[BACK]Return to errata55.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/errata55.html between version 1.52 and 1.53

version 1.52, 2017/03/28 04:04:52 version 1.53, 2017/03/28 06:41:18
Line 72 
Line 72 
 <p>  <p>
 Patches for the OpenBSD base system are distributed as unified diffs.  Patches for the OpenBSD base system are distributed as unified diffs.
 Each patch is cryptographically signed with the  Each patch is cryptographically signed with the
 <a href="http://man.openbsd.org/signify">signify(1)</a> tool and contains  <a href="http://man.openbsd.org/OpenBSD-5.5/signify.1">signify(1)</a> tool and contains
 usage instructions.  usage instructions.
 All the following patches are also available in one  All the following patches are also available in one
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.5.tar.gz">tar.gz file</a>  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.5.tar.gz">tar.gz file</a>
Line 86 
Line 86 
   
 <ul>  <ul>
   
 <li id="001_icmp">  <li id="p001_icmp">
 <font color="#009000"><strong>001: RELIABILITY FIX: March 15, 2014</strong></font>  <font color="#009000"><strong>001: RELIABILITY FIX: March 15, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Memory corruption happens during  Memory corruption happens during
Line 96 
Line 96 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="002_openssl">  <li id="p002_openssl">
 <font color="#009000"><strong>002: SECURITY FIX: April 8, 2014</strong></font>  <font color="#009000"><strong>002: SECURITY FIX: April 8, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Missing bounds checking in OpenSSL's implementation of the TLS/DTLS  Missing bounds checking in OpenSSL's implementation of the TLS/DTLS
Line 106 
Line 106 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="003_ftp">  <li id="p003_ftp">
 <font color="#009000"><strong>003: SECURITY FIX: April 9, 2014</strong></font>  <font color="#009000"><strong>003: SECURITY FIX: April 9, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Missing hostname check for HTTPS connections in the  Missing hostname check for HTTPS connections in the
 <a href="http://man.openbsd.org/?query=ftp&manpath=OpenBSD+5.5&sektion=1">ftp(1)</a>  <a href="http://man.openbsd.org/OpenBSD-5.5/ftp.1">ftp(1)</a>
 utility.  utility.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/003_ftp.patch.sig">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/003_ftp.patch.sig">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="004_openssl">  <li id="p004_openssl">
 <font color="#009000"><strong>004: SECURITY FIX: April 12, 2014</strong></font>  <font color="#009000"><strong>004: SECURITY FIX: April 12, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A use-after-free race condition in OpenSSL's read buffer may permit an attacker  A use-after-free race condition in OpenSSL's read buffer may permit an attacker
Line 127 
Line 127 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="005_openssl">  <li id="p005_openssl">
 <font color="#009000"><strong>005: RELIABILITY FIX: May 1, 2014</strong></font>  <font color="#009000"><strong>005: RELIABILITY FIX: May 1, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 An attacker can trigger generation of an SSL alert which could cause  An attacker can trigger generation of an SSL alert which could cause
Line 137 
Line 137 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="006_libXfont">  <li id="p006_libXfont">
 <font color="#009000"><strong>006: SECURITY FIX: May 24, 2014</strong></font>  <font color="#009000"><strong>006: SECURITY FIX: May 24, 2014</strong></font>
 &nbsp; <i>All architectures with X server</i><br>  &nbsp; <i>All architectures with X server</i><br>
 X Font Service Protocol & Font metadata file handling issues in libXfont  X Font Service Protocol & Font metadata file handling issues in libXfont
Line 152 
Line 152 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="007_sendmail">  <li id="p007_sendmail">
 <font color="#009000"><strong>007: SECURITY FIX: June 5, 2014</strong></font>  <font color="#009000"><strong>007: SECURITY FIX: June 5, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Sendmail was not properly closing file descriptions before executing programs.  Sendmail was not properly closing file descriptions before executing programs.
Line 163 
Line 163 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="008_openssl">  <li id="p008_openssl">
 <font color="#009000"><strong>008: SECURITY FIX: June 6, 2014</strong></font>  <font color="#009000"><strong>008: SECURITY FIX: June 6, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 This patch contains a number of SSL library fixes.  This patch contains a number of SSL library fixes.
Line 172 
Line 172 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="009_dhcp">  <li id="p009_dhcp">
 <font color="#009000"><strong>009: RELIABILITY FIX: July 30, 2014</strong></font>  <font color="#009000"><strong>009: RELIABILITY FIX: July 30, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Packets with illegal DHCP options can lead to memory exhaustion of  Packets with illegal DHCP options can lead to memory exhaustion of
 <a href="http://man.openbsd.org/?query=dhclient&amp;sektion=8">dhclient(8)</a>  <a href="http://man.openbsd.org/OpenBSD-5.5/dhclient.8">dhclient(8)</a>
 and  and
 <a href="http://man.openbsd.org/?query=dhcpd&amp;sektion=8">dhcpd(8)</a>.  <a href="http://man.openbsd.org/OpenBSD-5.5/dhcpd.8">dhcpd(8)</a>.
 <br>  <br>
 <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/009_dhcp.patch.sig">  <a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/009_dhcp.patch.sig">
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="010_openssl">  <li id="p010_openssl">
