-
Notifications
You must be signed in to change notification settings - Fork 43
/
Copy patherrata57.html
382 lines (347 loc) · 13.9 KB
/
errata57.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
<!doctype html>
<html lang=en id=errata>
<meta charset=utf-8>
<title>OpenBSD 5.7 Errata</title>
<meta name="description" content="the OpenBSD CD errata page">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="https://www.openbsd.org/errata57.html">
<!--
IMPORTANT REMINDER
IF YOU ADD A NEW ERRATUM, MAIL THE PATCH TO TECH AND ANNOUNCE
-->
<h2 id=OpenBSD>
<a href="index.html">
<i>Open</i><b>BSD</b></a>
5.7 Errata
</h2>
<hr>
For errata on a certain release, click below:<br>
<a href="errata20.html">2.0</a>,
<a href="errata21.html">2.1</a>,
<a href="errata22.html">2.2</a>,
<a href="errata23.html">2.3</a>,
<a href="errata24.html">2.4</a>,
<a href="errata25.html">2.5</a>,
<a href="errata26.html">2.6</a>,
<a href="errata27.html">2.7</a>,
<a href="errata28.html">2.8</a>,
<a href="errata29.html">2.9</a>,
<a href="errata30.html">3.0</a>,
<a href="errata31.html">3.1</a>,
<a href="errata32.html">3.2</a>,
<a href="errata33.html">3.3</a>,
<a href="errata34.html">3.4</a>,
<a href="errata35.html">3.5</a>,
<br>
<a href="errata36.html">3.6</a>,
<a href="errata37.html">3.7</a>,
<a href="errata38.html">3.8</a>,
<a href="errata39.html">3.9</a>,
<a href="errata40.html">4.0</a>,
<a href="errata41.html">4.1</a>,
<a href="errata42.html">4.2</a>,
<a href="errata43.html">4.3</a>,
<a href="errata44.html">4.4</a>,
<a href="errata45.html">4.5</a>,
<a href="errata46.html">4.6</a>,
<a href="errata47.html">4.7</a>,
<a href="errata48.html">4.8</a>,
<a href="errata49.html">4.9</a>,
<a href="errata50.html">5.0</a>,
<a href="errata51.html">5.1</a>,
<br>
<a href="errata52.html">5.2</a>,
<a href="errata53.html">5.3</a>,
<a href="errata54.html">5.4</a>,
<a href="errata55.html">5.5</a>,
<a href="errata56.html">5.6</a>,
<a href="errata58.html">5.8</a>,
<a href="errata59.html">5.9</a>,
<a href="errata60.html">6.0</a>,
<a href="errata61.html">6.1</a>,
<a href="errata62.html">6.2</a>,
<a href="errata63.html">6.3</a>,
<a href="errata64.html">6.4</a>,
<a href="errata65.html">6.5</a>,
<a href="errata66.html">6.6</a>,
<a href="errata67.html">6.7</a>,
<a href="errata68.html">6.8</a>,
<br>
<a href="errata69.html">6.9</a>,
<a href="errata70.html">7.0</a>,
<a href="errata71.html">7.1</a>,
<a href="errata72.html">7.2</a>,
<a href="errata73.html">7.3</a>,
<a href="errata74.html">7.4</a>,
<a href="errata75.html">7.5</a>,
<a href="errata76.html">7.6</a>,
<a href="errata77.html">7.7</a>.
<hr>
<p>
Patches for the OpenBSD base system are distributed as unified diffs.
Each patch is cryptographically signed with the
<a href="https://man.openbsd.org/OpenBSD-5.7/signify.1">signify(1)</a> tool and contains
usage instructions.
All the following patches are also available in one
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7.tar.gz">tar.gz file</a>
for convenience.
<p>
Patches for supported releases are also incorporated into the
<a href="stable.html">-stable branch</a>.
<hr>
<ul>
<li id="p001_sparc64_miniroot">
<strong>001: INSTALL ISSUE: May 1, 2015</strong>
<i>sparc64</i><br>
The "miniroot" install method is broken (related to the addition of
softraid support). This method is used by the official CD 3 as
well, so it fails to boot on sparc64 machines.
