===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/errata56.html,v
retrieving revision 1.6
retrieving revision 1.7
diff -c -r1.6 -r1.7
*** www/errata56.html 2014/11/17 17:57:18 1.6
--- www/errata56.html 2014/11/17 19:55:00 1.7
***************
*** 149,154 ****
--- 149,166 ----
A source code patch exists which remedies this problem.
+
+ 007: SECURITY FIX: November 17, 2014
+ All architectures
+ PF rules of the form "pass from {192.0.2.1 2001:db8::1} to (pppoe0)" will
+ apply an incorrect /32 mask to the dynamic IPv6 address, allowing access to
+ a wide address range rather than the intended single host.
+ As a workaround, list the IPv4 address last, i.e. "{2001:db8::1 192.0.2.1}".
+
+
+ A source code patch exists which remedies this problem.
+
+