=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/plus.html,v retrieving revision 1.1394 retrieving revision 1.1395 diff -c -r1.1394 -r1.1395 *** www/plus.html 2016/08/02 21:20:46 1.1394 --- www/plus.html 2016/08/04 22:29:31 1.1395 *************** *** 81,86 **** --- 81,181 ----

In libssl, limit the support of the "backward compatible" ssl2 handshake to only be used if TLS 1.0 is enabled. +
In ldpd(8): +
- Update per-neighbor GTSM options on config reload. +
- Explicitly ignore the Hop Count and Path Vector TLVs. +
- Improve logging of reserved labels. +
+
Disable acpicbkbd(4) by default until after the release. It causes the kernel to spin forever on certain Chromebooks. + +
In ssh(1), reduce the syslog level of some relatively common protocol events from LOG_CRIT (bz#2585). +
Add a ProxyJump ssh_config(5) option and a corresponding -J ssh(1) command-line flag to allow simplified indirection through a SSH bastion or "jump host". +
5.8 and 5.9 RELIABILITY FIX: Splicing sockets in a loop could cause a kernel spin.
A source code patch is available for 5.8 and 5.9. +
5.8 and 5.9 RELIABILITY FIX: ufs_readdir failed to limit size of memory allocation, leading to panics.
A source code patch is available for 5.8 and 5.9. +
5.8 and 5.9 SECURITY FIX: The mmap extension __MAP_NOFAULT could overcommit resources and crash the system.
A source code patch is available for 5.8 and 5.9. +
5.8 and 5.9 RELIABILITY FIX: Tick counting overflows could cause a kernel crash.
A source code patch is available for 5.8 and 5.9. +
5.8 and 5.9 RELIABILITY FIX: Invalid file descriptor use with kevent(2) could lead to a kernel crash.
A source code patch is available for 5.8 and 5.9. +
5.8 and 5.9 RELIABILITY FIX: Unchecked parameters and integer overflows in the amap allocation routines could cause malloc(9) to either not allocate enough memory, leading to memory corruption, or to trigger a "malloc: allocation too large" panic.
A source code patch is available for 5.8 and 5.9. +
5.9 RELIABILITY FIX: Multiple processes exiting with a fd-passing control message on a shared socket could crash the system.
A source code patch is available for 5.9. +
5.9 RELIABILITY FIX: A race occuring in the unlocked ARP input path can lead to a kernel NULL dereference.
A source code patch is available for 5.9. +
Ensure that amap slot calculation does not overflow. This prevents from too small amaps being allocated by forcing the allocation of a large number of slots. +
Ignore the kern.usermount sysctl(8). It is unsafe, because it allows any non-pledge(2)'d program to call the mount/umount system calls. The sysctl will be completely removed in 6.1. +
In ip6(4), dDrop received packets with an IPv4-compatible address as source or destination as per RFC4213. +
In fec(4/armv7, do board-specific delay/skew corrections for the Micrel KSZ9021 and KSZ9031 PHYs based on device tree properties instead of the board ID. +
Prevent a use-after-free by not updating an ARP entry that has been removed from the table. +
In vioblk(4), properly handle poll timeout. + +
Avoid a panic caused by very big mallocs for the ufs_readdir() buffer which should have been limited to 64 kB. +
Avoid a panic caused by very big mallocs that result from uint64-to-int32 truncation when kevent does fd validation. +
On amd64, add hvn(4), a work-in-progress driver for the Hyper-V NetVSC. +
In calendar(1), when matching a day in the month, ensure the date is still in the month we are interested in. This + fixes things like Sunday+5 for months where there is not a 5th Sunday. +
In bpgd(8), output the no-longer-so-new AS operators when printing the configuration. +
In libtls, split the existing TLS cipher suite groups into four: secure, compat, legacy and insecure. +
Check resource limits for mappings established using __MAP_NOFAULT. This prevents callers from triggering a kernel panic and a potential integer overflow in the amap code by forcing the allocation of too many slots. +
