This is the OpenBSD 4.0 release errata & patch list:
For OpenBSD patch branch information, please refer here.
For important packages updates, please refer here.
For errata on a certain release, click below:
2.1,
2.2,
2.3,
2.4,
2.5,
2.6,
2.7,
2.8,
2.9,
3.0,
3.1,
3.2,
3.3,
3.4,
3.5,
3.6,
3.7,
3.8,
3.9.
You can also fetch a tar.gz file containing all the following patches.
This file is updated once a day.
The patches below are available in CVS via the
OPENBSD_4_0
patch branch.
For more detailed information on how to install patches to OpenBSD, please
consult the OpenBSD FAQ.
-
004: RELIABILITY FIX: November 7, 2006 All architectures
Due to a bug in the
arc(4)
RAID driver the driver will not properly synchronize the cache to the logical volumes
upon system shut down. The result being that the mounted file systems within the logical
volumes will not be properly marked as being clean and fsck will be run for the subsequent
boot up.
A source code patch exists which remedies this problem.
-
003: SECURITY FIX: November 4, 2006 All architectures
Fix for an integer overflow in
systrace(4)'s
STRIOCREPLACE support, found by
Chris Evans. This could be exploited for DoS, limited kmem reads or local
privilege escalation.
A source code patch exists which remedies this problem.
-
002: SECURITY FIX: November 4, 2006 All architectures
Several problems have been found in OpenSSL. While parsing certain invalid ASN.1
structures an error condition is mishandled, possibly resulting in an infinite
loop. A buffer overflow exists in the SSL_get_shared_ciphers function. A NULL
pointer may be dereferenced in the SSL version 2 client code. In addition, many
applications using OpenSSL do not perform any validation of the lengths of
public keys being used.
CVE-2006-2937,
CVE-2006-3738,
CVE-2006-4343,
CVE-2006-2940
A source code patch exists which remedies this problem.
-
001: SECURITY FIX: November 4, 2006 All architectures
httpd(8)
does not sanitize the Expect header from an HTTP request when it is
reflected back in an error message, which might allow cross-site scripting (XSS)
style attacks.
CVE-2006-3918
A source code patch exists which remedies this problem.
For OpenBSD patch branch information, please refer here.
For important packages updates, please refer here.
For errata on a certain release, click below:
2.1,
2.2,
2.3,
2.4,
2.5,
2.6,
2.7,
2.8,
2.9,
3.0,
3.1,
3.2,
3.3,
3.4,
3.5,
3.6,
3.7,
3.8,
3.9.
www@openbsd.org
$OpenBSD: errata.html,v 1.576 2006/11/08 04:00:18 brad Exp $