===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/errata55.html,v
retrieving revision 1.26
retrieving revision 1.27
diff -c -r1.26 -r1.27
*** www/errata55.html 2014/11/17 19:55:00 1.26
--- www/errata55.html 2014/11/17 19:58:52 1.27
***************
*** 220,236 ****
A source code patch exists which remedies this problem.
!
! 013: SECURITY FIX: November 17, 2014
All architectures
! PF rules of the form "pass from {192.0.2.1 2001:db8::1} to (pppoe0)" will
! apply an incorrect /32 mask to the dynamic IPv6 address, allowing access to
! a wide address range rather than the intended single host.
! As a workaround, list the IPv4 address last, i.e. "{2001:db8::1 192.0.2.1}".
!
A source code patch exists which remedies this problem.
--- 220,246 ----
A source code patch exists which remedies this problem.
!
! 014: RELIABILITY FIX: November 17, 2014
All architectures
! A PF rule using an IPv4 address
! followed by an IPv6 address and then a dynamic address, e.g. "pass
! from {192.0.2.1 2001:db8::1} to (pppoe0)", will have an incorrect /32
! mask applied to the dynamic address.
!
A source code patch exists which remedies this problem.
+
+
+ 015: RELIABILITY FIX: November 17, 2014
+ All architectures
+ Querying an invalid hostname with gethostbyname(3) could cause a NULL deref.
+
+
+ A source code patch exists which remedies this problem.
+
+