===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/errata56.html,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- www/errata56.html	2014/11/17 17:57:18	1.6
+++ www/errata56.html	2014/11/17 19:55:00	1.7
@@ -149,6 +149,18 @@
 A source code patch exists which remedies this problem.</a>
 <p>
 
+<li><a name="007_pfctl"></a>
+<font color="#009000"><strong>007: SECURITY FIX: November 17, 2014</strong></font>
+&nbsp; <i>All architectures</i><br>
+PF rules of the form "pass from {192.0.2.1 2001:db8::1} to (pppoe0)" will
+apply an incorrect /32 mask to the dynamic IPv6 address, allowing access to
+a wide address range rather than the intended single host.
+As a workaround, list the IPv4 address last, i.e. "{2001:db8::1 192.0.2.1}".
+<br>
+<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/007_pfctl.patch.sig">
+A source code patch exists which remedies this problem.</a>
+<p>
+
 </ul>
 
 </body>