===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/errata53.html,v
retrieving revision 1.23
retrieving revision 1.24
diff -c -r1.23 -r1.24
*** www/errata53.html	2014/03/31 03:12:47	1.23
--- www/errata53.html	2014/03/31 16:02:48	1.24
***************
*** 77,83 ****
  
  <ul>
  <li><a name="001_bgpd"></a>
! <font color="#009000"><strong>001: RELIABILITY FIX: March 15, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  A rare condition during session startup may cause bgpd to replace
  an active session leading to unknown consequences.  Bug found by
  inspection (we do not know how to reproduce it, consider that a challenge).
--- 77,84 ----
  
  <ul>
  <li><a name="001_bgpd"></a>
! <font color="#009000"><strong>001: RELIABILITY FIX: March 15, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  A rare condition during session startup may cause bgpd to replace
  an active session leading to unknown consequences.  Bug found by
  inspection (we do not know how to reproduce it, consider that a challenge).
***************
*** 88,94 ****
  <p>
  
  <li><a name="002_vr"></a>
! <font color="#009000"><strong>002: RELIABILITY FIX: May 5, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  A flaw exists in the <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=vr&sektion=4"
  >vr(4)</a> driver that may cause it to not recover from some error conditions.
  
--- 89,96 ----
  <p>
  
  <li><a name="002_vr"></a>
! <font color="#009000"><strong>002: RELIABILITY FIX: May 5, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  A flaw exists in the <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=vr&sektion=4"
  >vr(4)</a> driver that may cause it to not recover from some error conditions.
  
***************
*** 98,104 ****
  <p>
  
  <li><a name="003_nginx"></a>
! <font color="#009000"><strong>003: RELIABILITY FIX: May 17, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  A problem exists in
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=nginx&sektion=8">nginx(8)</a>
  if proxy_pass is used with untrusted HTTP backend servers.
--- 100,107 ----
  <p>
  
  <li><a name="003_nginx"></a>
! <font color="#009000"><strong>003: RELIABILITY FIX: May 17, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  A problem exists in
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=nginx&sektion=8">nginx(8)</a>
  if proxy_pass is used with untrusted HTTP backend servers.
***************
*** 112,118 ****
  <p>
  
  <li><a name="004_route"></a>
! <font color="#009000"><strong>004: RELIABILITY FIX: May 17, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  As discovered by Peter Philipp, it is possible for an unprivileged user
  process to trigger deleting the undeletable RNF_ROOT route, resulting in
  a kernel panic.
--- 115,122 ----
  <p>
  
  <li><a name="004_route"></a>
! <font color="#009000"><strong>004: RELIABILITY FIX: May 17, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  As discovered by Peter Philipp, it is possible for an unprivileged user
  process to trigger deleting the undeletable RNF_ROOT route, resulting in
  a kernel panic.
***************
*** 123,129 ****
  <p>
  
  <li><a name="005_in6"></a>
! <font color="#009000"><strong>005: RELIABILITY FIX: May 31, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  A local denial of service is possible by an unprivileged user if the
  SIOCSIFADDR ioctl is performed upon an AF_INET6 socket with a specially
  crafted parameter.
--- 127,134 ----
  <p>
  
  <li><a name="005_in6"></a>
! <font color="#009000"><strong>005: RELIABILITY FIX: May 31, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  A local denial of service is possible by an unprivileged user if the
  SIOCSIFADDR ioctl is performed upon an AF_INET6 socket with a specially
  crafted parameter.
***************
*** 133,139 ****
  <p>
  
  <li><a name="006_tftpd"></a>
! <font color="#009000"><strong>006: RELIABILITY FIX: June 12, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  A denial of services was discovered where certain combinations of
  TFTP options could cause OACK generation to fail, which in turn
  caused a double free in tftpd.
--- 138,145 ----
  <p>
  
  <li><a name="006_tftpd"></a>
! <font color="#009000"><strong>006: RELIABILITY FIX: June 12, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  A denial of services was discovered where certain combinations of
  TFTP options could cause OACK generation to fail, which in turn
  caused a double free in tftpd.
***************
*** 143,149 ****
  <p>
  
  <li><a name="007_vio"></a>
! <font color="#009000"><strong>007: RELIABILITY FIX: June 12, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  Two flaws in the <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=vio&sektion=4">vio(4)</a>
  driver may cause a kernel panic, and may cause IPv6 neighbour discovery to fail
  due to multicast receive problems.<br>
--- 149,156 ----
  <p>
  
  <li><a name="007_vio"></a>
! <font color="#009000"><strong>007: RELIABILITY FIX: June 12, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  Two flaws in the <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=vio&sektion=4">vio(4)</a>
  driver may cause a kernel panic, and may cause IPv6 neighbour discovery to fail
  due to multicast receive problems.<br>
***************
*** 152,158 ****
  <p>
  
  <li><a name="008_pflow"></a>
! <font color="#009000"><strong>008: RELIABILITY FIX: Nov 7, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  A crash can happen on pflow(4) interface destruction.
  
