OpenBSD 7.3 Errata

For errata on a certain release, click below:
2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5,
3.6, 3.7, 3.8, 3.9, 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 5.0, 5.1,
5.2, 5.3, 5.4, 5.5, 5.6, 5.7, 5.8, 5.9, 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7,
6.8, 6.9, 7.0, 7.1, 7.2, 7.4, 7.5, 7.6.

Patches for the OpenBSD base system are distributed as unified diffs. Each patch is cryptographically signed with the signify(1) tool and contains usage instructions. All the following patches are also available in one tar.gz file for convenience.

Alternatively, the syspatch(8) utility can be used to apply binary updates on the following architectures: amd64, i386, arm64.

Patches for supported releases are also incorporated into the -stable branch.

001: RELIABILITY FIX: May 3, 2023 All architectures
A new ASPA object appeared in the RPKI ecosystem and exposed bugs in bgpd(8) and rpki-client(8).
A source code patch exists which remedies this problem.
002: RELIABILITY FIX: May 16, 2023 All architectures
Avoid fatal errors in bgpd(8) due to incorrect refcounting and mishandling of ASPA objects. Fix bgpctl(8) 'show rib in' by renaming 'invalid' into 'disqualified'.
A source code patch exists which remedies this problem.
003: RELIABILITY FIX: May 26, 2023 All architectures
IP address inheritance was handled incorrectly in rpki-client(8).
A source code patch exists which remedies this problem.
004: SECURITY FIX: May 26, 2023 All architectures
A double free or use after free could occur after SSL_clear(3).
A source code patch exists which remedies this problem.
005: SECURITY FIX: June 15, 2023 All architectures
libX11 CVE-2023-3138 Missing checks in XQueryExtension() return values.
A source code patch exists which remedies this problem.
006: RELIABILITY FIX: July 12, 2023 All architectures
Incorrect length handling of path attributes in bgpd(8) can lead to a session reset.
A source code patch exists which remedies this problem.
007: RELIABILITY FIX: July 12, 2023 All architectures
A malformed HTTP request can crash httpd(8), if fastcgi is in use.
A source code patch exists which remedies this problem.
008: RELIABILITY FIX: July 12, 2023 All architectures
Incomplete validation of ELF headers in execve(2).
A source code patch exists which remedies this problem.
009: RELIABILITY FIX: July 12, 2023 All architectures
When tracking nexthops over IPv6 multipath routes, or when receiving a NOTIFICATION while reaching an internal limit, bgpd(8) could crash.
A source code patch exists which remedies this problem.
010: SECURITY FIX: July 19, 2023 All architectures
In ssh-agent(1)'s PKCS#11 provider support, remote execution was possible due to controllable access in low-quality libraries. In addition to fixing this, the ability to remotely load PKCS#11 libraries is now disabled by default (re-enable with '-Oallow-remote-pkcs11').
A source code patch exists which remedies this problem.
011: SECURITY FIX: July 24, 2023 amd64 i386
Workaround for Zenbleed AMD cpu problem. For i386 and amd64 platforms.
A source code patch exists which remedies this problem.
012: SECURITY FIX: July 24, 2023 amd64 i386
Add firmware for AMD cpus, to repair past or potential future bugs. For i386 and amd64 platforms.
After this step, "fw_update" and "installboot" must be run.
A source code patch exists which remedies this problem.
013: SECURITY FIX: July 24, 2023 amd64 i386
Install firmware updates for AMD cpus, to repair past or potential future bugs. For i386 and amd64 platforms.
A source code patch exists which remedies this problem.
014: RELIABILITY FIX: July 24, 2023 All architectures
Missing bounds check in console terminal emulation could cause a kernel crash after receiving specially crafted escape sequences.
A source code patch exists which remedies this problem.
015: RELIABILITY FIX: July 25, 2023 amd64 i386
Some hypervisors remain unpatched for writes to Zenbleed DE_CFG bit, so skip it.
A source code patch exists which remedies this problem.
016: SECURITY FIX: September 21, 2023 All architectures
npppd(8) could crash by a l2tp message which has an AVP with wrong length.
A source code patch exists which remedies this problem.
017: SECURITY FIX: October 3, 2023 All architectures
Fix several input validation errors in libX11 and libXpm. CVE-2023-43785 CVE-2023-43786 CVE-2023-43787 CVE-2023-43788 CVE-2023-43789
A source code patch exists which remedies this problem.
018: SECURITY FIX: October 25, 2023 All architectures
Fix several input validation errors in the X server. CVE-2023-5367 CVE-2023-5380 CVE-2023-5574
A source code patch exists which remedies this problem.
019: SECURITY FIX: October 25, 2023 All architectures
A network buffer that had to be split at certain length could crash the kernel.
A source code patch exists which remedies this problem.
020: RELIABILITY FIX: November 21, 2023 All architectures
httpd(8): Avoid a NULL dereference when handling a malformed fastcgi request.
A source code patch exists which remedies this problem.
021: SECURITY FIX: November 29, 2023 All architectures
A crafted regular expression when compiled by perl can cause a one-byte attacker controlled buffer overflow in a heap allocated buffer. CVE-2023-47038
A source code patch exists which remedies this problem.
022: RELIABILITY FIX: December 10, 2023 amd64
vmm(4) restored stale GDTR & TR values on vm exit which could lead to memory corruption or kernel deadlocks.
A source code patch exists which remedies this problem.
023: SECURITY FIX: December 14, 2023 All architectures
Fix out of bounds memory accesses in XRandR and XKB X server extensions. CVE-2023-6377 CVE-2023-6478
A source code patch exists which remedies this problem.
024: SECURITY FIX: December 18, 2023 All architectures
An SSH protocol weakness (the Terrapin Attack) exists that allows an on-path adversary to disable keystroke timing obfuscation.
A source code patch exists which remedies this problem.
025: SECURITY FIX: January 16, 2024 All architectures
Fix multiple xserver heap buffer overflows, out of bounds memory accesses and memory corruption. CVE-2023-6816 CVE-2024-0229 CVE-2024-21885 CVE-2024-21886 CVE-2024-0408 CVE-2024-0409
A source code patch exists which remedies this problem.
026: SECURITY FIX: February 13, 2024 All architectures
DNSSEC protocol vulnerabilities have been discovered that render various DNSSEC validators victims of Denial Of Service while trying to validate specially crafted DNSSEC responses. Fix CVE-2023-50387 and CVE-2023-50868 in unwind(8) and unbound(8).
A source code patch exists which remedies this problem.
027: SECURITY FIX: March 18, 2024 All architectures
In libexpat fix billion laughs attack vulnerability CVE-2024-28757.
A source code patch exists which remedies this problem.
028: SECURITY FIX: April 8, 2024 All architectures
Fix multiple heap buffer overread and data leakage in the X11 server Xi extension and use after free in the Render extension. CVE-2024-31080 CVE-2024-31081 CVE-2024-31083
A source code patch exists which remedies this problem.

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.

Alternative Proxies: