[BACK]Return to errata56.html CVS log [TXT][DIR] Up to [local] / www

Annotation of www/errata56.html, Revision 1.42

1.1       jsg         1: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
                      2: <html>
                      3: <head>
                      4: <title>OpenBSD 5.6 errata</title>
                      5: <meta name="description" content="the OpenBSD CD errata page">
                      6: <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
1.30      sthen       7: <link rel="canonical" href="http://www.openbsd.org/errata56.html">
1.1       jsg         8: </head>
                      9:
                     10: <!--
                     11:                        IMPORTANT REMINDER
                     12:        IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE
                     13: -->
                     14:
                     15: <body bgcolor="#ffffff" text="#000000" link="#23238E">
                     16:
                     17: <a href="index.html"><img alt="[OpenBSD]" height="30" width="141" src="images/smalltitle.gif" border="0"></a>
1.3       deraadt    18: <h2><font color="#e00000">
                     19: OpenBSD 5.6 errata
1.1       jsg        20: </font></h2>
                     21:
                     22: <hr>
                     23: <a href=stable.html>For OpenBSD patch branch information, please refer here.</a><br>
                     24: <br>
                     25: For errata on a certain release, click below:<br>
                     26: <a href="errata21.html">2.1</a>,
                     27: <a href="errata22.html">2.2</a>,
                     28: <a href="errata23.html">2.3</a>,
                     29: <a href="errata24.html">2.4</a>,
                     30: <a href="errata25.html">2.5</a>,
                     31: <a href="errata26.html">2.6</a>,
                     32: <a href="errata27.html">2.7</a>,
                     33: <a href="errata28.html">2.8</a>,
                     34: <a href="errata29.html">2.9</a>,
                     35: <a href="errata30.html">3.0</a>,
                     36: <a href="errata31.html">3.1</a>,
                     37: <a href="errata32.html">3.2</a>,
                     38: <a href="errata33.html">3.3</a>,
                     39: <a href="errata34.html">3.4</a>,
                     40: <a href="errata35.html">3.5</a>,
                     41: <a href="errata36.html">3.6</a>,
                     42: <br>
                     43: <a href="errata37.html">3.7</a>,
                     44: <a href="errata38.html">3.8</a>,
                     45: <a href="errata39.html">3.9</a>,
                     46: <a href="errata40.html">4.0</a>,
                     47: <a href="errata41.html">4.1</a>,
                     48: <a href="errata42.html">4.2</a>,
                     49: <a href="errata43.html">4.3</a>,
                     50: <a href="errata44.html">4.4</a>,
                     51: <a href="errata45.html">4.5</a>,
                     52: <a href="errata46.html">4.6</a>,
                     53: <a href="errata47.html">4.7</a>,
                     54: <a href="errata48.html">4.8</a>,
                     55: <a href="errata49.html">4.9</a>,
                     56: <a href="errata50.html">5.0</a>,
                     57: <a href="errata51.html">5.1</a>,
                     58: <a href="errata52.html">5.2</a>,
                     59: <br>
                     60: <a href="errata53.html">5.3</a>,
                     61: <a href="errata54.html">5.4</a>,
1.21      deraadt    62: <a href="errata55.html">5.5</a>,
1.39      deraadt    63: <a href="errata57.html">5.7</a>,
                     64: <a href="errata58.html">5.8</a>.
1.1       jsg        65: <br>
                     66: <hr>
                     67:
                     68: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6.tar.gz">
                     69: You can also fetch a tar.gz file containing all the following patches</a>.
                     70: This file is updated once a day.
                     71: <p>
                     72:
                     73: The patches below are available in CVS via the
                     74: <code>OPENBSD_5_6</code> <a href="stable.html">patch branch</a>.
                     75: <p>
                     76:
                     77: For more detailed information on how to install patches to OpenBSD, please
                     78: consult the <a href="./faq/faq10.html#Patches">OpenBSD FAQ</a>.