In imxehci(4), use the device tree voltage regulator information to supply power to the USB bus, because this only supports "fixed" regulators that are controlled through a gpio. + +
Fix a crash when MNT_DOOMED is passed in the flags to unmount(2). +
In syslogd(8), add support for TLS client certificates in syslogd. This allows the remote server to verify the authenticity of received messages. + +
In tmpfs, don't allow mounting with noval owner. It causes a panic later on. +
In factor(6), use an integer version of the Newton method instead of using the floating point square root. This fixes a rounding issue. +
In imxesdhc(4/armv7) and fec(4/armv7, use the gpio framework to implement card detect instead of hardcoding particular gpios based on board IDs. +
Hook up imxgpio(4) to the FDT gpio framework. +
Fix path MTU discovery which was slightly broken: it took two ICMP packets to create and change the dynamic route. +
In tcp(4), do not increase the size of the socket buffer under memory pressure. + +
In tcpdump(8), recognize MPLS pseudowire with control words. Also print encapsulated ethernet packets. +
In acpimadt(4), properly handle Processor Local X2APIC structures. This makes secondary CPUs attach on the HP DL360 gen 9. +
Dynamically attach imxgpio(4) using the FDT. +
In mandoc(1), fix a bug causing .so links to gzipped manuals to fail in the absence of a mandoc.db(5) database. + +
In omap(4/armv7), follow imx and match based on the compatible property of the root node in the fdt instead of attaching the device based on board IDs. +
Dynamically attach i.MX6 ehci(4) using the FDT. + +
In ssh(1), improve crypto ordering for Encrypt-then-MAC (EtM) mode MAC algorithms. This prevents the possibility of a side-channel oracle, though no such oracle has been identified. +
In perl(1), fix a bug where XSLoader could try to load from a subdir of the cwd when called via eval (CVE-2016-6185). + +
In malloc(3), correctly implement the three-valued J/j option. +
In syslogd.conf(5), allow space-deliminated fields in syslog.conf in addition to traditional tabs-deliminated fields. +
Various cleanups in route6d(8). +
Fix several places where calculating ticks could overflow, because on arithmetic overflows the compiler may decide to do anything. + +
In libtls, correctly handle an EOF that occurs prior to the TLS handshake completing. +
Update to tzdata2016f. +
Build eeprom(8) on octeon. +
On octeon, add openprom(4). + +
In libcrypto, add several fixes to make OCSP work with intermediate certificates provided in the response. +
In ld.so(1), remove unfinished prebind support. +
Avoid an integer overflow of the thrsleep() timeout. This prevents a panic. +
On the Quad-G5, make hpb(4) attach first when iterating PCI buses to allow openpic(4) to properly map interrupt for the devices instead of possibly dereferencing garbage. +
In rtable(4) + +
In savecore(8), drop support for the undocumented second argument. +
In rcs(1), implement the -I option. +
In smtpd(8), add the -r option to the enqueuer for compatibility with mailx. + +
Introduce the "chown" pledge(2). +
Update to perl 5.20.3. +
In rebound(8), avoid a crash by checking the cache tree for collisions when inserting replies. +
In aoa(4/macppc), support the AOAShasta soundchip found on PowerMac9,1. + +
In ldpd(8): +
- Add GTSM support (RFC 6720). +
- Decrease the initialization FSM timeout. This allows quicker recovery of a session with a neighbor. +
- Improve RFC 4447 compliance. +
+
In cat(1), indent the '$' on blank lines when the -ne options are used. +
Make accepted sockets inherit IP_TTL from the listening socket. +
Allow resetting the IP_TTL and IP_MINTTL sockopts. +
Fix an issue where syslogd.8 would print 15 NUL bytes followed by two blank spaces before the log message for warnings generated while parsing syslog.conf. +
Add acpicbkbd(4), a simple keyboard backlight driver for some Chromebooks. +
On armv7, allow booting on SolidRun's HummingBoards and CuBoxes.
In sndiod(8), avoid triggering watchdog time-outs which prevent sndiod from resuming.
Update perl Time::HiRes to 1.9739.