===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/plus.html,v
retrieving revision 1.1368
retrieving revision 1.1369
diff -u -r1.1368 -r1.1369
--- www/plus.html 2015/05/25 17:07:36 1.1368
+++ www/plus.html 2015/05/28 18:02:24 1.1369
@@ -77,6 +77,301 @@
+
+- In sshd(8), prevent authorized_keys options picked up on public key tests without a corresponding private key authentication being applied to other authentication methods.
+
- Pass fflag to VOP_POLL so vfs fifo functions can get at the file flags to check FREAD/FWRITE if needed.
+
- Avoid a NULL dereference in fd_getfile_mode().
+
- 5.6 and 5.7 SECURITY FIX: a remote user can crash httpd.8.
A source code patch exists for 5.6 and 5.7.
+ - 5.6 and 5.7 SECURITY FIX: malformed binaries could trigger kernel panics or view kernel memory
A source code patch exists for 5.6 and 5.7.
+ - 5.6 and 5.7 SECURITY FIX: multiple issues in cpio(1)/pax(1)/tar(1).
A source code patch exists for 5.6 and 5.7.
+ - Don't add a separate .got.plt section as it would result in a partially writable GOT. ld.so(1) will properly write-protect the single .got.
+
- Prevent a user after free in tun(4).
+
- In ix(4), set the correct media type for 1000baseLX SFPs.
+
- In grep(1), warn when the user specifies -R but no files, like GNU grep.
+
- Allow use of 1Gb 1000baseLX SFPs in 82599 ix(4) SFP+ port.
+
- Optimise sensor I/O in upd(4).
+
- Indroduce fd_getfile_mode() and use it were fd_getfile() is directly followed by a mode check.
+
+
- Fix two assertion failures in mandoc(1).
+
- Add the tmux and tmux-256color entries to termcap(5) and terminfo. This can be used inside tmux for correct italics support.
+
- In tmux(1), if default-terminal is set to "screen" or "screen-*", follow historic screen(1) behaviour and send smso (standout) instead of sitm (italics) for SGR 3.
+
- Fix a use after free and a NULL pointer access in mandoc(1).
+
- Support passing a template file for the auto-allocation to disklabel(8).
+
- Fix an fd leak in relayd(8).
+
+
- In sshd_config(5), allow ListenAddress, Port and AddressFamily in any order (bz#68).
+
- Avoid a NULL dereference in CBS_get_any_asn1_element().
+
- In libtls, reject a dNSName of " " for the subjectAltName extension, per RFC 5280.
+
- Explicitly include .codepatch and .codepatchend in .rodata such that the binutils 2.17 linker doesn't make them disappear.
+
- Protect the per-process itimerval structs with a mutex.
+
- On hppa, don't grab the kernel lock for clock interrupts. The way we use mutexes these days is incompatible with that practice and leads to deadlocks.
+
- In sf(4), fix a memory leak in an error path.
+
- In tmux(1), add select-layout -o to undo the last layout change.
+
+
- In file(1), fix a memory leak in an error path.
+
- In the installer, rework sshd enable root login questions in light of sshd PermitRootLogin default change. The new default is not to ask to enable root logins when a non-root user has been added.
+
- Make sshd(8) default to PermitRootLogin=no.
+
- Do not call nd6_purge() before purging the IPv6 addresses of a detached interface. This fixes a use after free introduced in r1.98 of src/sys/netinet6/in6.c.
+
- In file(1):
+
+- Add simple privilege separation.
+
- Use a systrace(4) sandbox with a short whitelist of allowed syscalls for the file(1) child process.
+
+ - In upd(4), parse the HID descriptor multiple times to find sensors. This avoid lookups in the hot path for sensors that depend on the value of others.
+
- In tmux(1), if the requested pane is already active, do not unzoom the window (or doanything else). This prevents mouse clicking when zoomed causing unzoom.