                     79: <p>
                     80:
                     81: <hr>
                     82:
                     83: <ul>
                     84:
1.16      bentley    85: <li id="001_rxr">
1.1       jsg        86: <font color="#009000"><strong>001: RELIABILITY FIX: September 5, 2014</strong></font>
                     87: &nbsp; <i>All architectures</i><br>
                     88: Incorrect RX ring computation leads to panics under load with bge(4), em(4) and ix(4).
                     89: <br>
1.2       stsp       90: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/001_rxr.patch.sig">
                     91: A source code patch exists which remedies this problem.</a>
                     92: <p>
                     93:
1.16      bentley    94: <li id="002_nd6">
1.2       stsp       95: <font color="#009000"><strong>002: RELIABILITY FIX: October 1, 2014</strong></font>
                     96: &nbsp; <i>All architectures</i><br>
                     97: If IPv6 autoconf is active on an interface and the autoconfprivacy extension is used,
                     98: redundant addresses are added whenever an autoconfprivacy address expires.
                     99: The autoconfprivacy extension is used by default and can be disabled with ifconfig(8)
                    100: as a workaround:
                    101: <pre>
                    102: # ifconfig em0 -autoconfprivacy
                    103: </pre>
                    104: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/002_nd6.patch.sig">
                    105: A source code patch exists which remedies this problem.</a>
                    106: <p>
                    107:
1.16      bentley   108: <li id="003_nginx">
1.2       stsp      109: <font color="#009000"><strong>003: SECURITY FIX: October 1, 2014</strong></font>
                    110: &nbsp; <i>All architectures</i><br>
                    111: nginx can reuse cached SSL sessions in unrelated contexts, allowing virtual
                    112: host confusion attacks in some configurations.
                    113: This issue was assigned CVE-2014-3616.
                    114: <br>
                    115: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/003_nginx.patch.sig">
1.1       jsg       116: A source code patch exists which remedies this problem.</a>
                    117: <p>
                    118:
1.16      bentley   119: <li id="004_kernexec">
1.4       tedu      120: <font color="#009000"><strong>004: RELIABILITY FIX: October 20, 2014</strong></font>
                    121: &nbsp; <i>All architectures</i><br>
                    122: Executable headers with an unaligned address will trigger a kernel panic.
                    123: <br>
                    124: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/004_kernexec.patch.sig">
                    125: A source code patch exists which remedies this problem.</a>
                    126: <p>
                    127:
1.16      bentley   128: <li id="005_nosslv3">
1.5       tedu      129: <font color="#009000"><strong>005: SECURITY FIX: October 20, 2014</strong></font>
                    130: &nbsp; <i>All architectures</i><br>
                    131: This patch disables the SSLv3 protocol by default.
                    132: <p>
                    133: <i>
                    134: Applications depending on SSLv3 may need to be recompiled with
                    135: <pre>    SSL_CTX_clear_option(ctx, SSL_OP_NO_SSLv3);</pre>
                    136: but we recommend against the continued use of this obsolete protocol.
                    137: </i>
                    138: <p>
                    139: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/005_nosslv3.patch.sig">
                    140: A source code patch exists which remedies this problem.</a>
                    141: <p>
                    142:
1.16      bentley   143: <li id="006_relayd">
1.6       florian   144: <font color="#009000"><strong>006: RELIABILITY FIX: November 17, 2014</strong></font>
                    145: &nbsp; <i>All architectures</i><br>
                    146: Certain http requests can crash relayd.
                    147: <br>
                    148: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/006_relayd.patch.sig">
                    149: A source code patch exists which remedies this problem.</a>
                    150: <p>
                    151:
1.16      bentley   152: <li id="007_pfctl">
1.8       tedu      153: <font color="#009000"><strong>007: RELIABILITY FIX: November 17, 2014</strong></font>
1.7       sthen     154: &nbsp; <i>All architectures</i><br>
1.8       tedu      155: A PF rule using an IPv4 address
                    156: followed by an IPv6 address and then a dynamic address, e.g. "pass
                    157: from {192.0.2.1 2001:db8::1} to (pppoe0)", will have an incorrect /32
                    158: mask applied to the dynamic address.
