[BACK]Return to errata43.html CVS log [TXT][DIR] Up to [local] / www
File: [local] / www / errata43.html (download) (as text)

Revision 1.6, Thu Jul 24 06:28:08 2008 UTC (15 years, 10 months ago) by brad
Branch: MAIN
Changes since 1.5: +2 -1 lines 

A second revision of the BIND errata has gone out.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>OpenBSD 4.3 errata</title>
<link rev=made href="mailto:www@openbsd.org">
<meta name="resource-type" content="document">
<meta name="description" content="the OpenBSD CD errata page">
<meta name="keywords" content="openbsd,cd,errata">
<meta name="distribution" content="global">
<meta name="copyright" content="This document copyright 1997-2007 by OpenBSD.">
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
</head>

<body bgcolor="#ffffff" text="#000000" link="#23238E">

<a href="index.html"><img alt="[OpenBSD]" height="30" width="141" src="images/smalltitle.gif" border="0"></a>
<h2><font color="#0000e0">
This is the OpenBSD 4.3 release errata &amp; patch list:

</font></h2>

<hr>
<a href=stable.html>For OpenBSD patch branch information, please refer here.</a><br>
<a href=pkg-stable.html>For important packages updates, please refer here.</a><br>
<br>
For errata on a certain release, click below:<br>
<a href="errata21.html">2.1</a>,
<a href="errata22.html">2.2</a>,
<a href="errata23.html">2.3</a>,
<a href="errata24.html">2.4</a>,
<a href="errata25.html">2.5</a>,
<a href="errata26.html">2.6</a>,
<a href="errata27.html">2.7</a>,
<a href="errata28.html">2.8</a>,
<a href="errata29.html">2.9</a>,
<a href="errata30.html">3.0</a>,
<a href="errata31.html">3.1</a>,
<a href="errata32.html">3.2</a>,
<a href="errata33.html">3.3</a>,
<a href="errata34.html">3.4</a>,
<a href="errata35.html">3.5</a>,
<a href="errata36.html">3.6</a>,
<a href="errata37.html">3.7</a>,
<a href="errata38.html">3.8</a>,
<a href="errata39.html">3.9</a>,
<a href="errata40.html">4.0</a>,
<a href="errata41.html">4.1</a>,
<a href="errata42.html">4.2</a>.
<br>
<hr>

<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3.tar.gz">
You can also fetch a tar.gz file containing all the following patches</a>.
This file is updated once a day.

<p> The patches below are available in CVS via the
<code>OPENBSD_4_3</code> <a href="stable.html">patch branch</a>.

<p>
For more detailed information on how to install patches to OpenBSD, please
consult the <a href="./faq/faq10.html#Patches">OpenBSD FAQ</a>.
<hr>

<!-- Temporarily put anchors for all archs here.  Remove later. -->
<a name="all"></a>
<a name="alpha"></a>
<a name="amd64"></a>
<a name="armish"></a>
<a name="cats"></a>
<a name="hp300"></a>
<a name="hppa"></a>
<a name="i386"></a>
<a name="luna88k"></a>
<a name="mac68k"></a>
<a name="macppc"></a>
<a name="mvme68k"></a>
<a name="mvme88k"></a>
<a name="sgi"></a>
<a name="sparc"></a>
<a name="sparc64"></a>
<a name="vax"></a>
<a name="zaurus"></a>

<ul>

<li><a name="004_bind"></a>
<font color="#009000"><strong>004: SECURITY FIX: July 23, 2008</strong></font> &nbsp; <i>All architectures</i><br>
<strong>2nd revision, July 23, 2008</strong><br>
A vulnerability has been found with BIND. An attacker could use this vulnerability
to poison the cache of a recursive resolving name server.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a>.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/004_bind.patch">
A source code patch exists which remedies this problem</a>.<br>
<p>

<li><a name="003_xorg"></a>
<font color="#009000"><strong>003: SECURITY FIX: July 15, 2008</strong></font> &nbsp; <i>All architectures</i><br>
Multiple vulnerabilities have been discovered in X.Org.<br>
RENDER Extension heap buffer overflow,
RENDER Extension crash,
RENDER Extension memory corruption,
MIT-SHM arbitrary memory read,
RECORD and Security extensions memory corruption.
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2360">CVE-2008-2360</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2361">CVE-2008-2361</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2362">CVE-2008-2362</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1379">CVE-2008-1379</a>,
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1377">CVE-2008-1377</a>.
<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/003_xorg.patch">
A source code patch exists which remedies this problem</a>.<br>
<p>

<li><a name="002_openssh2"></a>
<font color="#009000"><strong>002: SECURITY FIX: April 3, 2008</strong></font> &nbsp; <i>All architectures</i><br>
Avoid possible hijacking of X11-forwarded connections with sshd(8)
by refusing to listen on a port unless all address families bind
successfully.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/002_openssh2.patch">
A source code patch exists which remedies this problem</a>.<br>
<p>

<li><a name="001_openssh"></a>
<font color="#009000"><strong>001: SECURITY FIX: March 30, 2008</strong></font> &nbsp; <i>All architectures</i><br>
sshd(8) would execute ~/.ssh/rc even when a sshd_config(5) <em>ForceCommand</em>
directive was in effect, allowing users with write access to this file to
execute arbitrary commands. This behaviour was documented, but was an unsafe
default and an extra hassle for administrators.<br>
<a href="ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/001_openssh.patch">
A source code patch exists which remedies this problem</a>.<br>
<p>

</ul>

<hr>
<a href=stable.html>For OpenBSD patch branch information, please refer here.</a><br>
<a href=pkg-stable.html>For important packages updates, please refer here.</a><br>
<br>
For errata on a certain release, click below:<br>
<a href="errata21.html">2.1</a>,
<a href="errata22.html">2.2</a>,
<a href="errata23.html">2.3</a>,
<a href="errata24.html">2.4</a>,
<a href="errata25.html">2.5</a>,
<a href="errata26.html">2.6</a>,
<a href="errata27.html">2.7</a>,
<a href="errata28.html">2.8</a>,
<a href="errata29.html">2.9</a>,
<a href="errata30.html">3.0</a>,
<a href="errata31.html">3.1</a>,
<a href="errata32.html">3.2</a>,
<a href="errata33.html">3.3</a>,
<a href="errata34.html">3.4</a>,
<a href="errata35.html">3.5</a>,
<a href="errata36.html">3.6</a>,
<a href="errata37.html">3.7</a>,
<a href="errata38.html">3.8</a>,
<a href="errata39.html">3.9</a>,
<a href="errata40.html">4.0</a>,
<a href="errata41.html">4.1</a>,
<a href="errata42.html">4.2</a>.
<br>

<hr>
<a href=index.html><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a> 
<a href="mailto:www@openbsd.org">www@openbsd.org</a>
<br><small>$OpenBSD: errata43.html,v 1.6 2008/07/24 06:28:08 brad Exp $</small>

</body>
</html>