| version 1.43, 2019/04/02 12:46:57 |
version 1.44, 2019/05/27 22:55:20 |
|
|
| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> |
<!doctype html> |
| <html> |
<html lang=en id=errata> |
| <head> |
<meta charset=utf-8> |
| |
|
| <title>OpenBSD 5.8 Errata</title> |
<title>OpenBSD 5.8 Errata</title> |
| <meta name="description" content="the OpenBSD CD errata page"> |
<meta name="description" content="the OpenBSD CD errata page"> |
| <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> |
|
| <meta name="viewport" content="width=device-width, initial-scale=1"> |
<meta name="viewport" content="width=device-width, initial-scale=1"> |
| <link rel="stylesheet" type="text/css" href="openbsd.css"> |
<link rel="stylesheet" type="text/css" href="openbsd.css"> |
| <link rel="canonical" href="https://www.openbsd.org/errata58.html"> |
<link rel="canonical" href="https://www.openbsd.org/errata58.html"> |
| </head> |
|
| |
|
| <!-- |
<!-- |
| IMPORTANT REMINDER |
IMPORTANT REMINDER |
| IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE |
IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE |
| --> |
--> |
| |
|
| <body bgcolor="#ffffff" text="#000000" link="#23238E"> |
|
| |
|
| <h2> |
<h2 id=OpenBSD> |
| <a href="index.html"> |
<a href="index.html"> |
| <font color="#0000ff"><i>Open</i></font><font color="#000084">BSD</font></a> |
<i>Open</i><b>BSD</b></a> |
| <font color="#e00000">5.8 Errata</font> |
5.8 Errata |
| </h2> |
</h2> |
| <hr> |
<hr> |
| |
|
|
|
| <ul> |
<ul> |
| |
|
| <li id="p001_sshd"> |
<li id="p001_sshd"> |
| <font color="#009000"><strong>001: SECURITY FIX: August 30, 2015</strong></font> |
<strong>001: SECURITY FIX: August 30, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Inverted logic made PermitRootLogin "prohibit-password" unsafe. |
Inverted logic made PermitRootLogin "prohibit-password" unsafe. |
| Use "no" (which is the installer default), or apply the following patch. |
Use "no" (which is the installer default), or apply the following patch. |
|
|
| <p> |
<p> |
| |
|
| <li id="p002_sslhello"> |
<li id="p002_sslhello"> |
| <font color="#009000"><strong>002: INTEROPERABILITY FIX: August 30, 2015</strong></font> |
<strong>002: INTEROPERABILITY FIX: August 30, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| LibreSSL 2.2.2 incorrectly handles ClientHello messages that do not |
LibreSSL 2.2.2 incorrectly handles ClientHello messages that do not |
| include TLS extensions, resulting in such handshakes being aborted. |
include TLS extensions, resulting in such handshakes being aborted. |
|
|
| <p> |
<p> |
| |
|
| <li id="p003_uvm"> |
<li id="p003_uvm"> |
| <font color="#009000"><strong>003: RELIABILITY FIX: September 28, 2015</strong></font> |
<strong>003: RELIABILITY FIX: September 28, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| An incorrect operation in uvm could result in system panics. |
An incorrect operation in uvm could result in system panics. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p004_smtpd"> |
<li id="p004_smtpd"> |
| <font color="#009000"><strong>004: SECURITY FIX: October 1, 2015</strong></font> |
<strong>004: SECURITY FIX: October 1, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix multiple reliability and security issues in smtpd:<br> |
Fix multiple reliability and security issues in smtpd:<br> |
| <ul> |
<ul> |
|
|
| <p> |
<p> |
| |
|
| <li id="p005_kevent"> |
<li id="p005_kevent"> |
| <font color="#009000"><strong>005: RELIABILITY FIX: October 14, 2015</strong></font> |
<strong>005: RELIABILITY FIX: October 14, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A problem with timer kevents could result in a kernel hang (local denial |
A problem with timer kevents could result in a kernel hang (local denial |
| of service).<br> |
of service).<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p006_src"> |
<li id="p006_src"> |
| <font color="#009000"><strong>006: RELEASE CD ISSUE: Oct 18, 2015</strong></font> |
<strong>006: RELEASE CD ISSUE: Oct 18, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The "src.tar.gz" file on the source tree was created on the wrong day, |
The "src.tar.gz" file on the source tree was created on the wrong day, |
| and does not match the 5.8 release builds. |
and does not match the 5.8 release builds. |
|
|
| <p> |
<p> |
| |
|
| <li id="p007_obj2txt"> |
<li id="p007_obj2txt"> |
| <font color="#009000"><strong>007: RELIABILITY FIX: October 15, 2015</strong></font> |
<strong>007: RELIABILITY FIX: October 15, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The OBJ_obj2txt function in libcrypto contains a one byte buffer overrun |
The OBJ_obj2txt function in libcrypto contains a one byte buffer overrun |
| and memory leak, as reported by Qualys Security.<br> |
and memory leak, as reported by Qualys Security.<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p008_rsn"> |
<li id="p008_rsn"> |
| <font color="#009000"><strong>008: RELIABILITY FIX: November 9, 2015</strong></font> |
<strong>008: RELIABILITY FIX: November 9, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Insufficient validation of RSN element group cipher values in 802.11 |
Insufficient validation of RSN element group cipher values in 802.11 |
| beacons and probe responses could result in system panics.<br> |
beacons and probe responses could result in system panics.<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p009_clientcert"> |
<li id="p009_clientcert"> |
| <font color="#009000"><strong>009: RELIABILITY FIX: Dec 3, 2015</strong></font> |
<strong>009: RELIABILITY FIX: Dec 3, 2015</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A NULL pointer dereference could be triggered by a crafted certificate sent to |
A NULL pointer dereference could be triggered by a crafted certificate sent to |
| services configured to verify client certificates on TLS/SSL connections.<br> |
services configured to verify client certificates on TLS/SSL connections.<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p010_sshd"> |
<li id="p010_sshd"> |
| <font color="#009000"><strong>010: SECURITY FIX: January 14, 2016</strong></font> |
<strong>010: SECURITY FIX: January 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Experimental roaming code in the ssh client could be tricked by a hostile sshd |
Experimental roaming code in the ssh client could be tricked by a hostile sshd |
| server, potentially leaking key material. CVE-2016-0777 and CVE-0216-0778. |
server, potentially leaking key material. CVE-2016-0777 and CVE-0216-0778. |
|
|
| <p> |
<p> |
| |
|
| <li id="p011_sshd"> |
<li id="p011_sshd"> |
| <font color="#009000"><strong>011: SECURITY FIX: March 10, 2016</strong></font> |
<strong>011: SECURITY FIX: March 10, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="https://www.openssh.com/txt/x11fwd.adv"> |
<a href="https://www.openssh.com/txt/x11fwd.adv"> |
| Lack of credential sanitization allows injection of commands to xauth(1).</a> |
Lack of credential sanitization allows injection of commands to xauth(1).</a> |
|
|
| <p> |
<p> |
| |
|
| <li id="p012_in6bind"> |
<li id="p012_in6bind"> |
| <font color="#009000"><strong>012: SECURITY FIX: March 16, 2016</strong></font> |
<strong>012: SECURITY FIX: March 16, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Insufficient checks in IPv6 socket binding and UDP IPv6 option |
Insufficient checks in IPv6 socket binding and UDP IPv6 option |
| processing allow a local user to send UDP packets with a source |
processing allow a local user to send UDP packets with a source |
|
|
| <p> |
<p> |
| |
|
| <li id="p013_crypto"> |
<li id="p013_crypto"> |
| <font color="#009000"><strong>013: SECURITY FIX: May 3, 2016</strong></font> |
<strong>013: SECURITY FIX: May 3, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix issues in the libcrypto library. |
Fix issues in the libcrypto library. |
| Refer to <a href="https://www.openssl.org/news/secadv/20160503.txt">the OpenSSL advisory</a>. |
Refer to <a href="https://www.openssl.org/news/secadv/20160503.txt">the OpenSSL advisory</a>. |
|
|
| <p> |
<p> |
| |
|
| <li id="p014_uvideo"> |
<li id="p014_uvideo"> |
| <font color="#009000"><strong>014: SECURITY FIX: May 17, 2016</strong></font> |
<strong>014: SECURITY FIX: May 17, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Insufficient checks in the uvideo(4) V4L2 ioctl handling leak kernel |
Insufficient checks in the uvideo(4) V4L2 ioctl handling leak kernel |
| memory contents to a local user. |
memory contents to a local user. |
|
|
| <p> |
<p> |
| |
|
| <li id="p015_crypto"> |
<li id="p015_crypto"> |
| <font color="#009000"><strong>015: RELIABILITY FIX: May 29, 2016</strong></font> |
<strong>015: RELIABILITY FIX: May 29, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix a bug in the libcrypto library when parsing certain ASN.1 elements. |
Fix a bug in the libcrypto library when parsing certain ASN.1 elements. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p016_libexpat"> |
<li id="p016_libexpat"> |
| <font color="#009000"><strong>016: SECURITY FIX: June 2, 2016</strong></font> |
<strong>016: SECURITY FIX: June 2, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix issues in the libexpat library to prevent multiple integer and buffer overflows. |
Fix issues in the libexpat library to prevent multiple integer and buffer overflows. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p017_crypto"> |
<li id="p017_crypto"> |
| <font color="#009000"><strong>017: SECURITY FIX: June 6, 2016</strong></font> |
<strong>017: SECURITY FIX: June 6, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Correct a problem that prevents the DSA signing algorithm from running |