1.7       sthen     159: <br>
                    160: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/007_pfctl.patch.sig">
1.8       tedu      161: A source code patch exists which remedies this problem.</a>
                    162: <p>
                    163:
1.16      bentley   164: <li id="008_asr">
1.8       tedu      165: <font color="#009000"><strong>008: RELIABILITY FIX: November 17, 2014</strong></font>
                    166: &nbsp; <i>All architectures</i><br>
                    167: Querying an invalid hostname with gethostbyname(3) could cause a NULL deref.
                    168: <br>
                    169: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/008_asr.patch.sig">
1.7       sthen     170: A source code patch exists which remedies this problem.</a>
                    171: <p>
                    172:
1.16      bentley   173: <li id="009_httpd">
1.9       reyk      174: <font color="#009000"><strong>009: RELIABILITY FIX: November 18, 2014</strong></font>
                    175: &nbsp; <i>All architectures</i><br>
                    176: httpd was developed very rapidly in the weeks before 5.6 release, and
                    177: it has a few flaws.  It would be nice to get these flaws fully
                    178: remediated before the next release, and that requires the community to
                    179: want to use it.  Therefore here is a "jumbo" patch that brings in the
                    180: most important fixes.
                    181: <br>
                    182: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/009_httpd.patch.sig">
                    183: A source code patch exists which remedies this problem.</a>
1.19      tedu      184: <br>
                    185: <i>Unfortunately the source tree found on the CD set contains a slightly different
                    186: checkout, from just before the release was finished and is missing a few httpd
                    187: commits. Therefore, the patch above will not apply correctly. Users are encouraged
                    188: to use cvs to get the latest httpd sources if interested.</i>
1.9       reyk      189: <p>
                    190:
1.16      bentley   191: <li id="010_pipex">
1.10      tedu      192: <font color="#009000"><strong>010: RELIABILITY FIX: December 5, 2014</strong></font>
                    193: &nbsp; <i>All architectures</i><br>
                    194: Several bugs were fixed that allowed a crash from remote when an active pipex
                    195: session exists.
                    196: <br>
                    197: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/010_pipex.patch.sig">
                    198: A source code patch exists which remedies this problem.</a>
                    199: <p>
                    200:
1.16      bentley   201: <li id="011_pppoe">
1.11      tedu      202: <font color="#009000"><strong>011: RELIABILITY FIX: December 5, 2014</strong></font>
1.10      tedu      203: &nbsp; <i>All architectures</i><br>
                    204: An incorrect memcpy call would result in corrupted MAC addresses when
                    205: using PPPOE.
                    206: <br>
                    207: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/011_pppoe.patch.sig">
                    208: A source code patch exists which remedies this problem.</a>
                    209: <p>
                    210:
1.16      bentley   211: <li id="012_unbound">
1.14      tedu      212: <font color="#009000"><strong>012: RELIABILITY FIX: December 9, 2014</strong></font>
1.12      tedu      213: &nbsp; <i>All architectures</i><br>
1.13      tedu      214: Fix a denial of service where a malicious authority could make the resolver chase an
                    215: endless series of delegations. (CVE-2014-8602)
1.12      tedu      216: <br>
1.13      tedu      217: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/012_unbound.patch.sig">
1.12      tedu      218: A source code patch exists which remedies this problem.</a>
                    219: <p>
                    220:
1.16      bentley   221: <li id="013_virtio">
1.14      tedu      222: <font color="#009000"><strong>013: RELIABILITY FIX: December 9, 2014</strong></font>
1.12      tedu      223: &nbsp; <i>All architectures</i><br>
1.13      tedu      224: Missing memory barriers in virtio(4) can lead to hangs with virtio devices,
                    225: like vio(4) and vioblk(4).
1.12      tedu      226: <br>
1.13      tedu      227: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/013_virtio.patch.sig">
1.12      tedu      228: A source code patch exists which remedies this problem.</a>
                    229: <p>
                    230:
1.16      bentley   231: <li id="014_xserver">
1.14      tedu      232: <font color="#009000"><strong>014: SECURITY FIX: December 9, 2014</strong></font>
1.12      tedu      233: &nbsp; <i>All architectures</i><br>
                    234: One year after Ilja van Sprundel discovered and reported a large number
                    235: of issues in the way the X server code base handles requests from X clients,
                    236: they have been fixed.
