| version 1.56, 2019/04/02 12:46:57 |
version 1.57, 2019/05/27 22:55:20 |
|
|
| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> |
<!doctype html> |
| <html> |
<html lang=en id=errata> |
| <head> |
<meta charset=utf-8> |
| |
|
| <title>OpenBSD 5.6 Errata</title> |
<title>OpenBSD 5.6 Errata</title> |
| <meta name="description" content="the OpenBSD CD errata page"> |
<meta name="description" content="the OpenBSD CD errata page"> |
| <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> |
|
| <meta name="viewport" content="width=device-width, initial-scale=1"> |
<meta name="viewport" content="width=device-width, initial-scale=1"> |
| <link rel="stylesheet" type="text/css" href="openbsd.css"> |
<link rel="stylesheet" type="text/css" href="openbsd.css"> |
| <link rel="canonical" href="https://www.openbsd.org/errata56.html"> |
<link rel="canonical" href="https://www.openbsd.org/errata56.html"> |
| </head> |
|
| |
|
| <!-- |
<!-- |
| IMPORTANT REMINDER |
IMPORTANT REMINDER |
| IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE |
IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE |
| --> |
--> |
| |
|
| <body bgcolor="#ffffff" text="#000000" link="#23238E"> |
|
| |
|
| <h2> |
<h2 id=OpenBSD> |
| <a href="index.html"> |
<a href="index.html"> |
| <font color="#0000ff"><i>Open</i></font><font color="#000084">BSD</font></a> |
<i>Open</i><b>BSD</b></a> |
| <font color="#e00000">5.6 Errata</font> |
5.6 Errata |
| </h2> |
</h2> |
| <hr> |
<hr> |
| |
|
|
|
| <ul> |
<ul> |
| |
|
| <li id="p001_rxr"> |
<li id="p001_rxr"> |
| <font color="#009000"><strong>001: RELIABILITY FIX: September 5, 2014</strong></font> |
<strong>001: RELIABILITY FIX: September 5, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Incorrect RX ring computation leads to panics under load with bge(4), em(4) and ix(4). |
Incorrect RX ring computation leads to panics under load with bge(4), em(4) and ix(4). |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p002_nd6"> |
<li id="p002_nd6"> |
| <font color="#009000"><strong>002: RELIABILITY FIX: October 1, 2014</strong></font> |
<strong>002: RELIABILITY FIX: October 1, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| If IPv6 autoconf is active on an interface and the autoconfprivacy extension is used, |
If IPv6 autoconf is active on an interface and the autoconfprivacy extension is used, |
| redundant addresses are added whenever an autoconfprivacy address expires. |
redundant addresses are added whenever an autoconfprivacy address expires. |
|
|
| <p> |
<p> |
| |
|
| <li id="p003_nginx"> |
<li id="p003_nginx"> |
| <font color="#009000"><strong>003: SECURITY FIX: October 1, 2014</strong></font> |
<strong>003: SECURITY FIX: October 1, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| nginx can reuse cached SSL sessions in unrelated contexts, allowing virtual |
nginx can reuse cached SSL sessions in unrelated contexts, allowing virtual |
| host confusion attacks in some configurations. |
host confusion attacks in some configurations. |
|
|
| <p> |
<p> |
| |
|
| <li id="p004_kernexec"> |
<li id="p004_kernexec"> |
| <font color="#009000"><strong>004: RELIABILITY FIX: October 20, 2014</strong></font> |
<strong>004: RELIABILITY FIX: October 20, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Executable headers with an unaligned address will trigger a kernel panic. |
Executable headers with an unaligned address will trigger a kernel panic. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p005_nosslv3"> |
<li id="p005_nosslv3"> |
| <font color="#009000"><strong>005: SECURITY FIX: October 20, 2014</strong></font> |
<strong>005: SECURITY FIX: October 20, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| This patch disables the SSLv3 protocol by default. |
This patch disables the SSLv3 protocol by default. |
| <p> |
<p> |
|
|
| <p> |
<p> |
| |
|
| <li id="p006_relayd"> |
<li id="p006_relayd"> |
| <font color="#009000"><strong>006: RELIABILITY FIX: November 17, 2014</strong></font> |
<strong>006: RELIABILITY FIX: November 17, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Certain http requests can crash relayd. |
Certain http requests can crash relayd. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p007_pfctl"> |
<li id="p007_pfctl"> |
| <font color="#009000"><strong>007: RELIABILITY FIX: November 17, 2014</strong></font> |
<strong>007: RELIABILITY FIX: November 17, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A PF rule using an IPv4 address |
A PF rule using an IPv4 address |
| followed by an IPv6 address and then a dynamic address, e.g. "pass |
followed by an IPv6 address and then a dynamic address, e.g. "pass |
|
|
| <p> |
<p> |
| |
|
| <li id="p008_asr"> |
<li id="p008_asr"> |
| <font color="#009000"><strong>008: RELIABILITY FIX: November 17, 2014</strong></font> |
<strong>008: RELIABILITY FIX: November 17, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Querying an invalid hostname with gethostbyname(3) could cause a NULL deref. |
Querying an invalid hostname with gethostbyname(3) could cause a NULL deref. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p009_httpd"> |
<li id="p009_httpd"> |
| <font color="#009000"><strong>009: RELIABILITY FIX: November 18, 2014</strong></font> |
<strong>009: RELIABILITY FIX: November 18, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| httpd was developed very rapidly in the weeks before 5.6 release, and |
httpd was developed very rapidly in the weeks before 5.6 release, and |
| it has a few flaws. It would be nice to get these flaws fully |
it has a few flaws. It would be nice to get these flaws fully |
|
|
| <p> |
<p> |
| |
|
| <li id="p010_pipex"> |
<li id="p010_pipex"> |
| <font color="#009000"><strong>010: RELIABILITY FIX: December 5, 2014</strong></font> |
<strong>010: RELIABILITY FIX: December 5, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Several bugs were fixed that allowed a crash from remote when an active pipex |
Several bugs were fixed that allowed a crash from remote when an active pipex |
| session exists. |
session exists. |
|
|
| <p> |
<p> |
| |
|
| <li id="p011_pppoe"> |
<li id="p011_pppoe"> |
| <font color="#009000"><strong>011: RELIABILITY FIX: December 5, 2014</strong></font> |
<strong>011: RELIABILITY FIX: December 5, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| An incorrect memcpy call would result in corrupted MAC addresses when |
An incorrect memcpy call would result in corrupted MAC addresses when |
| using PPPOE. |
using PPPOE. |
|
|
| <p> |
<p> |
| |
|
| <li id="p012_unbound"> |
<li id="p012_unbound"> |
| <font color="#009000"><strong>012: RELIABILITY FIX: December 9, 2014</strong></font> |
<strong>012: RELIABILITY FIX: December 9, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix a denial of service where a malicious authority could make the resolver chase an |
Fix a denial of service where a malicious authority could make the resolver chase an |
| endless series of delegations. (CVE-2014-8602) |
endless series of delegations. (CVE-2014-8602) |
|
|
| <p> |
<p> |
| |
|
| <li id="p013_virtio"> |
<li id="p013_virtio"> |
| <font color="#009000"><strong>013: RELIABILITY FIX: December 9, 2014</strong></font> |
<strong>013: RELIABILITY FIX: December 9, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Missing memory barriers in virtio(4) can lead to hangs with virtio devices, |
Missing memory barriers in virtio(4) can lead to hangs with virtio devices, |
| like vio(4) and vioblk(4). |
like vio(4) and vioblk(4). |
|
|
| <p> |
<p> |
| |
|
| <li id="p014_xserver"> |
<li id="p014_xserver"> |
| <font color="#009000"><strong>014: SECURITY FIX: December 9, 2014</strong></font> |
<strong>014: SECURITY FIX: December 9, 2014</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| One year after Ilja van Sprundel discovered and reported a large number |
One year after Ilja van Sprundel discovered and reported a large number |
| of issues in the way the X server code base handles requests from X clients, |
of issues in the way the X server code base handles requests from X clients, |
|
|
| <p> |
<p> |
| |
|
| <li id="p015_libevent"> |
<li id="p015_libevent"> |
