===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/errata42.html,v
retrieving revision 1.66
retrieving revision 1.67
diff -c -r1.66 -r1.67
*** www/errata42.html	2019/05/27 22:55:20	1.66
--- www/errata42.html	2019/05/28 16:32:42	1.67
***************
*** 85,190 ****
  
  <ul>
  
! <li id="p015_ndp">
! <strong>015: SECURITY FIX: October 2, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! The Neighbor Discovery Protocol (ndp) did not correctly verify neighbor
! solicitation requests maybe allowing a nearby attacker to intercept traffic.
! The attacker must have IPv6 connectivity to the same router as their target for
! this vulnerability to be exploited.
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476">CVE-2008-2476</a>.
  <br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/015_ndp.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
! 
! <li id="p014_pcb">
! <strong>014: RELIABILITY FIX: July 29, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! Some kinds of IPv6 usage would leak kernel memory (in particular, this path
! was exercised by the named(8) patch for port randomization).  Since INET6 is
! enabled by default, this condition affects all systems.
! <br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/014_pcb.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p013_bind">
! <strong>013: SECURITY FIX: July 23, 2008</strong>
! &nbsp; <i>All architectures</i><br>
! <b>2nd revision, July 23, 2008</b><br>
! A vulnerability has been found with BIND. An attacker could use this vulnerability
! to poison the cache of a recursive resolving name server.
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a>.
  <br>
- <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/013_bind.patch">
- A source code patch exists which remedies this problem.</a>
- <p>
  
! <li id="p012_xorg2">
! <strong>012: SECURITY FIX: July 15, 2008</strong>
! &nbsp; <i>All architectures</i><br>
! Multiple vulnerabilities have been discovered in X.Org.<br>
! RENDER Extension heap buffer overflow,
! RENDER Extension crash,
! RENDER Extension memory corruption,
! MIT-SHM arbitrary memory read,
! RECORD and Security extensions memory corruption.
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</a>,
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</a>,
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</a>,
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</a>,
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</a>.
! <br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/012_xorg2.patch">
! A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p011_openssh2">
! <strong>011: SECURITY FIX: April 3, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! Avoid possible hijacking of X11-forwarded connections with sshd(8)
! by refusing to listen on a port unless all address families bind
! successfully.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/011_openssh2.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p010_openssh">
! <strong>010: SECURITY FIX: March 30, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>
! directive was in effect, allowing users with write access to this file to
! execute arbitrary commands. This behaviour was documented, but was an unsafe
! default and an extra hassle for administrators.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/010_openssh.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
- <li id="p009_ppp">
- <strong>009: SECURITY FIX: March 7, 2008</strong>
- &nbsp; <i>All architectures</i><br>
- Buffer overflow in ppp command prompt parsing.<br>
- <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/009_ppp.patch">
- A source code patch exists which remedies this problem.</a>
- <p>
- 
- <li id="p008_ip6rthdr">
- <strong>008: RELIABILITY FIX: February 25, 2008</strong>
- &nbsp; <i>All architectures</i><br>
- Malformed IPv6 routing headers can cause a kernel panic.<br>
- <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/008_ip6rthdr.patch">
- A source code patch exists which remedies this problem.</a>
- <p>
- 
- <li id="p007_tcprespond">
- <strong>007: RELIABILITY FIX: February 22, 2008</strong>
- &nbsp; <i>All architectures</i><br>
- Incorrect assumptions in tcp_respond can lead to a kernel panic.<br>
- <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/007_tcprespond.patch">
- A source code patch exists which remedies this problem.</a>
- <p>
- 
  <li id="p006_xorg">
  <strong>006: SECURITY FIX: February 8, 2008</strong>
  &nbsp; <i>All architectures</i><br>
--- 85,144 ----
  
  <ul>
  
! <li id="p001_dhcpd">
! <strong>001: SECURITY FIX: October 8, 2007</strong>
  &nbsp; <i>All architectures</i><br>
! Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>
! A DHCP client that claimed to require a maximum message size less than
! the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.
  <br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/001_dhcpd.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
! <li id="p002_openssl">
! <strong>002: SECURITY FIX: October 10, 2007</strong>
  &nbsp; <i>All architectures</i><br>
! The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/002_openssl.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p003_i386_boot">
! <strong>003: CD BOOT FAILURE ON OLDER COMPUTERS : October 30, 2007</strong>
! &nbsp; <i>i386 only</i><br>
! Some older BIOSes are unable to boot CD1 (ie. the commercial release sold
! by the project, not the CD images available on the net).
! A workaround using CD2 (amd64 architecture) is as follows.
! (An amd64 machine is <i>NOT</i> required for this to work.)<br>
  <br>
  
! <ol>
! <li>Insert CD2 and tell your computer to boot it;<br>
! <li>When the <code>boot></code> prompt appears, stop the automatic boot
! by pressing the space bar;<br>
! <li>Remove CD2 and insert CD1;<br>
! <li>Erase the character you typed to stop the boot, type<br>
! <code><b>boot /4.2/i386/bsd.rd</b></code><br>
! then press <i>Enter</i>.
! </ol>
  <p>
  
