| version 1.46, 2019/04/02 12:46:57 |
version 1.47, 2019/05/27 22:55:20 |
|
|
| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> |
<!doctype html> |
| <html> |
<html lang=en id=errata> |
| <head> |
<meta charset=utf-8> |
| |
|
| <title>OpenBSD 5.9 Errata</title> |
<title>OpenBSD 5.9 Errata</title> |
| <meta name="description" content="the OpenBSD CD errata page"> |
<meta name="description" content="the OpenBSD CD errata page"> |
| <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> |
|
| <meta name="viewport" content="width=device-width, initial-scale=1"> |
<meta name="viewport" content="width=device-width, initial-scale=1"> |
| <link rel="stylesheet" type="text/css" href="openbsd.css"> |
<link rel="stylesheet" type="text/css" href="openbsd.css"> |
| <link rel="canonical" href="https://www.openbsd.org/errata59.html"> |
<link rel="canonical" href="https://www.openbsd.org/errata59.html"> |
| </head> |
|
| |
|
| <!-- |
<!-- |
| IMPORTANT REMINDER |
IMPORTANT REMINDER |
| IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE |
IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE |
| --> |
--> |
| <body bgcolor="#ffffff" text="#000000" link="#23238E"> |
|
| |
|
| <h2> |
<h2 id=OpenBSD> |
| <a href="index.html"> |
<a href="index.html"> |
| <font color="#0000ff"><i>Open</i></font><font color="#000084">BSD</font></a> |
<i>Open</i><b>BSD</b></a> |
| <font color="#e00000">5.9 Errata</font> |
5.9 Errata |
| </h2> |
</h2> |
| <hr> |
<hr> |
| |
|
|
|
| <ul> |
<ul> |
| |
|
| <li id="p001_sshd"> |
<li id="p001_sshd"> |
| <font color="#009000"><strong>001: SECURITY FIX: March 10, 2016</strong></font> |
<strong>001: SECURITY FIX: March 10, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| <a href="https://www.openssh.com/txt/x11fwd.adv"> |
<a href="https://www.openssh.com/txt/x11fwd.adv"> |
| Lack of credential sanitization allows injection of commands to xauth(1).</a> |
Lack of credential sanitization allows injection of commands to xauth(1).</a> |
|
|
| <p> |
<p> |
| |
|
| <li id="p002_in6bind"> |
<li id="p002_in6bind"> |
| <font color="#009000"><strong>002: SECURITY FIX: March 16, 2016</strong></font> |
<strong>002: SECURITY FIX: March 16, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Insufficient checks in IPv6 socket binding and UDP IPv6 option |
Insufficient checks in IPv6 socket binding and UDP IPv6 option |
| processing allow a local user to send UDP packets with a source |
processing allow a local user to send UDP packets with a source |
|
|
| <p> |
<p> |
| |
|
| <li id="p003_pledge"> |
<li id="p003_pledge"> |
| <font color="#009000"><strong>003: RELIABILITY FIX: March 16, 2016</strong></font> |
<strong>003: RELIABILITY FIX: March 16, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Incorrect path processing in pledge_namei() could result in unexpected |
Incorrect path processing in pledge_namei() could result in unexpected |
| program termination of pledge(2)'d programs. |
program termination of pledge(2)'d programs. |
|
|
| <p> |
<p> |
| |
|
| <li id="p004_mbuf"> |
<li id="p004_mbuf"> |
| <font color="#009000"><strong>004: RELIABILITY FIX: April 30, 2016</strong></font> |
<strong>004: RELIABILITY FIX: April 30, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A problem in m_dup_pkt() can result in kernel crashes with carp(4). |
A problem in m_dup_pkt() can result in kernel crashes with carp(4). |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p005_crypto"> |
<li id="p005_crypto"> |
| <font color="#009000"><strong>005: SECURITY FIX: May 3, 2016</strong></font> |
<strong>005: SECURITY FIX: May 3, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix issues in the libcrypto library. |
Fix issues in the libcrypto library. |
| Refer to <a href="https://www.openssl.org/news/secadv/20160503.txt">the advisory</a>. |
Refer to <a href="https://www.openssl.org/news/secadv/20160503.txt">the advisory</a>. |
|
|
| <p> |
<p> |
| |
|
| <li id="p006_smtpd"> |
<li id="p006_smtpd"> |
| <font color="#009000"><strong>006: RELIABILITY FIX: May 16, 2016</strong></font> |
<strong>006: RELIABILITY FIX: May 16, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix issues in smtpd. |
Fix issues in smtpd. |
| <ul> |
<ul> |
|
|
| <p> |
<p> |
| |
|
| <li id="p007_uvideo"> |
<li id="p007_uvideo"> |
| <font color="#009000"><strong>007: SECURITY FIX: May 17, 2016</strong></font> |