| <font color="#009000"><strong>015: SECURITY FIX: January 13, 2015</strong></font> |
<strong>015: SECURITY FIX: January 13, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix CVE-2014-6272 in libevent 1.4 event buffer handling. OpenBSD |
Fix CVE-2014-6272 in libevent 1.4 event buffer handling. OpenBSD |
| base uses it for the programs: cu tmux ftp-proxy httpd ldapd relayd |
base uses it for the programs: cu tmux ftp-proxy httpd ldapd relayd |
|
|
| <p> |
<p> |
| |
|
| <li id="p016_xserver"> |
<li id="p016_xserver"> |
| <font color="#009000"><strong>016: SECURITY FIX: March 3, 2015</strong></font> |
<strong>016: SECURITY FIX: March 3, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Information leak in the XkbSetGeometry request of X servers. |
Information leak in the XkbSetGeometry request of X servers. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p017_openssl"> |
<li id="p017_openssl"> |
| <font color="#009000"><strong>017: SECURITY FIX: March 13, 2015</strong></font> |
<strong>017: SECURITY FIX: March 13, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Don't permit TLS client connections to be downgraded to weak keys. |
Don't permit TLS client connections to be downgraded to weak keys. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p018_freetype"> |
<li id="p018_freetype"> |
| <font color="#009000"><strong>018: SECURITY FIX: March 13, 2015</strong></font> |
<strong>018: SECURITY FIX: March 13, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Another fix for buffer overflows in malformed fonts. |
Another fix for buffer overflows in malformed fonts. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p019_libxfont"> |
<li id="p019_libxfont"> |
| <font color="#009000"><strong>019: SECURITY FIX: March 18, 2015</strong></font> |
<strong>019: SECURITY FIX: March 18, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Buffer overflows in libXfont |
Buffer overflows in libXfont |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p020_openssl"> |
<li id="p020_openssl"> |
| <font color="#009000"><strong>020: SECURITY FIX: March 19, 2015</strong></font> |
<strong>020: SECURITY FIX: March 19, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix several crash causing defects from OpenSSL.<br> |
Fix several crash causing defects from OpenSSL.<br> |
| These include:<br> |
These include:<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p021_smtpd"> |
<li id="p021_smtpd"> |
| <font color="#009000"><strong>021: RELIABILITY FIX: April 17, 2015</strong></font> |
<strong>021: RELIABILITY FIX: April 17, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix a logic error in smtpd handling of SNI. |
Fix a logic error in smtpd handling of SNI. |
| This could allow a remote user to crash the server or provoke a disconnect of other sessions. |
This could allow a remote user to crash the server or provoke a disconnect of other sessions. |
|
|
| <p> |
<p> |
| |
|
| <li id="p022_httpd"> |
<li id="p022_httpd"> |
| <font color="#009000"><strong>022: RELIABILITY FIX: April 30, 2015</strong></font> |
<strong>022: RELIABILITY FIX: April 30, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A remote user can crash httpd by forcing the daemon to log to a file |
A remote user can crash httpd by forcing the daemon to log to a file |
| before the logging system was initialized. |
before the logging system was initialized. |
|
|
| <p> |
<p> |
| |
|
| <li id="p023_elf"> |
<li id="p023_elf"> |
| <font color="#009000"><strong>023: SECURITY FIX: April 30, 2015</strong></font> |
<strong>023: SECURITY FIX: April 30, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Malformed binaries could trigger kernel panics or view kernel memory. |
Malformed binaries could trigger kernel panics or view kernel memory. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p024_tar"> |
<li id="p024_tar"> |
| <font color="#009000"><strong>024: SECURITY FIX: April 30, 2015</strong></font> |
<strong>024: SECURITY FIX: April 30, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Multiple issues in tar/pax/cpio: |
Multiple issues in tar/pax/cpio: |
| <ul> |