+
- Correctly write the 64bits of the HID 1, 4 and 5 registers on powerpc.
+
+
- Allow "sshd -f none" to skip reading the config file, much like"ssh -F none" does.
+
- In file(1), don't support -s on FIFOs.
+
- Let bgpd(8) check the length of the control socket path to make sure it fits -- just like bgpctl(8) does.
+
- Fix a typo in sndiod(8): the buffer size should be 7680 rather than 7860.
+
- Get dwc2 working on octeon:
+
+- Transplant the clock setup code from octhci.
+
- Add a bus space tag to deal with dwc2 using little endian addressing.
+
- ump up the rx fifo size, necessary for umass/sd to work.
+
+ - Support checksum offloading for IPv4 TX on vio(4).
+
- In bgpctl(8), for every policy we write out, flush the output so we don't get a partially written line.
+
- On i386, disable PAE when switching to the hibernate resume pagetables. This makes (un)hibernate work with the new PAE pmap.
+
- On i386, enable NX support in the resume path. This makes suspend/resume work with the PAE pmap.
+
- On i386, only enable PAE if the CPU we're running on has NX support.
+
- Bump i386 MAXDSIZ to 3 GB.
+
- Make the Belkin Components F5U109 Serial work at 115200 baud in umct(4).
+
+
- Require a PT_LOAD segment's p_filesz to be no larger than its p_memsz.
+
- In the IRR parser of bgpctl(8), ignore case when reading the tokens.
+
- We are now following the ABI and always clear cld on function entry, so remove the extra CLD instructions from when that wasn't true.
+
- In file(1), only print MIME warnings when warnings are enabled.
+
- Repair boot device detection when booting off the second SCSI controller on AV530.
+
- Update to perl 5.20.2.
+
- In file(1), fail if a \ appears at EOL of a magic(5) file rather than continuing off the end of the buffer.
+
- In LibreSSL, don't ignore the reference count in X509_STORE_free.
+
- In tmux(1), explicitly cancel mouse "button" mode. This happens implicitly with some of the other things we send with xterm, but not with urxvt.
+
- In m4(1) and make(1), adda check for overflow while doubling.
+
- In LibreSSL, check for invalid leading zeros in CBS_get_asn1_uint64.
+
- In bgpd(8), allow rules that match directly on the peer AS. Also adjust the IRR ruleset output to include the declared peer AS instead of hoping they listed their neighbor IP address.
+
- In httpd(8), prepend files or directories containing ":" with "./" in directory indexes as per RFC 3986.
+
- In bgpctl(8), handle an IRR record of "export ... action X" the same way we handle "import ... action X".
+
+
- Add a quirk to azalia(4) for the Cirrus Logic CS4208 which is needed for MacBookAir6,1.
+
- In tmux(1):
+
+- Set up the signal handler earlier so that we don't get zombies.
+
- Allow choice options (multiple states) to be toggled between states 0 and 1.
+
- Set the working directory for run-shell and if-shell.
+
+ - Enable PAE mode for those CPUs that support it. This allows us to use the NX bit for userland and kernel W^X. Unlike the previous c.2008 PAE experiment, this does not provide > 4GB phys ram on i386 -- PAE is solely being used for NX capability this time. If you need > 4GB phys, use amd64.
+
- Make sure we keep the whole recursive mapping of the PDP instead of just the mapping for the first page when tearing things down.
+
- Remove tip(1): it has been superseded by cu(1).
+
- In file(1):
+
+- If ~/.magic exists but can't be used, fail rather than silently falling back to /etc/magic.
+
- Do not attempt to use ~/.magic if running as root (or issetugid()).
+
+ - Add a new implementation of file(1). This is a simplified, modernised version with a nearly complete magic(5) parser but omits some of the complex builtin tests (notably ELF) and has a reduced set of options.
+
- Revert r1.7 of src/sys/arch/powerpc/include/atomic.h (implement the MI atomic API for PowerPC). This code triggers an off by one in device_unref().