                    237: <br>
                    238: <a href="http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/">X Advisory</a>
                    239: <br>
                    240: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/014_xserver.patch.sig">
                    241: A source code patch exists which remedies this problem.</a>
                    242: <p>
                    243:
1.16      bentley   244: <li id="015_libevent">
1.15      bluhm     245: <font color="#009000"><strong>015: SECURITY FIX: January 13, 2015</strong></font>
                    246: &nbsp; <i>All architectures</i><br>
                    247: Fix CVE-2014-6272 in libevent 1.4 event buffer handling.  OpenBSD
                    248: base uses it for the programs: cu tmux ftp-proxy httpd ldapd relayd
                    249: tftp-proxy tftpd
                    250: <br>
                    251: <a href="http://www.wangafu.net/~nickm/volatile/advisory.txt.asc">Libevent Advisory</a>
                    252: <br>
                    253: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/015_libevent.patch.sig">
                    254: A source code patch exists which remedies this problem.</a>
                    255: <p>
1.10      tedu      256:
1.17      tedu      257: <li id="016_xserver">
                    258: <font color="#009000"><strong>016: SECURITY FIX: March 3, 2015</strong></font>
                    259: &nbsp; <i>All architectures</i><br>
                    260: Information leak in the XkbSetGeometry request of X servers.
                    261: <br>
                    262: For more information, see the
                    263: <a href="http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/">X.org advisory</a>.
                    264: <br>
                    265: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/016_xserver.patch.sig">
                    266: A source code patch exists which remedies this problem.</a>
                    267: <p>
                    268:
1.20      tedu      269: <li id="017_openssl">
                    270: <font color="#009000"><strong>017: SECURITY FIX: March 13, 2015</strong></font>
                    271: &nbsp; <i>All architectures</i><br>
                    272: Don't permit TLS client connections to be downgraded to weak keys.
                    273: <br>
                    274: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/017_openssl.patch.sig">
                    275: A source code patch exists which remedies this problem.</a>
                    276: <p>
                    277:
                    278: <li id="018_freetype">
                    279: <font color="#009000"><strong>018: SECURITY FIX: March 13, 2015</strong></font>
                    280: &nbsp; <i>All architectures</i><br>
                    281: Another fix for buffer overflows in malformed fonts.
                    282: <br>
                    283: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/018_freetype.patch.sig">
                    284: A source code patch exists which remedies this problem.</a>
                    285: <p>
                    286:
1.23      tedu      287: <li id="019_libxfont">
1.22      tedu      288: <font color="#009000"><strong>019: SECURITY FIX: March 18, 2015</strong></font>
                    289: &nbsp; <i>All architectures</i><br>
                    290: Buffer overflows in libXfont
                    291: <br>
                    292: For more information, see the
                    293: <a href="http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/">X.org advisory</a>.
                    294: <br>
                    295: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/019_libxfont.patch.sig">
1.23      tedu      296: A source code patch exists which remedies this problem.</a>
1.24      tedu      297: <br>Note that the instructions should read <code>cd /usr/xenocara/lib/libXfont</code>.
1.23      tedu      298: <p>
                    299:
                    300: <li id="020_openssl">
                    301: <font color="#009000"><strong>020: SECURITY FIX: March 19, 2015</strong></font>
                    302: &nbsp; <i>All architectures</i><br>
                    303: Fix several crash causing defects from OpenSSL.<br>
                    304: These include:<br>
                    305: CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error<br>
                    306: CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp<br>
                    307: CVE-2015-0287 - ASN.1 structure reuse memory corruption<br>
                    308: CVE-2015-0288 - X509_to_X509_REQ NULL pointer deref<br>
                    309: CVE-2015-0289 - PKCS7 NULL pointer dereferences<br>
                    310: <br>
                    311: Several other issues did not apply or were already fixed.<br>
                    312: For more information, see the
                    313: <a href="https://www.openssl.org/news/secadv_20150319.txt">OpenSSL advisory</a>.
