly synchronize the cache to the logical volumes ! upon system shut down. The result being that the mounted file systems within the logical ! volumes will not be properly marked as being clean and fsck will be run for the subsequent ! boot up.
  ! A source code patch exists which remedies this problem.
  !
- ! 003: SECURITY FIX: November 4, 2006 All architectures
  ! Fix for an integer overflow in ! systrace(4)'s ! STRIOCREPLACE support, found by ! Chris Evans. This could be exploited for DoS, limited kmem reads or local ! privilege escalation.
  ! A source code patch exists which remedies this problem.
  !
- ! 002: SECURITY FIX: November 4, 2006 All architectures
  ! Several problems have been found in OpenSSL. While parsing certain invalid ASN.1 ! structures an error condition is mishandled, possibly resulting in an infinite ! loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL ! pointer may be dereferenced in the SSL version 2 client code. In addition, many ! applications using OpenSSL do not perform any validation of the lengths of ! public keys being used. ! CVE-2006-2937, ! CVE-2006-3738, ! CVE-2006-4343, ! CVE-2006-2940 !
  ! A source code patch exists which remedies this problem.
  !
- ! 001: SECURITY FIX: November 4, 2006 All architectures
  ! httpd(8) ! does not sanitize the Expect header from an HTTP request when it is ! reflected back in an error message, which might allow cross-site scripting (XSS) ! style attacks. ! CVE-2006-3918
  ! A source code patch exists which remedies this problem.
  --- 186,294 ---- A source code patch exists which remedies this problem.
  !
- ! 008: RELIABILITY FIX: January 16, 2007 All architectures
  ! Under some circumstances, processing an ICMP6 echo request would cause ! the kernel to enter an infinite loop.
  ! ! A source code patch exists which remedies this problem.
  !
- ! 009: INTEROPERABILITY FIX: February 4, 2007 All architectures
  ! A US daylight saving time rules change takes effect in 2007.
  ! ! A source code patch exists which syncs the timezone data files with tzdata2007a.
  
  !
- ! 010: SECURITY FIX: March 7, 2007 All architectures
  ! 2nd revision, March 17, 2007
  ! Incorrect mbuf handling for ICMP6 packets.
  ! Using ! pf(4) ! to avoid the problem packets is an effective workaround until the patch ! can be installed.
  ! Use "block in inet6" in /etc/pf.conf
  ! A source code patch exists which remedies this problem.
  !
- ! 011: SECURITY FIX: April 4, 2007 All architectures
  ! Multiple vulnerabilities have been discovered in X.Org.
  ! XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability, ! BDFFont parsing integer overflow vulnerability, ! fonts.dir file parsing integer overflow vulnerability, ! multiple integer overflows in the XGetPixel() and XInitImage functions ! in ImUtil.c. ! CVE-2007-1003, ! CVE-2007-1351, ! CVE-2007-1352, ! CVE-2007-1667.
  ! A source code patch exists which remedies this problem.
  !
- ! 012: SECURITY FIX: April 23, 2007 All architectures
  ! IPv6 type 0 route headers can be used to mount a DoS attack against ! hosts and networks. This is a design flaw in IPv6 and not a bug in ! OpenBSD.
  ! ! A source code patch exists which remedies this problem. !
  !
- ! 013: STABILITY FIX: April 26, 2007 ! PowerPC
  ! An unhandled AltiVec assist exception can cause a kernel panic.
  ! A source code patch exists which remedies this problem.
  !
- ! 014: STABILITY FIX: May 9, 2007 ! All Architectures
  ! A malicious client can cause a division by zero.
  ! ! A source code patch exists which remedies this problem. !
  ! !
- ! 015: SECURITY FIX: July 9, 2007 ! All Architectures
  ! Fix possible heap overflow in file(1), aka CVE-2007-1536.
  ! ! A source code patch exists which remedies this problem. !
  ! !
- ! 016: SECURITY FIX: October 8, 2007 All architectures
  ! Malicious DHCP clients could cause dhcpd(8) to corrupt its stack
  ! A DHCP client that claimed to require a maximum message size less than ! the minimum IP MTU could cause dhcpd(8) to overwrite stack memory. !
  ! ! A source code patch exists which remedies this problem. !
  +
- + 017: SECURITY FIX: October 10, 2007 + All architectures
  + The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.
  ! A source code patch exists which remedies this problem.