+
- Enable the NX bit and use it in the PAE pmap code. PAE is still disabled while we're chasing at least one remaining bug.
+
- Fix a segfault in user(8).
+
+
- In ssh-agent(1), add the -D option to leave ssh-agent in foreground without enabling debug mode (bz#2381).
+
- Use "softintr_pic0" instead of "softintr_fakepic" when faking a struct device so there is enough space in the buffer for a NUL and the unit is included in the string.
+
- Fix a memory leak in ssh-askpass(1).
+
- In xlock(1), don't read past the end of an array.
+
- Fix a crash in httpd(8) and relayd(8): we cannot log errors with server_close() before allocating clt_log evbuffer.
+
- Fix a 13 year old typo that should be responsible for the unhappiness of UVM on PowerPC architectures.
+
- Replace the use of struct ifqueue in pipex with mbuf_queues.
+
+
- In sshd(8), check for and reject missing arguments for VersionAddendum and ForceCommand (bz#2281)
+
- Implement the MI atomic API for PowerPC to avoid using gcc builtins that include extra sync operations.
+
+
- Unknown certificate extensions are non-fatal in ssh, so don't fatal when they are encountered (bz#2387).
+
- In tmux(1):
+
+- Fix moving windows to nonexistent indexes when renumber-windows is off.
+
- Do not die on USR1 if any of the socket parent directories are missing.
+
- Always format real layout even when zoomed.
+
- Look up indexes as number before name. This makes more sense if windows are named starting with numbers.
+
+ - Remove an extra lcr3 that snuck into pmap_switch, responsible for various reaper panics.
+
- In rtadvd(8), don't let rltime exceed 9000 seconds, per RFC 4861.
+
- Avoid a use after free in mandoc(1).
+
- In tmux(1):
+
+- Pass mouse events through to commands for if-shell.
+
- Pass mouse events triggering a drag on to the application inside the pane.
+
- Bind mouse dragging so that it is passed through to applications if they want it.
+
+ - Revert r1.182 of src/sys/kern/subr_pool.c (try and place at least 8 items on a page if we're able to use large page allocators) again. Incoherent architectures aren't having much fun with it.
+
+
- In ntpd(8), fix a memory leak if tls_read() fails.
+
- Fix a memory leak in relayd(8).
+
- Rework sgi mutexes to use the owner pointer as the lock (similar to r1.14 of src/sys/arch/alpha/alpha/mutex.c).
+
- In tmux(1), add support for multiple key tables to commands to be bound to sequences of keys.
+
- In the installer, fix asking for list of http servers via "?". This should fix scanning for wireless networks too.
+
- In mandoc(1), avoid out-of-bounds read access. This sometimes prevented proper warnings about text nodes preceding the first section header.
+
- In tmux(1), make jump-to-backward/jump-to-forward repeatable withjump-reverse/jump-again.
+
- Remove a typo introduced in r1.185 of src/sys/net/route.c. Because of this typo, a local route was always created.
+
- Do not treat loopback interfaces as p2p interfaces and create only one route to ::1.
+
- Always call rt_ifa_dellocal(9) when removing an IPv6 address.
+
+
- In ping6(8), add a mac to the timestamp payload and calculate it with siphash (r1.119 and r1.121 from src/sbin/ping/ping.c).
+
- In ping(8), fold the icmp seq number into the mac.
+
- In tmux(1):
+
+- Support setting the default window and pane background colours.
+
- Rewrite of tmux mouse support which was a mess.
+
- Honour renumber-windows when unlinking a window.
+
+ - 5.5, 5.6 and 5.7 SECURITY FIX: logic error in smtpd handling of SNI.
A source patch is available for 5.5, 5.6 and 5.7.
+ - Fix incorrect logic in smtpd(8) that could lead to unexpected client disconnect, invalid certificate in SNI negotiation or server crash.