 <font color="#009000"><strong>010: SECURITY FIX: August 9, 2014</strong></font>  <font color="#009000"><strong>010: SECURITY FIX: August 9, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 This patch contains a number of SSL library fixes.  This patch contains a number of SSL library fixes.
Line 193 
Line 193 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="011_nginx">  <li id="p011_nginx">
 <font color="#009000"><strong>011: SECURITY FIX: October 1, 2014</strong></font>  <font color="#009000"><strong>011: SECURITY FIX: October 1, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 nginx can reuse cached SSL sessions in unrelated contexts, allowing virtual  nginx can reuse cached SSL sessions in unrelated contexts, allowing virtual
Line 204 
Line 204 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="012_openssl">  <li id="p012_openssl">
 <font color="#009000"><strong>012: RELIABILITY FIX: October 20, 2014</strong></font>  <font color="#009000"><strong>012: RELIABILITY FIX: October 20, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Two remotely triggerable memory leaks in OpenSSL can lead to a denial of  Two remotely triggerable memory leaks in OpenSSL can lead to a denial of
Line 214 
Line 214 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="013_kernexec">  <li id="p013_kernexec">
 <font color="#009000"><strong>013: RELIABILITY FIX: October 20, 2014</strong></font>  <font color="#009000"><strong>013: RELIABILITY FIX: October 20, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Executable headers with an unaligned address will trigger a kernel panic.  Executable headers with an unaligned address will trigger a kernel panic.
Line 223 
Line 223 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="014_pfctl">  <li id="p014_pfctl">
 <font color="#009000"><strong>014: RELIABILITY FIX: November 17, 2014</strong></font>  <font color="#009000"><strong>014: RELIABILITY FIX: November 17, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 A PF rule using an IPv4 address  A PF rule using an IPv4 address
Line 235 
Line 235 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="015_asr">  <li id="p015_asr">
 <font color="#009000"><strong>015: RELIABILITY FIX: November 17, 2014</strong></font>  <font color="#009000"><strong>015: RELIABILITY FIX: November 17, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Querying an invalid hostname with gethostbyname(3) could cause a NULL deref.  Querying an invalid hostname with gethostbyname(3) could cause a NULL deref.
Line 244 
Line 244 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="016_pipex">  <li id="p016_pipex">
 <font color="#009000"><strong>016: RELIABILITY FIX: December 5, 2014</strong></font>  <font color="#009000"><strong>016: RELIABILITY FIX: December 5, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Several bugs were fixed that allowed a crash from remote when an active pipex  Several bugs were fixed that allowed a crash from remote when an active pipex
Line 254 
Line 254 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="017_pppoe">  <li id="p017_pppoe">
 <font color="#009000"><strong>017: RELIABILITY FIX: December 5, 2014</strong></font>  <font color="#009000"><strong>017: RELIABILITY FIX: December 5, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 An incorrect memcpy call would result in corrupted MAC addresses when  An incorrect memcpy call would result in corrupted MAC addresses when
Line 264 
Line 264 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="018_virtio">  <li id="p018_virtio">
 <font color="#009000"><strong>018: RELIABILITY FIX: December 9, 2014</strong></font>  <font color="#009000"><strong>018: RELIABILITY FIX: December 9, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Several bugs in virtio(4) can lead to hangs with virtio devices,  Several bugs in virtio(4) can lead to hangs with virtio devices,
Line 274 
Line 274 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="019_xserver">  <li id="p019_xserver">
 <font color="#009000"><strong>019: SECURITY FIX: December 9, 2014</strong></font>  <font color="#009000"><strong>019: SECURITY FIX: December 9, 2014</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 One year after Ilja van Sprundel discovered and reported a large number  One year after Ilja van Sprundel discovered and reported a large number
Line 287 
Line 287 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="020_libevent">  <li id="p020_libevent">
 <font color="#009000"><strong>020: SECURITY FIX: January 13, 2015</strong></font>  <font color="#009000"><strong>020: SECURITY FIX: January 13, 2015</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix CVE-2014-6272 in libevent 1.4 event buffer handling.  OpenBSD  Fix CVE-2014-6272 in libevent 1.4 event buffer handling.  OpenBSD
Line 300 
Line 300 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="021_xserver">  <li id="p021_xserver">
 <font color="#009000"><strong>021: SECURITY FIX: March 3, 2015</strong></font>  <font color="#009000"><strong>021: SECURITY FIX: March 3, 2015</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Information leak in the XkbSetGeometry request of X servers.  Information leak in the XkbSetGeometry request of X servers.
Line 312 
Line 312 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="022_freetype">  <li id="p022_freetype">
 <font color="#009000"><strong>022: SECURITY FIX: March 13, 2015</strong></font>  <font color="#009000"><strong>022: SECURITY FIX: March 13, 2015</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Another fix for buffer overflows in malformed fonts.  Another fix for buffer overflows in malformed fonts.
Line 321 
Line 321 
 A source code patch exists which remedies this problem.</a>  A source code patch exists which remedies this problem.</a>
 <p>  <p>
   
