[BACK]Return to errata41.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata41.html between version 1.63 and 1.64

version 1.63, 2019/05/27 22:55:20 version 1.64, 2019/05/28 16:32:42
Line 85 
Line 85 
   
 <ul>  <ul>
   
 <li id="p016_openssh2">  <li id="p001_mbuf">
 <strong>016: SECURITY FIX: April 3, 2008</strong>  <strong>001: SECURITY FIX: April 27, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Avoid possible hijacking of X11-forwarded connections with sshd(8)  Incorrect mbuf handling for ICMP6 packets.<br>
 by refusing to listen on a port unless all address families bind  Using
 successfully.<br>  <a href="https://man.openbsd.org/OpenBSD-4.1/pf.4">pf(4)</a>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/016_openssh2.patch">  to avoid the problem packets is an effective workaround until the patch
   can be installed.<br>
   Use "block in inet6" in /etc/pf.conf
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/001_mbuf.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p015_openssh">  <li id="p002_splnet">
 <strong>015: SECURITY FIX: March 30, 2008</strong>  <strong>002: STABILITY FIX: April 27, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>  Incorrect spl level can lead to panics under heavy kqueue usage.<br>
 directive was in effect, allowing users with write access to this file to  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/002_splnet.patch">
 execute arbitrary commands. This behaviour was documented, but was an unsafe  
 default and an extra hassle for administrators.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/015_openssh.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p014_ppp">  <li id="p003_spamd">
 <strong>014: SECURITY FIX: March 7, 2008</strong>  <strong>003: RELIABILITY FIX: April 27, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Buffer overflow in ppp command prompt parsing.<br>  Bugs found in the spamd sychronization mechanism could cause corrupted
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/014_ppp.patch">  databases.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/003_spamd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p013_tcprespond">  <li id="p004_xorg">
 <strong>013: RELIABILITY FIX: February 22, 2008</strong>  <strong>004: SECURITY FIX: April 27, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Incorrect assumptions in tcp_respond can lead to a kernel panic.<br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/013_tcprespond.patch">  
 A source code patch exists which remedies this problem.</a>  
 <p>  
   