<strong>007: SECURITY FIX: May 17, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Insufficient checks in the uvideo(4) V4L2 ioctl handling leak kernel |
Insufficient checks in the uvideo(4) V4L2 ioctl handling leak kernel |
| memory contents to a local user. |
memory contents to a local user. |
|
|
| <p> |
<p> |
| |
|
| <li id="p008_bnx"> |
<li id="p008_bnx"> |
| <font color="#009000"><strong>008: RELIABILITY FIX: May 18, 2016</strong></font> |
<strong>008: RELIABILITY FIX: May 18, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix issue in the bnx(4) ethernet driver that could cause data corruption. |
Fix issue in the bnx(4) ethernet driver that could cause data corruption. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p009_crypto"> |
<li id="p009_crypto"> |
| <font color="#009000"><strong>009: RELIABILITY FIX: May 29, 2016</strong></font> |
<strong>009: RELIABILITY FIX: May 29, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix a bug in the libcrypto library when parsing certain ASN.1 elements. |
Fix a bug in the libcrypto library when parsing certain ASN.1 elements. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p010_libexpat"> |
<li id="p010_libexpat"> |
| <font color="#009000"><strong>010: SECURITY FIX: June 2, 2016</strong></font> |
<strong>010: SECURITY FIX: June 2, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Fix issues in the libexpat library to prevent multiple integer and |
Fix issues in the libexpat library to prevent multiple integer and |
| buffer overflows. |
buffer overflows. |
|
|
| <p> |
<p> |
| |
|
| <li id="p011_crypto"> |
<li id="p011_crypto"> |
| <font color="#009000"><strong>011: SECURITY FIX: June 6, 2016</strong></font> |
<strong>011: SECURITY FIX: June 6, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Correct a problem that prevents the DSA signing algorithm from running |
Correct a problem that prevents the DSA signing algorithm from running |
| in constant time even if the flag BN_FLG_CONSTTIME is set. |
in constant time even if the flag BN_FLG_CONSTTIME is set. |
|
|
| <p> |
<p> |
| |
|
| <li id="p012_crypto"> |
<li id="p012_crypto"> |
| <font color="#009000"><strong>012: SECURITY FIX: June 27, 2016</strong></font> |
<strong>012: SECURITY FIX: June 27, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Correct a problem that could result in incorrect parsing/encoding of times in OCSP messages. |
Correct a problem that could result in incorrect parsing/encoding of times in OCSP messages. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p013_splice"> |
<li id="p013_splice"> |
| <font color="#009000"><strong>013: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>013: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Splicing sockets in a loop could cause a kernel spin. |
Splicing sockets in a loop could cause a kernel spin. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p014_unp"> |
<li id="p014_unp"> |
| <font color="#009000"><strong>014: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>014: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Multiple processes exiting with a fd-passing control message on a |
Multiple processes exiting with a fd-passing control message on a |
| shared socket could crash the system. |
shared socket could crash the system. |
|
|
| <p> |
<p> |
| |
|
| <li id="p015_dirent"> |
<li id="p015_dirent"> |
| <font color="#009000"><strong>015: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>015: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| ufs_readdir failed to limit size of memory allocation, leading to panics. |
ufs_readdir failed to limit size of memory allocation, leading to panics. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p016_mmap"> |
<li id="p016_mmap"> |
| <font color="#009000"><strong>016: SECURITY FIX: July 14, 2016</strong></font> |
<strong>016: SECURITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| The mmap extension __MAP_NOFAULT could overcommit resources and crash |
The mmap extension __MAP_NOFAULT could overcommit resources and crash |
| the system. |
the system. |
|
|
| <p> |
<p> |
| |
|
| <li id="p017_arp"> |
<li id="p017_arp"> |
| <font color="#009000"><strong>017: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>017: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| A race occuring in the unlocked ARP input path can lead to a kernel |