+
- Add support for x2apic mode. This is currently only enabled on hypervisors.
+
- In mandoc(1), if an explicit line break request (.br or .sp) occurs within an .HP block, the next line doesn't hang, but is simply indented.
+
- If apropos(1) finds no match, print "nothing appropriate" to stderr similar to what the old apropos did.
+
- Update to sqlite3 3.8.9.
+
- In ping(8):
+
+- Add a mac to the timestamp payload and calculate it with siphash.
+
- By default fill the ping payload with a chacha stream instead of an unvarying payload. By aggressively varying the payload we hope to generate more opportunities for dodgy network equipment to show errors.
+
+ - In xhci(4), do not truncate possible remaining transfer length.
+
- Remove emulation of OSS audio ioctls from Linux emulation.
+
- Implement binary code patching on i386.
+
+
- Enable th REG_READ ioctl.
+
- Don't lock the file for "vi -R" or "view".
+
- Work around what appear to be CPUID lies about the monitor-line size. This makes the mwait-based idle loop actually work.
+
- Convert many atoi() calls to strtonum() in userland, adding range checks and failure handling along the way.
+
- Remove kdriver/wscons code from Xserver(1).
+
- In systat(1) avoid calling freeifaddrs() uninitialised pointer in an error path.
+
- In httpd(8), strictly accept CRLF for newlines.
+
+
- In install(1), use futimens() to preserve timestamps with subsec precision.
+
- In pf(4), do not include padding of Ethernet packets in reassembled fragmented packets.
+
- In ssh, don't try to cleanup NULL KEX proposals in kex_prop_free().
+
- Change alpha mutexes so they record which cpu owns the lock rather than just if the lock is held or not.
+
- Remove the unsupported SADB_X_IDENTTYPE_CONNECTION, unused ipsp_parse_headers, and stubs and support code for NIC-enabled IPsec.
+
- Fix a crash in the bgpctl(8) "network bulk" command.
+
- In ualea(4), crank the timeout and decrease the buffer size to not end up dropping all the entropy provided by the device. Also make sure we match the right endpoint.
+
+
- Tweaks in utimensat/futimens handling:
+
+- Always update ctime, even when both atime and mtime are UTIME_OMIT (at least for ufs, tmpfs, and ext2fs).
+
- Correctly handle a timestamp of -1.
+
+ - Don't call record_login() in monitor when UseLogin is enabled (bz#378).
+
- Add some missing options to sshd -T and fix the output of VersionAddendum HostCertificate (bz#2346).
+
- In mandoc(1), restore the page headers and page footers in the HTML output.
+
- Remove unfinished and unused support for socket-attached ipsec-policies.
+
- In pkg_add(1), expand the %a, %c, %m and %v sequences in PKG_PATH.
+
- Add ualea(4) to support the Araneus Alea II TRNG.
+
+
- Plug a memory leak in sshd(8).
+
- In tmux(1), fix some issues in bright colour handling.
+
- Make tls_close(3) more robust.
+
- In tmux(1), fix setting old-style window -fg/-bg/-attr options that aren't global.
+
- In tun(4), fix a typo introduced in the niq_enqueue() conversion. This should fix a panic reported by many.
+
- Import libepoxy 1.2, a library for handling gl/glx/egl function pointer management. This is needed by glamor egl in the xserver which is in turn needed to get acceleration with some hardware on xf86-video-ati.
+
+
- Update to xf86-video-ati 7.5.0.
+
- Make ipsp_address thread safe.
+
- Remove support for storing credentials and auth information in the kernel. This code is largely unfinished and is not used for anything.
+
- In uchcom(4), make sure we close the interrupt pipe when the device is detached.
+
+
- Initialize RX/TX on re(4) slightly later. It appears that newer chips don't set up DMA correctly until more configuration has been done -- enabling RX too soon causes DMA to bad places.