! <li id="p004_pf">
! <strong>004: RELIABILITY FIX: November 27, 2007</strong>
  &nbsp; <i>All architectures</i><br>
! A memory leak in pf can lead to machine lockups.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/004_pf.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p005_ifrtlabel">
! <strong>005: RELIABILITY FIX: January 11, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! A missing NULL pointer check can lead to a kernel panic.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/005_ifrtlabel.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
  <li id="p006_xorg">
  <strong>006: SECURITY FIX: February 8, 2008</strong>
  &nbsp; <i>All architectures</i><br>
***************
*** 207,265 ****
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p005_ifrtlabel">
! <strong>005: RELIABILITY FIX: January 11, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! A missing NULL pointer check can lead to a kernel panic.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/005_ifrtlabel.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p004_pf">
! <strong>004: RELIABILITY FIX: November 27, 2007</strong>
  &nbsp; <i>All architectures</i><br>
! A memory leak in pf can lead to machine lockups.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/004_pf.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p003_i386_boot">
! <strong>003: CD BOOT FAILURE ON OLDER COMPUTERS : October 30, 2007</strong>
! &nbsp; <i>i386 only</i><br>
! Some older BIOSes are unable to boot CD1 (ie. the commercial release sold
! by the project, not the CD images available on the net).
! A workaround using CD2 (amd64 architecture) is as follows.
! (An amd64 machine is <i>NOT</i> required for this to work.)<br>
! <br>
  
! <ol>
! <li>Insert CD2 and tell your computer to boot it;<br>
! <li>When the <code>boot></code> prompt appears, stop the automatic boot
! by pressing the space bar;<br>
! <li>Remove CD2 and insert CD1;<br>
! <li>Erase the character you typed to stop the boot, type<br>
! <code><b>boot /4.2/i386/bsd.rd</b></code><br>
! then press <i>Enter</i>.
! </ol>
  
  <p>
  
! <li id="p002_openssl">
! <strong>002: SECURITY FIX: October 10, 2007</strong>
  &nbsp; <i>All architectures</i><br>
! The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/002_openssl.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p001_dhcpd">
! <strong>001: SECURITY FIX: October 8, 2007</strong>
  &nbsp; <i>All architectures</i><br>
! Malicious DHCP clients could cause dhcpd(8) to corrupt its stack<br>
! A DHCP client that claimed to require a maximum message size less than
! the minimum IP MTU could cause dhcpd(8) to overwrite stack memory.
  <br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/001_dhcpd.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
--- 161,265 ----
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p007_tcprespond">
! <strong>007: RELIABILITY FIX: February 22, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! Incorrect assumptions in tcp_respond can lead to a kernel panic.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/007_tcprespond.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p008_ip6rthdr">
! <strong>008: RELIABILITY FIX: February 25, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! Malformed IPv6 routing headers can cause a kernel panic.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/008_ip6rthdr.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p009_ppp">
! <strong>009: SECURITY FIX: March 7, 2008</strong>
! &nbsp; <i>All architectures</i><br>
! Buffer overflow in ppp command prompt parsing.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/009_ppp.patch">
! A source code patch exists which remedies this problem.</a>
! <p>
  
! <li id="p010_openssh">
! <strong>010: SECURITY FIX: March 30, 2008</strong>
! &nbsp; <i>All architectures</i><br>
! sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>
! directive was in effect, allowing users with write access to this file to
! execute arbitrary commands. This behaviour was documented, but was an unsafe
! default and an extra hassle for administrators.<br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/010_openssh.patch">
! A source code patch exists which remedies this problem.</a>
! <p>
  
+ <li id="p011_openssh2">
+ <strong>011: SECURITY FIX: April 3, 2008</strong>
+ &nbsp; <i>All architectures</i><br>
+ Avoid possible hijacking of X11-forwarded connections with sshd(8)
+ by refusing to listen on a port unless all address families bind
+ successfully.<br>
+ <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/011_openssh2.patch">
+ A source code patch exists which remedies this problem.</a>
  <p>
  
! 
! <li id="p012_xorg2">
! <strong>012: SECURITY FIX: July 15, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! Multiple vulnerabilities have been discovered in X.Org.<br>
! RENDER Extension heap buffer overflow,
! RENDER Extension crash,
! RENDER Extension memory corruption,
! MIT-SHM arbitrary memory read,
! RECORD and Security extensions memory corruption.
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</a>,
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</a>,
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</a>,
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</a>,
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</a>.
! <br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/012_xorg2.patch">
  A source code patch exists which remedies this problem.</a>
  <p>
  
! <li id="p013_bind">
! <strong>013: SECURITY FIX: July 23, 2008</strong>
  &nbsp; <i>All architectures</i><br>
! <b>2nd revision, July 23, 2008</b><br>
! A vulnerability has been found with BIND. An attacker could use this vulnerability
! to poison the cache of a recursive resolving name server.
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a>.
  <br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/013_bind.patch">
! A source code patch exists which remedies this problem.</a>
! <p>
! 
! 
! <li id="p014_pcb">
! <strong>014: RELIABILITY FIX: July 29, 2008</strong>
! &nbsp; <i>All architectures</i><br>
! Some kinds of IPv6 usage would leak kernel memory (in particular, this path
! was exercised by the named(8) patch for port randomization).  Since INET6 is
! enabled by default, this condition affects all systems.
! <br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/014_pcb.patch">
! A source code patch exists which remedies this problem.</a>
! <p>
! 
! <li id="p015_ndp">
! <strong>015: SECURITY FIX: October 2, 2008</strong>
! &nbsp; <i>All architectures</i><br>
! The Neighbor Discovery Protocol (ndp) did not correctly verify neighbor
! solicitation requests maybe allowing a nearby attacker to intercept traffic.
! The attacker must have IPv6 connectivity to the same router as their target for
! this vulnerability to be exploited.
! <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476">CVE-2008-2476</a>.
! <br>
! <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/015_ndp.patch">
  A source code patch exists which remedies this problem.</a>
  <p>