 <li id="023_libxfont">  <li id="p023_libxfont">
 <font color="#009000"><strong>023: SECURITY FIX: March 18, 2015</strong></font>  <font color="#009000"><strong>023: SECURITY FIX: March 18, 2015</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Buffer overflows in libXfont  Buffer overflows in libXfont
Line 334 
Line 334 
 <br>Note that the instructions should read <code>cd /usr/xenocara/lib/libXfont</code>.  <br>Note that the instructions should read <code>cd /usr/xenocara/lib/libXfont</code>.
 <p>  <p>
   
 <li id="024_openssl">  <li id="p024_openssl">
 <font color="#009000"><strong>024: SECURITY FIX: March 19, 2015</strong></font>  <font color="#009000"><strong>024: SECURITY FIX: March 19, 2015</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix two possible crash causing defects.<br>  Fix two possible crash causing defects.<br>
Line 349 
Line 349 
 <br>Note that instructions should read <code>cd /usr/src/lib/libssl/crypto</code>.  <br>Note that instructions should read <code>cd /usr/src/lib/libssl/crypto</code>.
 <p>  <p>
   
 <li id="025_smtpd">  <li id="p025_smtpd">
 <font color="#009000"><strong>025: RELIABILITY FIX: April 17, 2015</strong></font>  <font color="#009000"><strong>025: RELIABILITY FIX: April 17, 2015</strong></font>
 &nbsp; <i>All architectures</i><br>  &nbsp; <i>All architectures</i><br>
 Fix a logic error in smtpd handling of SNI.  Fix a logic error in smtpd handling of SNI.
Legend:
Removed from v.1.52  
changed lines
  Added in v.1.53