<ul> |
|
|
| <p> |
<p> |
| |
|
| <li id="p025_smtpd"> |
<li id="p025_smtpd"> |
| <font color="#009000"><strong>025: RELIABILITY FIX: June 11, 2015</strong></font> |
<strong>025: RELIABILITY FIX: June 11, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix multiple reliability issues in smtpd: |
Fix multiple reliability issues in smtpd: |
| <ul> |
<ul> |
|
|
| <p> |
<p> |
| |
|
| <li id="p026_openssl"> |
<li id="p026_openssl"> |
| <font color="#009000"><strong>026: SECURITY FIX: June 11, 2015</strong></font> |
<strong>026: SECURITY FIX: June 11, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix several defects from OpenSSL: |
Fix several defects from OpenSSL: |
| <ul> |
<ul> |
|
|
| <p> |
<p> |
| |
|
| <li id="p027_tcp"> |
<li id="p027_tcp"> |
| <font color="#009000"><strong>027: SECURITY FIX: July 14, 2015</strong></font> |
<strong>027: SECURITY FIX: July 14, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A TCP socket can become confused and not properly cleanup resources. |
A TCP socket can become confused and not properly cleanup resources. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p028_execve"> |
<li id="p028_execve"> |
| <font color="#009000"><strong>028: RELIABILITY FIX: July 26, 2015</strong></font> |
<strong>028: RELIABILITY FIX: July 26, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A kernel memory leak could be triggered by an unprivileged user in |
A kernel memory leak could be triggered by an unprivileged user in |
| a failure case when using execve under systrace. |
a failure case when using execve under systrace. |
|
|
| <p> |
<p> |
| |
|
| <li id="p029_patch"> |
<li id="p029_patch"> |
| <font color="#009000"><strong>029: SECURITY FIX: July 26, 2015</strong></font> |
<strong>029: SECURITY FIX: July 26, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The patch utility could be made to invoke arbitrary commands via |
The patch utility could be made to invoke arbitrary commands via |
| the obsolete SCCS and RCS support when processing a crafted input file. |
the obsolete SCCS and RCS support when processing a crafted input file. |
|
|
| <p> |
<p> |
| |
|
| <li id="p030_patch"> |
<li id="p030_patch"> |
| <font color="#009000"><strong>030: SECURITY FIX: July 30, 2015</strong></font> |
<strong>030: SECURITY FIX: July 30, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The patch utility could become desyncronized processing ed(1)-style diffs. |
The patch utility could become desyncronized processing ed(1)-style diffs. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p031_smtpd"> |
<li id="p031_smtpd"> |
| <font color="#009000"><strong>031: SECURITY FIX: October 1, 2015</strong></font> |
<strong>031: SECURITY FIX: October 1, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix multiple reliability and security issues in smtpd:<br> |
Fix multiple reliability and security issues in smtpd:<br> |
| <ul> |
<ul> |
|
|
| <p> |
<p> |
| |
|
| <li id="p032_kevent"> |
<li id="p032_kevent"> |
| <font color="#009000"><strong>032: RELIABILITY FIX: October 14, 2015</strong></font> |
<strong>032: RELIABILITY FIX: October 14, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A problem with timer kevents could result in a kernel hang (local denial |
A problem with timer kevents could result in a kernel hang (local denial |
| of service).<br> |
of service).<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p033_obj2txt"> |
<li id="p033_obj2txt"> |
| <font color="#009000"><strong>033: RELIABILITY FIX: October 15, 2015</strong></font> |
<strong>033: RELIABILITY FIX: October 15, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The OBJ_obj2txt function in libcrypto contains a one byte buffer overrun |
The OBJ_obj2txt function in libcrypto contains a one byte buffer overrun |
| and memory leak, as reported by Qualys Security.<br> |
and memory leak, as reported by Qualys Security.<br> |
|
|
| </ul> |
</ul> |
| |
|
| <hr> |
<hr> |
| |
|
| </body> |
|
| </html> |
|
![[BACK]](/icons/back.gif){kind=icon}
Return to errata56.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www