! Note: Problems for which patches exist are marked in red.
For changes in other releases, click below:
--- 33,39 ----
or use CVS.
! Note: Problems for which patches exist are marked in red.
For changes in other releases, click below:
***************
*** 82,88 ****
!
Changes made between OpenBSD 5.8 and 5.9
--- 88,94 ----
!
Changes made between OpenBSD 5.8 and 5.9
***************
*** 406,412 ****
Prevent a NULL dereference when detaching a USB device with ugen(4) disabled or if allocating memory during the attachment process failed.
On octeon, add support for a variety of USB devices.
In ssh, remove roaming support altogether.
!
5.7 and 5.8 SECURITY FIX: experimental roaming code in the ssh client could be tricked by a hostile sshd server, potentially leaking key material (CVE-2016-0777 and CVE-0216-0778). A source code patch and workaround is available for 5.7 and 5.8.
In ssh(1), disable experimental client-side roaming support.
Grab the kernel lock before delivering a message to the routing socket when an ARP resolution has been done. This should fix the "receive 1" panic.
In pfctl(8), print an error message when detecting multiple root queues on a single interface.
--- 412,418 ----
Prevent a NULL dereference when detaching a USB device with ugen(4) disabled or if allocating memory during the attachment process failed.
On octeon, add support for a variety of USB devices.
In ssh, remove roaming support altogether.
!
5.7 and 5.8 SECURITY FIX: experimental roaming code in the ssh client could be tricked by a hostile sshd server, potentially leaking key material (CVE-2016-0777 and CVE-0216-0778). A source code patch and workaround is available for 5.7 and 5.8.
In ssh(1), disable experimental client-side roaming support.
Grab the kernel lock before delivering a message to the routing socket when an ARP resolution has been done. This should fix the "receive 1" panic.
In pfctl(8), print an error message when detecting multiple root queues on a single interface.
***************
*** 735,741 ****
In vmm(4), restore VMM mode after resume from suspend/hibernate.
In vmd(8), terminate all running VMs on startup: it is not possible to pick up state of "zombie" VMs yet.
In as(1), implement the .inst assembler directive for arm.
! Ensure the same CPU numbering is used for the kern.cptime2 sysctl as for kern.proc. This fixes an issue in top(1) where a CPU would seem to be idle even though a thread was reported to be running on it.
In ssh(1), prefer rsa-sha2-512 over -256 for hostkeys.
Update termtypes.master to upstream terminfo-20151128.
In rc.conf(8), merge "multicast_router" and "multicast_host" into a single "multicast" configuration variable.
--- 741,747 ----
In vmm(4), restore VMM mode after resume from suspend/hibernate.
In vmd(8), terminate all running VMs on startup: it is not possible to pick up state of "zombie" VMs yet.
In as(1), implement the .inst assembler directive for arm.
!
Ensure the same CPU numbering is used for the kern.cptime2 sysctl as for kern.proc. This fixes an issue in top(1) where a CPU would seem to be idle even though a thread was reported to be running on it.
In ssh(1), prefer rsa-sha2-512 over -256 for hostkeys.
Update termtypes.master to upstream terminfo-20151128.
In rc.conf(8), merge "multicast_router" and "multicast_host" into a single "multicast" configuration variable.
***************
*** 751,757 ****
In vmctl(8), add -c to the "start" subcommand to automatically connect to the VM console after startup.
Add a few kernel lock improvements in the network stack.
!
5.7 and 5.8 RELIABILITY FIX: a NULL pointer deference could be triggered by a crafted certificate sent to services configured to verify client certificates on TLS/SSL connections. A source code patch is available for 5.7 and 5.8.
Add a fix for OpenSSL CVE-2015-3195 and one for OpenSSL CVE-2015-3195.
In vmctl(8), re-add the "load" and "reload" commands.
Re-enable acceleration on Broadwell.
--- 757,763 ----
In vmctl(8), add -c to the "start" subcommand to automatically connect to the VM console after startup.
Add a few kernel lock improvements in the network stack.
!
5.7 and 5.8 RELIABILITY FIX: a NULL pointer deference could be triggered by a crafted certificate sent to services configured to verify client certificates on TLS/SSL connections. A source code patch is available for 5.7 and 5.8.
Add a fix for OpenSSL CVE-2015-3195 and one for OpenSSL CVE-2015-3195.
In vmctl(8), re-add the "load" and "reload" commands.
Re-enable acceleration on Broadwell.
***************
*** 1039,1045 ****
5.7 and 5.8 RELIABILITY FIX: insufficient validation of RSN element group cipher values in 802.11 beacons and probe responses could result in system panics. A source code patch is available for 5.7 and 5.8.
5.7 and 5.8 RELIABILITY FIX: insufficient validation of RSN element group cipher values in 802.11 beacons and probe responses could result in system panics. A source code patch is available for 5.7 and 5.8.
Use the correct rdomain(4) when sending gre(4) keepalive packets.
***************
*** 1306,1316 ****
In smtpctl(8), allow "all" as an argument for the "resume envelope", "pause envelope" and "remove" subcommands.
In tcpdump(8), fix a crash that occurs when printing the filename in a malformed NFS request packet.
!
5.6, 5.7 and 5.8 RELIABILITY FIX: the OBJ_obj2txt function in libcrypto contains a one byte buffer overrun and memory leak. A source code patch is available for 5.6, 5.7, 5.8.
In tar(1), use a strict $PATH to run the (de)compressors.
In newsyslog.conf(5), allow the wheel group to read /var/log/maillog.
!