Correct a problem that prevents the DSA signing algorithm from running |
| in constant time even if the flag BN_FLG_CONSTTIME is set. |
in constant time even if the flag BN_FLG_CONSTTIME is set. |
|
|
| <p> |
<p> |
| |
|
| <li id="p018_splice"> |
<li id="p018_splice"> |
| <font color="#009000"><strong>018: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>018: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Splicing sockets in a loop could cause a kernel spin. |
Splicing sockets in a loop could cause a kernel spin. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p019_dirent"> |
<li id="p019_dirent"> |
| <font color="#009000"><strong>019: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>019: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| ufs_readdir failed to limit size of memory allocation, leading to panics. |
ufs_readdir failed to limit size of memory allocation, leading to panics. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p020_mmap"> |
<li id="p020_mmap"> |
| <font color="#009000"><strong>020: SECURITY FIX: July 14, 2016</strong></font> |
<strong>020: SECURITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The mmap extension __MAP_NOFAULT could overcommit resources and crash |
The mmap extension __MAP_NOFAULT could overcommit resources and crash |
| the system. |
the system. |
|
|
| <p> |
<p> |
| |
|
| <li id="p021_timeout"> |
<li id="p021_timeout"> |
| <font color="#009000"><strong>021: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>021: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Tick counting overflows could cause a kernel crash. |
Tick counting overflows could cause a kernel crash. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p022_kevent"> |
<li id="p022_kevent"> |
| <font color="#009000"><strong>022: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>022: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Invalid file descriptor use with kevent(2) could lead to a kernel crash. |
Invalid file descriptor use with kevent(2) could lead to a kernel crash. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p023_amap"> |
<li id="p023_amap"> |
| <font color="#009000"><strong>023: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>023: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Unchecked parameters and integer overflows in the amap allocation routines |
Unchecked parameters and integer overflows in the amap allocation routines |
| could cause malloc(9) to either not allocate enough memory, leading to memory |
could cause malloc(9) to either not allocate enough memory, leading to memory |
|
|
| <p> |
<p> |
| |
|
| <li id="p024_relayd"> |
<li id="p024_relayd"> |
| <font color="#009000"><strong>024: RELIABILITY FIX: July 25, 2016</strong></font> |
<strong>024: RELIABILITY FIX: July 25, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| When signaling an error to an HTTP relay client, the connection can be |
When signaling an error to an HTTP relay client, the connection can be |
| terminated prematurely, leading to a crash. |
terminated prematurely, leading to a crash. |
|
|
| <p> |
<p> |
| |
|
| <li id="p025_sysctl"> |
<li id="p025_sysctl"> |
| <font color="#009000"> |
<strong>025: RELIABILITY FIX: August 2, 2016</strong> |
| <strong>025: RELIABILITY FIX: August 2, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| A missing NULL check in sysctl code results in a crash. |
A missing NULL check in sysctl code results in a crash. |
|
|
| <p> |
<p> |
| |
|
| <li id="p026_uvmisavail"> |
<li id="p026_uvmisavail"> |
| <font color="#009000"> |
<strong>026: RELIABILITY FIX: August 2, 2016</strong> |
| <strong>026: RELIABILITY FIX: August 2, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Missing overflow checks in uvm may result in panics. |
Missing overflow checks in uvm may result in panics. |
|
|
| <p> |
<p> |
| |
|
| <li id="p027_perl"> |
<li id="p027_perl"> |
| <font color="#009000"> |
<strong>027: SECURITY FIX: August 6, 2016</strong> |
| <strong>027: SECURITY FIX: August 6, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Don't look in the current working directory for perl modules to load. |
Don't look in the current working directory for perl modules to load. |
|
|
| <p> |
<p> |
| |
|
| <li id="p028_relayd"> |
<li id="p028_relayd"> |
| <font color="#009000"> |
<strong>028: RELIABILITY FIX: August 6, 2016</strong> |
| <strong>028: RELIABILITY FIX: August 6, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Improve relayd's parsing of the Host-header by following RFC 7230 |
Improve relayd's parsing of the Host-header by following RFC 7230 |
|
|
| </ul> |
</ul> |
| |
|
| <hr> |
<hr> |
| |
|
| </body> |
|
| </html> |
|
![[BACK]](/icons/back.gif){kind=icon}
Return to errata58.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www