+
- Perform IPsec bypass check on a socket before performing TDB lookups.
+
+
- In sed(1), correct a multiplication idiom during xreallocarray() and avoid an integer overflow.
+
- In ssh, deprecate the ancient, pre-RFC4419 and undocumented SSH2_MSG_KEX_DH_GEX_REQUEST_OLD message.
+
- Prevent use after free in mg(1).
+
- Let nl_langinfo(CODESET) return "US-ASCII" as the name of the character codeset for the POSIX/C default locale. This is the preferred IANA name and also used by FreeBSD.
+
- Update to xf86-video-intel 2.99.916. This fixes a display bug. Newer X.Org (2.99.917 or master) versions cause corruption on older machines (X40, i965), probably caused by a bug in our kernel. This is under investigation by kettenis@.
+
- Bring PAE code back to life on i386. More specifically, bring the PAE pmap on i386 closer to the current non-PAE pmap. This allows us to take a big next step toward better i386 W^X in the kernel (similar to what we did a few months ago on amd64). Unlike the original PAE pmap, this diff will not be supporting more than 4 GB physical memory on i386 -- this effort is specifically geared toward providing W^X (via NX) only. There still seems to be a bug removing certain pmap entries when PAE is enabled, so PAE mode is left disabled for the moment.
+
- Switch example NSD config to splitting master and slave zones into different subdirectories and create these in mtree.
+
- Disable the pool garbage collector. There are reports of strange lockups on various multiprocessor architectures and this is the only interesting diff in the window.
+
+
- In softraid(4), directly handle ioctls issued to a SCSI device associated with a softraid volume, ignoring any device name specified in the bio(4) ioctl struct. Amongst other things, this makes bioctl -d now work with DUIDs.
+
- In softraid(4), re-enable the RAID 5 discipline and add support for restarting rebuilds on it.
+
- Remove OPENSSL_issetugid() from LibreSSL. By default on systems lacking true issetugid(), OPENSSL_issetugid() returns 0, falsely indicating safety. This means OPENSSL_issetugid() fails to make any sort of promise about safety, in fact it is just the opposite.
+
- Update to xf86-input-synaptics 1.8.2.
+
- Remove all getenv() calls in LibreSSL, especially those wrapped by issetugid(). getenv()'s wrapped by issetugid() are safe, but issetugid() is difficult to implement on many operating systems.
+
- In httpd(8), always check the return value of proc_composev_imsg() and handle failures appropriately. Otherwise imsg construction can silently fail, resulting in non-obvious problems.
+
+
- Let vi(1) use resizeterm(3) instead of reinitializing curses on window resizes, which was leaking massive amounts of memory.
+
- In tmux(1), add a -x flag to copy-selection, append-selection and start-named-buffer to prevent it exiting copy mode after copying.
+
- Replace the use of ifqueues for most input queues serviced by netisr with niqueues.
+
- In ehci(4), implement full-speed isochronous transfers support with opportunistic micro-frames scheduling. More work is required to properly budget and schedule micro-frames, most of it at the HUB level. But this let people use USB1.1 uaudio(4) devices on ehci(4)-only systems.
+
- Add support for CRC-enabled elantech v3 touchpads to pms(4).
+
+
- In ssh(1), don't send hostkey advertisments (hostkeys-00@openssh.com) to current versions of Tera Term as they can't handle them. Newer versions should be OK.
+
- In vlan(4), don't inherit the parent interface's hardmtu as the vlan interface's mtu when it gets set up. Instead, allow the vlan interface's mtu to be raised to the parent's hardmtu in SIOCSIFMTU handling.
+
- In zmore(1) and zless(1), accept options starting with "+".
+
- In whois(1), improve the lookup of gTLDs.
+
- Make the sparc64 pmap (more) mpsafe by protecting both the pmap itself and the pv lists with a mutex.
+
- Plug a memory leak in pf(4).