                    314: <br>
                    315: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/020_openssl.patch.sig">
1.22      tedu      316: A source code patch exists which remedies this problem.</a>
                    317: <p>
                    318:
1.25      gilles    319: <li id="021_smtpd">
                    320: <font color="#009000"><strong>021: RELIABILITY FIX: April 17, 2015</strong></font>
                    321: &nbsp; <i>All architectures</i><br>
                    322: Fix a logic error in smtpd handling of SNI.
                    323: This could allow a remote user to crash the server or provoke a disconnect of other sessions.
                    324: <br>
                    325: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/021_smtpd.patch.sig">
1.28      deraadt   326: A source code patch exists which remedies this problem.</a>
1.25      gilles    327: <p>
                    328:
1.26      florian   329: <li id="022_httpd">
                    330: <font color="#009000"><strong>022: RELIABILITY FIX: April 30, 2015</strong></font>
                    331: &nbsp; <i>All architectures</i><br>
                    332: A remote user can crash httpd by forcing the daemon to log to a file
                    333: before the logging system was initialized.
                    334: <br>
                    335: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/022_httpd.patch.sig">
1.28      deraadt   336: A source code patch exists which remedies this problem.</a>
1.26      florian   337: <p>
                    338:
1.27      guenther  339: <li id="023_elf">
1.29      deraadt   340: <font color="#009000"><strong>023: SECURITY FIX: April 30, 2015</strong></font>
1.27      guenther  341: &nbsp; <i>All architectures</i><br>
                    342: Malformed binaries could trigger kernel panics or view kernel memory.
                    343: <br>
                    344: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/023_elf.patch.sig">
1.28      deraadt   345: A source code patch exists which remedies this problem.</a>
1.27      guenther  346: <p>
                    347:
                    348: <li id="024_tar">
1.29      deraadt   349: <font color="#009000"><strong>024: SECURITY FIX: April 30, 2015</strong></font>
1.27      guenther  350: &nbsp; <i>All architectures</i><br>
                    351: Multiple issues in tar/pax/cpio:
                    352: <ul>
                    353: <li>extracting a malicious archive could create files outside of
                    354: the current directory without using pre-existing symlinks to 'escape',
                    355: and could change the timestamps and modes on preexisting files
                    356: <li>tar without -P would permit extraction of paths with ".." components
                    357: <li>there was a buffer overflow in the handling of pax extension headers
                    358: </ul>
                    359: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/024_tar.patch.sig">
1.31      deraadt   360: A source code patch exists which remedies this problem.</a>
                    361: <p>
                    362:
                    363: <li id="025_smtpd">
                    364: <font color="#009000"><strong>025: RELIABILITY FIX: June 11, 2015</strong></font>
                    365: &nbsp; <i>All architectures</i><br>
                    366: Fix multiple reliability issues in smtpd:
                    367: <ul>
                    368: <li>a local user can cause smtpd to fail by writing an invalid imsg to control socket.
                    369: <li>a local user can prevent smtpd from serving new requests by exhausting descriptors.
                    370: </ul>
                    371: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/025_smtpd.patch.sig">
                    372: A source code patch exists which remedies this problem.</a>
                    373: <p>
                    374:
                    375: <li id="026_openssl">
                    376: <font color="#009000"><strong>026: SECURITY FIX: June 11, 2015</strong></font>
                    377: &nbsp; <i>All architectures</i><br>
                    378: Fix several defects from OpenSSL:
                    379: <ul>
                    380: <li>CVE-2015-1788 - Malformed ECParameters causes infinite loop
                    381: <li>CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time
                    382: <li>CVE-2015-1792 - CMS verify infinite loop with unknown hash function
                    383: </ul>
1.32      doug      384: Note that CMS was already disabled in LibreSSL.
                    385: Several other issues did not apply or were already fixed and one is under review.<br>
                    386: For more information, see the
                    387: <a href="https://www.openssl.org/news/secadv_20150611.txt">OpenSSL advisory</a>.
                    388: <br>
1.31      deraadt   389: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/026_openssl.patch.sig">
1.28      deraadt   390: A source code patch exists which remedies this problem.</a>
1.27      guenther  391: <p>
                    392:
1.37      deraadt   393: <li id="027_tcp">
1.34      deraadt   394: <font color="#009000"><strong>027: SECURITY FIX: July 14, 2015</strong></font>
                    395: &nbsp; <i>All architectures</i><br>
                    396: A TCP socket can become confused and not properly cleanup resources.
