===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/security.html,v
retrieving revision 1.333
retrieving revision 1.334
diff -u -r1.333 -r1.334
--- www/security.html	2006/10/30 21:11:21	1.333
+++ www/security.html	2006/11/04 03:02:28	1.334
@@ -58,7 +58,8 @@
 <a href="#36">3.6</a>,
 <a href="#37">3.7</a>,
 <a href="#38">3.8</a>,
-<a href="#39">3.9</a>.
+<a href="#39">3.9</a>,
+<a href="#40">4.0</a>.
 </td>
 </tr>
 </table>
@@ -223,6 +224,27 @@
 <li><h3><font color="#e00000">Advisories</font></h3><p>
 
 <li>
+<a name="40"></a>
+
+<h3><font color="#e00000">OpenBSD 4.0 Security Advisories</font></h3>
+These are the OpenBSD 4.0 advisories -- all these problems are solved
+in <a href=anoncvs.html>OpenBSD current</a> and the
+<a href=stable.html>patch branch</a>.
+
+<p>
+<ul>
+<li><a href="errata.html#systrace">Oct 7, 2006:
+	Fix for an integer overflow in systrace(4)'s STRIOCREPLACE support,
+	found by Chris Evans.</a>
+<li><a href="errata.html#openssl">Oct 7, 2006:
+	Several problems have been found in OpenSSL.</a>
+<li><a href="errata.html#httpd">Oct 7, 2006:
+	httpd(8) does not sanitize the Expect header from an HTTP request
+	when it is reflected back in an error message, which might allow
+	cross-site scripting (XSS) style attacks.</a>
+</ul>
+
+<li>
 <a name="39"></a>
 
 <h3><font color="#e00000">OpenBSD 3.9 Security Advisories</font></h3>
@@ -1509,7 +1531,7 @@
 <a href="index.html"><img height=24 width=24 src="back.gif" border=0 alt="OpenBSD"></a>
 <a href="mailto:www@openbsd.org">www@openbsd.org</a>
 <br>
-<small>$OpenBSD: security.html,v 1.333 2006/10/30 21:11:21 deraadt Exp $</small>
+<small>$OpenBSD: security.html,v 1.334 2006/11/04 03:02:28 brad Exp $</small>
 
 </body>
 </html>