A race occuring in the unlocked ARP input path can lead to a kernel |
| NULL dereference. |
NULL dereference. |
|
|
| <p> |
<p> |
| |
|
| <li id="p018_timeout"> |
<li id="p018_timeout"> |
| <font color="#009000"><strong>018: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>018: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Tick counting overflows could cause a kernel crash. |
Tick counting overflows could cause a kernel crash. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p019_kevent"> |
<li id="p019_kevent"> |
| <font color="#009000"><strong>019: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>019: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Invalid file descriptor use with kevent(2) could lead to a kernel crash. |
Invalid file descriptor use with kevent(2) could lead to a kernel crash. |
| <br> |
<br> |
|
|
| <p> |
<p> |
| |
|
| <li id="p020_amap"> |
<li id="p020_amap"> |
| <font color="#009000"><strong>020: RELIABILITY FIX: July 14, 2016</strong></font> |
<strong>020: RELIABILITY FIX: July 14, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| Unchecked parameters and integer overflows in the amap allocation routines |
Unchecked parameters and integer overflows in the amap allocation routines |
| could cause malloc(9) to either not allocate enough memory, leading to memory |
could cause malloc(9) to either not allocate enough memory, leading to memory |
|
|
| <p> |
<p> |
| |
|
| <li id="p021_relayd"> |
<li id="p021_relayd"> |
| <font color="#009000"><strong>021: RELIABILITY FIX: July 25, 2016</strong></font> |
<strong>021: RELIABILITY FIX: July 25, 2016</strong> |
| <i>All architectures</i><br> |
<i>All architectures</i><br> |
| When signaling an error to an HTTP relay client, the connection can be |
When signaling an error to an HTTP relay client, the connection can be |
| terminated prematurely, leading to a crash. |
terminated prematurely, leading to a crash. |
|
|
| <p> |
<p> |
| |
|
| <li id="p022_sysctl"> |
<li id="p022_sysctl"> |
| <font color="#009000"> |
<strong>022: RELIABILITY FIX: August 2, 2016</strong> |
| <strong>022: RELIABILITY FIX: August 2, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| A missing NULL check in sysctl code results in a crash. |
A missing NULL check in sysctl code results in a crash. |
|
|
| <p> |
<p> |
| |
|
| <li id="p023_uvmisavail"> |
<li id="p023_uvmisavail"> |
| <font color="#009000"> |
<strong>023: RELIABILITY FIX: August 2, 2016</strong> |
| <strong>023: RELIABILITY FIX: August 2, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Missing overflow checks in uvm may result in panics. |
Missing overflow checks in uvm may result in panics. |
|
|
| <p> |
<p> |
| |
|
| <li id="p024_perl"> |
<li id="p024_perl"> |
| <font color="#009000"> |
<strong>024: SECURITY FIX: August 6, 2016</strong> |
| <strong>024: SECURITY FIX: August 6, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Don't look in the current working directory for perl modules to load. |
Don't look in the current working directory for perl modules to load. |
|
|
| <p> |
<p> |
| |
|
| <li id="p025_relayd"> |
<li id="p025_relayd"> |
| <font color="#009000"> |
<strong>025: RELIABILITY FIX: August 6, 2016</strong> |
| <strong>025: RELIABILITY FIX: August 6, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Improve relayd's parsing of the Host-header by following RFC 7230 |
Improve relayd's parsing of the Host-header by following RFC 7230 |
|
|
| <p> |
<p> |
| |
|
| <li id="p026_wsfont"> |
<li id="p026_wsfont"> |
| <font color="#009000"> |
<strong>026: RELIABILITY FIX: September 17, 2016</strong> |
| <strong>026: RELIABILITY FIX: September 17, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Limit the number of wscons fonts that can be loaded into the kernel. |
Limit the number of wscons fonts that can be loaded into the kernel. |
|
|
| <p> |
<p> |
| |
|
| <li id="p027_libssl"> |
<li id="p027_libssl"> |
| <font color="#009000"> |
<strong>027: RELIABILITY FIX: September 22, 2016</strong> |
| <strong>027: RELIABILITY FIX: September 22, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Avoid unbounded memory growth in libssl, which can be triggered by a TLS |
Avoid unbounded memory growth in libssl, which can be triggered by a TLS |