<br>
No patch is available for obvious reasons, so use a different install method.
<p>
<li id="p002_libxfont">
<strong>002: SECURITY FIX: March 18, 2015</strong>
<i>All architectures</i><br>
Buffer overflows in libXfont
<br>
For more information, see the
<a href="http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/">X.org advisory</a>.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/002_libxfont.patch.sig">
A source code patch exists which remedies this problem.</a>
<br>Note that the instructions should read <code>cd /usr/xenocara/lib/libXfont</code>.
<p>
<li id="p003_openssl">
<strong>003: SECURITY FIX: March 19, 2015</strong>
<i>All architectures</i><br>
Fix several crash causing defects from OpenSSL.<br>
These include:<br>
CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error<br>
CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp<br>
CVE-2015-0287 - ASN.1 structure reuse memory corruption<br>
CVE-2015-0288 - X509_to_X509_REQ NULL pointer deref<br>
CVE-2015-0289 - PKCS7 NULL pointer dereferences<br>
<br>
Several other issues did not apply or were already fixed.<br>
For more information, see the
<a href="https://www.openssl.org/news/secadv_20150319.txt">OpenSSL advisory</a>.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/003_openssl.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p004_smtpd">
<strong>004: RELIABILITY FIX: April 17, 2015</strong>
<i>All architectures</i><br>
Fix a logic error in smtpd handling of SNI.
This could allow a remote user to crash the server or provoke a disconnect of other sessions.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/004_smtpd.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p005_httpd">
<strong>005: RELIABILITY FIX: April 30, 2015</strong>
<i>All architectures</i><br>
A remote user can crash httpd by forcing the daemon to log to a file
before the logging system was initialized.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/005_httpd.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p006_elf">
<strong>006: SECURITY FIX: April 30, 2015</strong>
<i>All architectures</i><br>
Malformed binaries could trigger kernel panics or view kernel memory.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/006_elf.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p007_tar">
<strong>007: SECURITY FIX: April 30, 2015</strong>
<i>All architectures</i><br>
Multiple issues in tar/pax/cpio:
<ul>
<li>extracting a malicious archive could create files outside of
the current directory without using pre-existing symlinks to 'escape',
and could change the timestamps and modes on preexisting files
<li>tar without -P would permit extraction of paths with ".." components
<li>there was a buffer overflow in the handling of pax extension headers
</ul>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/007_tar.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p008_smtpd">
<strong>008: RELIABILITY FIX: June 11, 2015</strong>
<i>All architectures</i><br>
Fix multiple reliability issues in smtpd:
<ul>
<li>a local user can cause smtpd to fail by writing an invalid imsg to control socket.
<li>a local user can prevent smtpd from serving new requests by exhausting descriptors.
</ul>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/008_smtpd.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p009_openssl">
<strong>009: SECURITY FIX: June 11, 2015</strong>
<i>All architectures</i><br>
Fix several defects from OpenSSL:
<ul>
<li>CVE-2015-1788 - Malformed ECParameters causes infinite loop
<li>CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time
<li>CVE-2015-1792 - CMS verify infinite loop with unknown hash function
</ul>
Note that CMS was already disabled in LibreSSL.
Several other issues did not apply or were already fixed and one is under review.<br>
For more information, see the
<a href="https://www.openssl.org/news/secadv_20150611.txt">OpenSSL advisory</a>.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/009_openssl.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p010_tcp">
<strong>010: SECURITY FIX: July 14, 2015</strong>
<i>All architectures</i><br>
A TCP socket can become confused and not properly cleanup resources.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/010_tcp_persist.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p011_execve">
<strong>011: RELIABILITY FIX: July 26, 2015</strong>
<i>All architectures</i><br>
A kernel memory leak could be triggered by an unprivileged user in
a failure case when using execve under systrace.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/011_execve.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p012_patch">
<strong>012: SECURITY FIX: July 26, 2015</strong>
<i>All architectures</i><br>
The patch utility could be made to invoke arbitrary commands via
the obsolete RCS support when processing a crafted input file.