                    397: <br>
1.36      deraadt   398: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/027_tcp_persist.patch.sig">
1.37      deraadt   399: A source code patch exists which remedies this problem.</a>
                    400: <p>
                    401:
                    402: <li id="028_execve">
                    403: <font color="#009000"><strong>028: RELIABILITY FIX: July 26, 2015</strong></font>
                    404: &nbsp; <i>All architectures</i><br>
                    405: A kernel memory leak could be triggered by an unprivileged user in
                    406: a failure case when using execve under systrace.
                    407: <br>
                    408: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/028_execve.patch.sig">
                    409: A source code patch exists which remedies this problem.</a>
                    410: <p>
                    411:
                    412: <li id="029_patch">
                    413: <font color="#009000"><strong>029: SECURITY FIX: July 26, 2015</strong></font>
                    414: &nbsp; <i>All architectures</i><br>
                    415: The patch utility could be made to invoke arbitrary commands via
                    416: the obsolete SCCS and RCS support when processing a crafted input file.
                    417: This patch deletes the SCCS and RCS support.
                    418: <br>
                    419: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/029_patch.patch.sig">
1.34      deraadt   420: A source code patch exists which remedies this problem.</a>
                    421: <p>
                    422:
1.38      deraadt   423: <li id="030_patch">
                    424: <font color="#009000"><strong>030: SECURITY FIX: July 30, 2015</strong></font>
                    425: &nbsp; <i>All architectures</i><br>
                    426: The patch utility could become desyncronized processing ed(1)-style diffs.
                    427: <br>
                    428: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/030_patch.patch.sig">
                    429: A source code patch exists which remedies this problem.</a>
                    430: <p>
                    431:
1.40      deraadt   432: <li id="031_smtpd">
                    433: <font color="#009000"><strong>031: SECURITY FIX: October 1, 2015</strong></font>
                    434: &nbsp; <i>All architectures</i><br>
                    435: Fix multiple reliability and security issues in smtpd:<br>
                    436: <ul>
                    437: <li>local and remote users could make smtpd crash or stop serving requests.
                    438: <li>a buffer overflow in the unprivileged, non-chrooted smtpd (lookup)
                    439:     process could allow a local user to cause a crash or potentially
                    440:     execute arbitrary code.
                    441: <li>a use-after-free in the unprivileged, non-chrooted smtpd (lookup)
                    442:     process could allow a remote attacker to cause a crash or potentially
                    443:     execute arbitrary code.
                    444: <li>hardlink and symlink attacks allowed a local user to unset chflags or
                    445:     leak the first line of an arbitrary file.
                    446: </ul>
                    447: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/031_smtpd.patch.sig">
                    448: A source code patch exists which remedies this problem.</a>
                    449: <p>
                    450:
1.41      sthen     451: <li id="032_kevent">
                    452: <font color="#009000"><strong>032: RELIABILITY FIX: October 14, 2015</strong></font>
                    453: &nbsp; <i>All architectures</i><br>
                    454: A problem with timer kevents could result in a kernel hang (local denial
                    455: of service).<br>
                    456: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/032_kevent.patch.sig">
                    457: A source code patch exists which remedies this problem.</a>
                    458: <p>
                    459:
1.42    ! tedu      460: <li id="033_obj2txt">
        !           461: <font color="#009000"><strong>033: RELIABILITY FIX: October 15, 2015</strong></font>
        !           462: &nbsp; <i>All architectures</i><br>
        !           463: The OBJ_obj2txt function in libcrypto contains a one byte buffer overrun
        !           464: and memory leak, as reported by Qualys Security.<br>
        !           465: <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/033_obj2txt.patch.sig">
        !           466: A source code patch exists which remedies this problem.</a>
        !           467: <p>
        !           468:
1.1       jsg       469: </ul>
                    470:
1.18      tedu      471: <hr>
                    472:
1.1       jsg       473: </body>
                    474: </html>