|
|
| <p> |
<p> |
| |
|
| <li id="p028_libssl"> |
<li id="p028_libssl"> |
| <font color="#009000"> |
<strong>028: SECURITY FIX: September 22, 2016</strong> |
| <strong>028: SECURITY FIX: September 22, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Avoid falling back to a weak digest for (EC)DH when using SNI with libssl. |
Avoid falling back to a weak digest for (EC)DH when using SNI with libssl. |
|
|
| <p> |
<p> |
| |
|
| <li id="p029_xorg_libs"> |
<li id="p029_xorg_libs"> |
| <font color="#009000"> |
<strong>029: SECURITY FIX: October 4, 2016</strong> |
| <strong>029: SECURITY FIX: October 4, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Fix a number of issues in the way various X client libraries handle |
Fix a number of issues in the way various X client libraries handle |
|
|
| <p> |
<p> |
| |
|
| <li id="p030_ssh_kexinit"> |
<li id="p030_ssh_kexinit"> |
| <font color="#009000"> |
<strong>030: RELIABILITY FIX: October 10, 2016</strong> |
| <strong>030: RELIABILITY FIX: October 10, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| A protocol parsing bug in sshd can lead to unauthenticated memory |
A protocol parsing bug in sshd can lead to unauthenticated memory |
|
|
| <p> |
<p> |
| |
|
| <li id="p031_smtpd.patch"> |
<li id="p031_smtpd.patch"> |
| <font color="#009000"> |
<strong>031: RELIABILITY FIX: October 13, 2016</strong> |
| <strong>031: RELIABILITY FIX: October 13, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| A logic issue in smtpd's header parsing can cause SMTP sessions to hang. |
A logic issue in smtpd's header parsing can cause SMTP sessions to hang. |
|
|
| <p> |
<p> |
| |
|
| <li id="p032_libssl.patch"> |
<li id="p032_libssl.patch"> |
| <font color="#009000"> |
<strong>032: RELIABILITY FIX: November 5, 2016</strong> |
| <strong>032: RELIABILITY FIX: November 5, 2016</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Avoid continual processing of an unlimited number of TLS records. |
Avoid continual processing of an unlimited number of TLS records. |
|
|
| <p> |
<p> |
| |
|
| <li id="p033_libcrypto.patch"> |
<li id="p033_libcrypto.patch"> |
| <font color="#009000"> |
<strong>033: SECURITY FIX: January 5, 2017</strong> |
| <strong>033: SECURITY FIX: January 5, 2017</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Avoid possible side-channel leak of ECDSA private keys when signing. |
Avoid possible side-channel leak of ECDSA private keys when signing. |
|
|
| <p> |
<p> |
| |
|
| <li id="p034_httpd.patch"> |
<li id="p034_httpd.patch"> |
| <font color="#009000"> |
<strong>034: RELIABILITY FIX: January 31, 2017</strong> |
| <strong>034: RELIABILITY FIX: January 31, 2017</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| A bug in the processing of range heanders in httpd can lead to memory |
A bug in the processing of range heanders in httpd can lead to memory |
|
|
| <p> |
<p> |
| |
|
| <li id="p035_net80211.patch"> |
<li id="p035_net80211.patch"> |
| <font color="#009000"> |
<strong>035: SECURITY FIX: March 1, 2017</strong> |
| <strong>035: SECURITY FIX: March 1, 2017</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| WiFi clients using WPA1 or WPA2 are vulnerable to a man-in-the-middle attack |
WiFi clients using WPA1 or WPA2 are vulnerable to a man-in-the-middle attack |
|
|
| <p> |
<p> |
| |
|
| <li id="p036_pf.patch"> |
<li id="p036_pf.patch"> |
| <font color="#009000"> |
<strong>036: RELIABILITY FIX: March 9, 2017</strong> |
| <strong>036: RELIABILITY FIX: March 9, 2017</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| Prevent integer overflow in PF when calculating the adaptive timeout, |
Prevent integer overflow in PF when calculating the adaptive timeout, |
|
|
| <p> |
<p> |
| |
|
| <li id="p037_exec_elf.patch"> |
<li id="p037_exec_elf.patch"> |
| <font color="#009000"> |
<strong>037: SECURITY FIX: March 20, 2017</strong> |
| <strong>037: SECURITY FIX: March 20, 2017</strong></font> |
|
| <i>All architectures</i> |
<i>All architectures</i> |
| <br> |
<br> |
| ELF auxiliary vector storage leaks piece of kernel stack. |
ELF auxiliary vector storage leaks piece of kernel stack. |
|
|
| </ul> |
</ul> |
| |
|
| <hr> |
<hr> |
| |
|
| </body> |
|
| </html> |
|
![[BACK]](/icons/back.gif){kind=icon}
Return to errata59.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www