This patch deletes the RCS support.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/012_patch.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p013_patch">
<strong>013: SECURITY FIX: July 30, 2015</strong>
<i>All architectures</i><br>
The patch utility could become desyncronized processing ed(1)-style diffs.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p014_sshd">
<strong>014: SECURITY FIX: August 16, 2015</strong>
<i>All architectures</i><br>
A change to sshd resulted in incorrect permissions being applied to pseudo
terminal devices, allowing local users to write to (but not read from) them.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/014_sshd.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p015_relayd">
<strong>015: RELIABILITY FIX: September 28, 2015</strong>
<i>All architectures</i><br>
Various problems were identified in relayd and merged back from
current to 5.7 in this maintenance update.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/015_relayd.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p016_uvm">
<strong>016: RELIABILITY FIX: September 28, 2015</strong>
<i>All architectures</i><br>
An incorrect operation in uvm could result in system panics.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/016_uvm.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p017_smtpd">
<strong>017: SECURITY FIX: October 1, 2015</strong>
<i>All architectures</i><br>
Fix multiple reliability and security issues in smtpd:<br>
<ul>
<li>local and remote users could make smtpd crash or stop serving requests.
<li>a buffer overflow in the unprivileged, non-chrooted smtpd (lookup)
process could allow a local user to cause a crash or potentially
execute arbitrary code.
<li>a use-after-free in the unprivileged, non-chrooted smtpd (lookup)
process could allow a remote attacker to cause a crash or potentially
execute arbitrary code.
<li>hardlink and symlink attacks allowed a local user to unset chflags or
leak the first line of an arbitrary file.
</ul>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/017_smtpd.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p018_kevent">
<strong>018: RELIABILITY FIX: October 14, 2015</strong>
<i>All architectures</i><br>
A problem with timer kevents could result in a kernel hang (local denial
of service).<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/018_kevent.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p019_obj2txt">
<strong>019: RELIABILITY FIX: October 15, 2015</strong>
<i>All architectures</i><br>
The OBJ_obj2txt function in libcrypto contains a one byte buffer overrun
and memory leak, as reported by Qualys Security.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/019_obj2txt.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p020_rsn">
<strong>020: RELIABILITY FIX: November 9, 2015</strong>
<i>All architectures</i><br>
Insufficient validation of RSN element group cipher values in 802.11
beacons and probe responses could result in system panics.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/020_rsn.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p021_clientcert">
<strong>021: RELIABILITY FIX: Dec 3, 2015</strong>
<i>All architectures</i><br>
A NULL pointer deference could be triggered by a crafted certificate sent to
services configured to verify client certificates on TLS/SSL connections.<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/021_clientcert.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p022_sshd">
<strong>022: SECURITY FIX: January 14, 2016</strong>
<i>All architectures</i><br>
Experimental roaming code in the ssh client could be tricked by a hostile sshd
server, potentially leaking key material. CVE-2016-0777 and CVE-0216-0778.
<br>
Prevent this problem immediately by adding the line "UseRoaming no" to
<b>/etc/ssh/ssh_config</b>.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/022_ssh.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p023_sshd">
<strong>023: SECURITY FIX: March 10, 2016</strong>
<i>All architectures</i><br>
<a href="https://www.openssh.com/txt/x11fwd.adv">
Lack of credential sanitization allows injection of commands to xauth(1).</a>
<br>
Prevent this problem immediately by not using the "X11Forwarding" feature
(which is disabled by default)
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/023_sshd.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
<li id="p024_in6bind">
<strong>024: SECURITY FIX: March 16, 2016</strong>
<i>All architectures</i><br>
Insufficient checks in IPv6 socket binding and UDP IPv6 option
processing allow a local user to send UDP packets with a source
(IPv6 address + port) already reserved by another user.
<br>
<a href="https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/024_in6bind.patch.sig">
A source code patch exists which remedies this problem.</a>
<p>
</ul>
<hr>