===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/security.html,v
retrieving revision 1.329
retrieving revision 1.330
diff -u -r1.329 -r1.330
--- www/security.html	2006/09/09 03:04:22	1.329
+++ www/security.html	2006/10/07 18:07:36	1.330
@@ -232,6 +232,15 @@
 
 <p>
 <ul>
+<li><a href="errata.html#systrace">Oct 7, 2006:
+	Fix for an integer overflow in systrace's STRIOCREPLACE support,
+	found by Chris Evans.</a>
+<li><a href="errata.html#openssl2">Oct 7, 2006:
+	Several problems have been found in OpenSSL.</a>
+<li><a href="errata.html#httpd2">Oct 7, 2006:
+	httpd(8) does not sanitize the Expect header from an HTTP request
+	when it is reflected back in an error message, which might allow
+	cross-site scripting (XSS) style attacks.</a>
 <li><a href="errata.html#openssl">Sep 8, 2006:
 	Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is
 	possible for an attacker to construct an invalid signature which
@@ -276,6 +285,15 @@
 
 <p>
 <ul>
+<li><a href="errata38.html#systrace">Oct 7, 2006:
+	Fix for an integer overflow in systrace's STRIOCREPLACE support,
+	found by Chris Evans.</a>
+<li><a href="errata38.html#openssl2">Oct 7, 2006:
+	Several problems have been found in OpenSSL.</a>
+<li><a href="errata38.html#httpd2">Oct 7, 2006:
+	httpd(8) does not sanitize the Expect header from an HTTP request
+	when it is reflected back in an error message, which might allow
+	cross-site scripting (XSS) style attacks.</a>
 <li><a href="errata38.html#openssl">Sep 8, 2006:
 	Due to incorrect PKCS#1 v1.5 padding validation in OpenSSL, it is
 	possible for an attacker to construct an invalid signature which
@@ -1487,7 +1505,7 @@
 <a href="index.html"><img height=24 width=24 src="back.gif" border=0 alt="OpenBSD"></a>
 <a href="mailto:www@openbsd.org">www@openbsd.org</a>
 <br>
-<small>$OpenBSD: security.html,v 1.329 2006/09/09 03:04:22 brad Exp $</small>
+<small>$OpenBSD: security.html,v 1.330 2006/10/07 18:07:36 brad Exp $</small>
 
 </body>
 </html>