 <li id="p012_xorg">  
 <strong>012: SECURITY FIX: February 8, 2008</strong>  
 &nbsp; <i>All architectures</i><br>  
 <b>2nd revision, February 10, 2008</b><br>  
 Multiple vulnerabilities have been discovered in X.Org.<br>  Multiple vulnerabilities have been discovered in X.Org.<br>
 XFree86 Misc extension out of bounds array index,  XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,
 File existence disclosure,  BDFFont parsing integer overflow vulnerability,
 Xinput extension memory corruption,  fonts.dir file parsing integer overflow vulnerability,
 TOG-cup extension memory corruption,  multiple integer overflows in the XGetPixel() and XInitImage functions
 MIT-SHM and EVI extensions integer overflows,  in ImUtil.c.
 PCF Font parser buffer overflow.  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003">CVE-2007-1003</a>,
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760">CVE-2007-5760</a>,  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351">CVE-2007-1351</a>,
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5958">CVE-2007-5958</a>,  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352">CVE-2007-1352</a>,
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427">CVE-2007-6427</a>,  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667">CVE-2007-1667</a>.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428">CVE-2007-6428</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429">CVE-2007-6429</a>,  
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0006">CVE-2008-0006</a>.  
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/012_xorg.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/004_xorg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p011_openssl">  <li id="p005_route6">
 <strong>011: SECURITY FIX: October 10, 2007</strong>  <strong>005: SECURITY FIX: April 27, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.  IPv6 type 0 route headers can be used to mount a DoS attack against
 <br>  hosts and networks.  This is a design flaw in IPv6 and not a bug in
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/011_openssl.patch">  OpenBSD.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/005_route6.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p010_dhcpd">  <li id="p006_altivec">
 <strong>010: SECURITY FIX: October 8, 2007</strong>  <strong>006: STABILITY FIX: April 27, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>PowerPC</i><br>
 Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>  An unhandled AltiVec assist exception can cause a kernel panic.<br>
 A DHCP client that claimed to require a maximum message size less than  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/macppc/006_altivec.patch">
 the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.  
 <br>  
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/010_dhcpd.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p009_file">  <li id="p007_kroute">
 <strong>009: SECURITY FIX: July 9, 2007</strong>  <strong>007: RELIABILITY FIX: April 30, 2007</strong>
 &nbsp; <i>All Architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix possible heap overflow in file(1), aka CVE-2007-1536.<br>  Link state is not correctly tracked in ospfd and ripd.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/009_file.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/007_kroute.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Line 180 
Line 168 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p007_kroute">  <li id="p009_file">
 <strong>007: RELIABILITY FIX: April 30, 2007</strong>  <strong>009: SECURITY FIX: July 9, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All Architectures</i><br>
 Link state is not correctly tracked in ospfd and ripd.<br>  Fix possible heap overflow in file(1), aka CVE-2007-1536.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/007_kroute.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/009_file.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p006_altivec">  <li id="p010_dhcpd">
 <strong>006: STABILITY FIX: April 27, 2007</strong>  <strong>010: SECURITY FIX: October 8, 2007</strong>
 &nbsp; <i>PowerPC</i><br>  &nbsp; <i>All architectures</i><br>
 An unhandled AltiVec assist exception can cause a kernel panic.<br>  Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/macppc/006_altivec.patch">  A DHCP client that claimed to require a maximum message size less than
   the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.
   <br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/010_dhcpd.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p005_route6">  <li id="p011_openssl">
 <strong>005: SECURITY FIX: April 27, 2007</strong>  <strong>011: SECURITY FIX: October 10, 2007</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 IPv6 type 0 route headers can be used to mount a DoS attack against  The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.
 hosts and networks.  This is a design flaw in IPv6 and not a bug in  <br>
 OpenBSD.<br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/011_openssl.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/005_route6.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p004_xorg">  <li id="p012_xorg">
 <strong>004: SECURITY FIX: April 27, 2007</strong>  <strong>012: SECURITY FIX: February 8, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
   <b>2nd revision, February 10, 2008</b><br>
 Multiple vulnerabilities have been discovered in X.Org.<br>  Multiple vulnerabilities have been discovered in X.Org.<br>
 XC-MISC extension ProcXCMiscGetXIDList memory corruption vulnerability,  XFree86 Misc extension out of bounds array index,
 BDFFont parsing integer overflow vulnerability,  File existence disclosure,
 fonts.dir file parsing integer overflow vulnerability,  Xinput extension memory corruption,
 multiple integer overflows in the XGetPixel() and XInitImage functions  TOG-cup extension memory corruption,
 in ImUtil.c.  MIT-SHM and EVI extensions integer overflows,
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003">CVE-2007-1003</a>,  PCF Font parser buffer overflow.
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351">CVE-2007-1351</a>,  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760">CVE-2007-5760</a>,
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352">CVE-2007-1352</a>,  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5958">CVE-2007-5958</a>,
 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667">CVE-2007-1667</a>.  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427">CVE-2007-6427</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428">CVE-2007-6428</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429">CVE-2007-6429</a>,
   <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0006">CVE-2008-0006</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/004_xorg.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/012_xorg.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p003_spamd">  <li id="p013_tcprespond">
 <strong>003: RELIABILITY FIX: April 27, 2007</strong>  <strong>013: RELIABILITY FIX: February 22, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Bugs found in the spamd sychronization mechanism could cause corrupted  Incorrect assumptions in tcp_respond can lead to a kernel panic.<br>
 databases.<br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/013_tcprespond.patch">
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/003_spamd.patch">  
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p002_splnet">  <li id="p014_ppp">
 <strong>002: STABILITY FIX: April 27, 2007</strong>  <strong>014: SECURITY FIX: March 7, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Incorrect spl level can lead to panics under heavy kqueue usage.<br>  Buffer overflow in ppp command prompt parsing.<br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/002_splnet.patch">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/014_ppp.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="p001_mbuf">  <li id="p015_openssh">
 <strong>001: SECURITY FIX: April 27, 2007</strong>  <strong>015: SECURITY FIX: March 30, 2008</strong>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Incorrect mbuf handling for ICMP6 packets.<br>  sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>
 Using  directive was in effect, allowing users with write access to this file to
 <a href="https://man.openbsd.org/OpenBSD-4.1/pf.4">pf(4)</a>  execute arbitrary commands. This behaviour was documented, but was an unsafe
 to avoid the problem packets is an effective workaround until the patch  default and an extra hassle for administrators.<br>
 can be installed.<br>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/015_openssh.patch">
 Use "block in inet6" in /etc/pf.conf  A source code patch exists which remedies this problem.</a>
 <br>  <p>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/001_mbuf.patch">  
   <li id="p016_openssh2">
   <strong>016: SECURITY FIX: April 3, 2008</strong>
   &nbsp; <i>All architectures</i><br>
   Avoid possible hijacking of X11-forwarded connections with sshd(8)
   by refusing to listen on a port unless all address families bind
   successfully.<br>
   <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.1/common/016_openssh2.patch">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
Legend:
Removed from v.1.63  
changed lines
  Added in v.1.64