+
+
- Fix a regression on re(4) chips that have 7k jumbo support.
+
- Move vmap back to kernel_map/uvm_km_valloc as it's allowed to fail. This should fix the Dell 2950 when it gets stuck during boot.
+
- In tsec(4), prevent the watchdog from firing when no cable is plugged in but the interface is brought up.
+
- In iwn(4), don't leak the chip's hardware address during scans when a randomized address is set by the user.
+
+
- In tmux(1), when replacing, don't free the old paste until after the new one's name has been copied. This fixes a use-after-free in window-copy.c.
+
- Introduce a garbage collector for (very) idle pool pages.
+
+
- Remove the obsolete timezone(3) function.
+
- Make pthread_atfork(3) track the DSO that called it like atexit(3) does, unregistering callbacks if the DSO is unloaded. Move the callback handling from libpthread to libc, though libpthread still overrides the inner call to handle locking and thread-library reinitialization.
+
- In mandoc(1), do not mistreat empty arguments to font alternating macros as vertical spacing requests.
+
- Remove DES support from crypt(3).
+
- Add support for an efi-app-x86_64 target to binutils. This is needed for UEFI bootloader work.
+
- In mandoc(1), use the default width for .RS without arguments. This reduces groff-mandoc differences in base and Xenocara by about 4%.
+
- Update to xcb-util 0.4.0, xcb-util-image 0.4.0, xcb-util-keysyms 0.4.0, libXxf86vm 1.1.4, libXvMC 1.0.9, libXdmcp 1.1.2 and libX11 1.6.3.
+
- In pkg_info(1), check that the info of distant packages is signed.
+
- In pkg_add(1),
+mark installed locations as "trusted" so that pkg_info does not check sigs
+on them.
+
- In realloc(3), when expanding a region, actually use the free page cache instead of simply zapping it. This can save many syscalls in a program that repeatedly grows and shrinks a buffer.
+
+
- Work-in-progress support for non-accelerated X11 on some sti(4) frame buffers; based upon the old HP ngle X11 driver. Currently limited to CRX (720/735/750), Timber (710, old 715), Artist (712, 715) and EG (B-series). However, the colormap isn't set up correctly on Timber and EG yet.
+
- Various improvements to sort(1):
+
+- Do not permute command line arguments, but still support the obsolescent "-o outfile" after input files syntax.
+
- The -b flag should only apply when key fields are specified. If -b follows -k it has no effect.
+
- For the -g flag, treat non-floating point keys as 0, similar to -n. This makes "sort -gu" and "sort -nu" behave similarly and passes our sort regress tests.
+
+
+ - Update to sqlite3 3.8.8.3.
+
- Give man(7) section and subsection headers hanging indentation. This reduces groff-mandoc differences in base by about 2.5%.
+
- Better implementation of rounding rules in mandoc(1).
+
- Show the remote labels in the ldpctl(8) "show lib" command even if they are not installed in the FIB.
+
- Remove lo protection in ldpd(8). There's no need to protect the 127/8 network since it is filtered before being sent to lde.
+
- Show the full LIB in the ldpctl(8) "show lib" command.
+
- Add support for commit ids to "opencvs status".
+
- Fix the modified timestamp in the output of "opencvs status".
+
- In mandoc(1), don't allow breaking the output line after hyphens following escape sequences. Improves tic(1), sxpm(1) and a few Perl manuals.
+
- Use config_suspend() instead of dereferencing ca_activate directly to support drivers that do not need any specific suspend/resume magic and do not have an activate function. This is needed at least by kauaiata(4).
+
- In mandoc(1), fix a quirk with respect to an empty .HP.
+
+
- In sti(4), fix an unsigned vs signed comparison causing an infinite loop for the WSDISPLAYIO_PUTCMAP ioctl.
+
- In sort(1):
+
+- If -S has been supplied multiple times, only take last one into account.