  <br>
--- 159,166 ----
  <p>
  
  <li><a name="008_pflow"></a>
! <font color="#009000"><strong>008: RELIABILITY FIX: Nov 7, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  A crash can happen on pflow(4) interface destruction.
  
  <br>
***************
*** 161,167 ****
  <p>
  
  <li><a name="009_sshgcm"></a>
! <font color="#009000"><strong>009: SECURITY FIX: Nov 7, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  A memory corruption vulnerability exists in the post-authentication sshd process
  when an AES-GCM cipher (aes128-gcm@openssh.com or aes256-gcm@openssh.com) is
  selected during kex exchange.
--- 169,176 ----
  <p>
  
  <li><a name="009_sshgcm"></a>
! <font color="#009000"><strong>009: SECURITY FIX: Nov 7, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  A memory corruption vulnerability exists in the post-authentication sshd process
  when an AES-GCM cipher (aes128-gcm@openssh.com or aes256-gcm@openssh.com) is
  selected during kex exchange.
***************
*** 175,181 ****
  
  
  <li><a name="010_vnode"></a>
! <font color="#009000"><strong>010: RELIABILITY FIX: Nov 11, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  An unprivileged user may hang the system.
  
  <br>
--- 184,191 ----
  
  
  <li><a name="010_vnode"></a>
! <font color="#009000"><strong>010: RELIABILITY FIX: Nov 11, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  An unprivileged user may hang the system.
  
  <br>
***************
*** 184,190 ****
  <p>
  
  <li><a name="011_nginx"></a>
! <font color="#009000"><strong>011: SECURITY FIX: Nov 21, 2013</strong></font> &nbsp; <i>All architectures</i><br>
  A problem exists in
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=nginx&sektion=8">nginx(8)</a>
  which might allow an attacker to bypass security restrictions in certain
--- 194,201 ----
  <p>
  
  <li><a name="011_nginx"></a>
! <font color="#009000"><strong>011: SECURITY FIX: Nov 21, 2013</strong></font>
! &nbsp; <i>All architectures</i><br>
  A problem exists in
  <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=nginx&sektion=8">nginx(8)</a>
  which might allow an attacker to bypass security restrictions in certain
***************
*** 196,202 ****
  <p>
  
  <li><a name="012_sha512"></a>
! <font color="#009000"><strong>012: RELIABILITY FIX: Dec 19, 2013</strong></font> &nbsp; <i>Strict alignment architectures</i><br>
  In OpenSSL, use of the SHA384 SSL/TLS ciphers may result in a crash of
  the application.  The i386, amd64, vax and m68k platforms aren't
  affected.
--- 207,214 ----
  <p>
  
  <li><a name="012_sha512"></a>
! <font color="#009000"><strong>012: RELIABILITY FIX: Dec 19, 2013</strong></font>
! &nbsp; <i>Strict alignment architectures</i><br>
  In OpenSSL, use of the SHA384 SSL/TLS ciphers may result in a crash of
  the application.  The i386, amd64, vax and m68k platforms aren't
  affected.
***************
*** 206,212 ****
  <p>
  
  <li><a name="013_libXfont"></a>
! <font color="#009000"><strong>013: SECURITY FIX: Jan 10, 2014</strong></font> &nbsp; <i>All architectures</i><br>
  A BDF font file containing a longer than expected string could overflow
  a buffer on the stack in the X server.
  This issue was assigned CVE-2013-6462.
--- 218,225 ----
  <p>
  
  <li><a name="013_libXfont"></a>
! <font color="#009000"><strong>013: SECURITY FIX: Jan 10, 2014</strong></font>
! &nbsp; <i>All architectures</i><br>
  A BDF font file containing a longer than expected string could overflow
  a buffer on the stack in the X server.
  This issue was assigned CVE-2013-6462.