RELEASE CD ISSUE: the "src.tar.gz" file on the source tree was created on the wrong day and does not match the 5.8 release builds. A replacement file is available for 5.8.
!
5.6, 5.7 and 5.8 RELIABILITY FIX: a problem with timer kevents could result in a kernel hang (local denial of service). A source code patch is available for 5.6, 5.7 and 5.8.
In smtpctl(8), allow "all" as an argument for the "resume envelope", "pause envelope" and "remove" subcommands.
In tcpdump(8), fix a crash that occurs when printing the filename in a malformed NFS request packet.
!
5.6, 5.7 and 5.8 RELIABILITY FIX: the OBJ_obj2txt function in libcrypto contains a one byte buffer overrun and memory leak. A source code patch is available for 5.6, 5.7, 5.8.
In tar(1), use a strict $PATH to run the (de)compressors.
In newsyslog.conf(5), allow the wheel group to read /var/log/maillog.
!
RELEASE CD ISSUE: the "src.tar.gz" file on the source tree was created on the wrong day and does not match the 5.8 release builds. A replacement file is available for 5.8.
!
5.6, 5.7 and 5.8 RELIABILITY FIX: a problem with timer kevents could result in a kernel hang (local denial of service). A source code patch is available for 5.6, 5.7 and 5.8.
When multiple vxlan(4) interfaces are configured with same VNI, select the interface whose tunnel destination corresponded to the incoming packets' source address.
In libssl, fix reference counting and memory leak in error path in an error path.
--- 1412,1418 ----
When multiple vxlan(4) interfaces are configured with same VNI, select the interface whose tunnel destination corresponded to the incoming packets' source address.
In libssl, fix reference counting and memory leak in error path in an error path.
***************
*** 1425,1431 ****
Add ktracing of argv and envp to execve(2), with envp not traced by default.
Do not allow connection IDs to wrap and collide with another active connection ID. This allows a local user to force the daemon to exit.
--- 1431,1437 ----
Add ktracing of argv and envp to execve(2), with envp not traced by default.
Do not allow connection IDs to wrap and collide with another active connection ID. This allows a local user to force the daemon to exit.
***************
*** 1461,1470 ****
In mg(1), fix the location of the cursor when opening a directory using filevisit, findvisitalt and poptofile.
In mg(1), make dired mode treat a double "/" in a path like fundamental mode.
***************
*** 1800,1806 ****
On sparc64, add support for switching CPUs in ddb(4).
On sh, use kbind(2) for lazy binding GOT/PLT updates.
Make gdb(1) work again on mips64 PIE binaries by making sure a reasonable 64-bit ABI is selected for 64-bit ELF files instead of a 32-bit ABI.
!
5.8 SECURITY FIX: LibreSSL 2.2.2 incorrectly handles ClientHello messages that do not include TLS extensions, resulting in such handshakes being aborted. A source code patch is available for 5.8.
In apmd(8), log battery changes every 10%, not every 21%.
In envy(4), disable interrupts while the midi uart is not in use. This avoids generating unused interrupts when a chatty peripheral is connected but not used.
In binutils 2.17, add support for Irix-style "64-bit" archives.
--- 1806,1812 ----
On sparc64, add support for switching CPUs in ddb(4).
On sh, use kbind(2) for lazy binding GOT/PLT updates.
Make gdb(1) work again on mips64 PIE binaries by making sure a reasonable 64-bit ABI is selected for 64-bit ELF files instead of a 32-bit ABI.
!
5.8 SECURITY FIX: LibreSSL 2.2.2 incorrectly handles ClientHello messages that do not include TLS extensions, resulting in such handshakes being aborted. A source code patch is available for 5.8.
In apmd(8), log battery changes every 10%, not every 21%.
In envy(4), disable interrupts while the midi uart is not in use. This avoids generating unused interrupts when a chatty peripheral is connected but not used.
In binutils 2.17, add support for Irix-style "64-bit" archives.
***************
*** 1826,1832 ****
On hppa, use kbind(2) for lazy binding GOT/PLT updates.
Add more overflow checks to libexpat.
!
5.8 SECURITY FIX: in sshd(8), inverted logic made PermitRootLogin "prohibit-password" unsafe. A source code patch is available for 5.8.
Let MBR have priority over GPT.
Fix an alignment issue in bridge(4).
--- 1832,1838 ----
On hppa, use kbind(2) for lazy binding GOT/PLT updates.
Add more overflow checks to libexpat.
!
5.8 SECURITY FIX: in sshd(8), inverted logic made PermitRootLogin "prohibit-password" unsafe. A source code patch is available for 5.8.
Let MBR have priority over GPT.
Fix an alignment issue in bridge(4).
***************
*** 1943,1949 ****
In whois(1), fix whois server detection for new TLDs.
Accept NULL pointers in rtfree(9). This will simplify upcoming conversions of rt_refcnt-- to rtfree(9).
!
5.6 and 5.7 SECURITY FIX: a change to sshd(8) resulted in incorrect permissions being applied to pseudo terminal devices, allowing local users to write to (but not read from) them. A source code patch is available for 5.7.
Avoid a TOCTOU problem in if_input in the bpf handling.
--- 1949,1955 ----
In whois(1), fix whois server detection for new TLDs.
Accept NULL pointers in rtfree(9). This will simplify upcoming conversions of rt_refcnt-- to rtfree(9).
!
5.6 and 5.7 SECURITY FIX: a change to sshd(8) resulted in incorrect permissions being applied to pseudo terminal devices, allowing local users to write to (but not read from) them. A source code patch is available for 5.7.