+
- If -c (or -C) has been specified, only perform that action and ignore -o among other arguments.
+
- Allow only one input file with the -c and -C flags.
+
+ - In apropos(1), man(1) and mandoc(1), don't hardcode /usr/bin/ as the path to more(1).
+
+
- In sort(1), prevent an integer overflow when parsing the -S argument as percentage. Also make sure that the parsed memory amount won't be larger than SIZE_MAX to properly support 32-bit systems.
+
- Change gcc and ld semantics to make static PIE the default when invoking "cc -static".
+
+
- Many improvements to sort(1), including:
+
+- Use strtonum(3) to parse the argument to --batch-size.
+
- Use mkstemp(3) to generate a new temporary file name.
+
- Use reallocarray(3) where appropriate.
+
- Prevent a tiny signal race by blocking signals when inserting into the tmp_files list.
+
- Check for overflow when handling buffer size suffixes.
+
+ - Run most of the vnet(4) interrupt handler without holding the kernel lock.
- In httpd(8), zero the tls cert/key length variables when inheriting a server configuration for multiple listen statements in a server block. Otherwise httpd(8) will crash when a listen statement with tls is followed by a listen statement without tls.
- Prevent ssh(1) from warning about SSH1 keys present when compiled without SSH1 support. Also identify SSH1 keys when scanning, even when compiled without SSH1 support.
@@ -138,7 +433,7 @@
- Fix a memory leak in ssh(1).
- Work around broken device-tree in PowerMac7,2 and PowerMac7,3 (K2 systems) and get the correct offsets from the "i2s" node.
-
- Remove lmc(4) and san(4).
+
- Remove lmc(4), san(4) and lmccontrol(8).
- Use chacha20-poly1305@openssh.com as the default cipher in ssh.
- Disable SSH protocol 1 in ssh.
@@ -174,6 +469,8 @@
- Fix a memory leak in an error path in LibreSSL (from OpenSSL commit 5e5d53d341fd9a9b9cc0a58eb3690832ca7a511f).
- Fix a small memory leak in sort(1).
+
- 5.6 and 5.7 SECURITY FIX: several crash causing defects in OpenSSL (CVE-2015-0209, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288 and CVE-2015-0289.
A source code patch is available for 5.6 and 5.7.
+ - 5.5 SECURITY FIX: two possible crash causing defects in OpenSSL (CVE-2015-0286 and CVE-2015-0292).
A source code patch is available for 5.5.
- Fix CVE-2015-0209, CVE-2015-0286, CVE-2015-0287 and CVE-2015-0289 in LibreSSL.
- Deal with half-configured control pipes in dwc2, using the same workaround as in ehci(4) and ohci(4).
@@ -187,6 +484,7 @@
- Reenable the pa1.1 fallback code for sha256 on hppa.
- "Handle" wccp2 packets if net.inet.gre.wccp is set to 2 by truncating skipping the wccp 2 header.
+
- 5.5, 5.6 and 5.7 SECURITY FIX: buffer overflows in libXfont (CVE-2015-1802, CVE-2015-1803 and CVE-2015-1804).
A source code patch is available for 5.5, 5.6 and 5.7.
- Update to libXfont 1.5.1 which contains fixes for CVE-2015-1802, CVE-2015-1803 and CVE-2015-1804.
- Fix swap auto-allocation in disklabel(8) for machines with very little memory.
- Replace sort(1) with the implementation from FreeBSD.
@@ -253,7 +551,7 @@
- Make -DSHORTENED the default in pkg_add(1).
- Move i386 pvlists to pool backed, and improve the locking using mutexes.
-
- Various fixes for pax(1)/tar(1):
+
- Various fixes for cpio(1)/pax(1)/tar(1):
- Prevent an archive from escaping the current directory by itself.
- For tar without -P, if a path in the archive has any ".." components, then strip everything up to and including the last of them (if it ends in ".." then it becomes ".").