BSD Commit Log Search

Fix multiple vulnerabilities of OpenSSL.

Security:       FreeBSD-SA-17:11
Approved by:    so

Properly bzero kldstat structure to prevent information leak. [SA-17:10]

Approved by:    so
Security:       FreeBSD-SA-17:10.kldstat
Security:       CVE-2017-1088

Fix kernel data leak via ptrace(PT_LWPINFO). [SA-17:08]

Approved by:    so
Security:       FreeBSD-SA-17:08.ptrace
Security:       CVE-2017-1086

Update timezone database information. [EN-17:09]

Approved by:    so

Fix WPA2 protocol vulnerability. [SA-17:07]

Approved by:    so

Fix OpenSSH Denial of Service vulnerability. [SA-17:06]

Fix VNET kernel panic with asynchronous I/O. [EN-17:07]

Approved by:    so

Fix heimdal KDC-REP service name validation vulnerability [SA-17:05]

Approved by:    so

Fix ipfilter(4) fragment handling panic.

Security:       FreeBSD-SA-17:04.ipfilter
Approved by:    so

Fix multiple vulnerabilities of ntp. [SA-17:03]

Xen migration enhancements. [EN-17:05]

Approved by:    so

Fix multiple vulnerabilities of OpenSSL. [SA-17:02]

Fix system hang when booting when PCI-express HotPlug is enabled.
[EN-17:01]

Fix NIS master updates are not pushed to NIS slave. [EN-17:02]

Fix compatibility with Hyper-V/storage after KB3172614 or
KB3179574. [EN-17:03]

Make makewhatis output reproducible. [EN-17:04]

Approved by:    so

Fix multiple vulnerabilities of OpenSSH.

Security:       FreeBSD-SA-17:01.openssh
Security:       CVE-2016-10009
Security:       CVE-2016-10010
Approved by:    so

Fix multiple vulnerabilities of ntp.

Approved by:    so

Merge r309688: address regressions in SA-16:37.libc.

PR:             215105
Submitted by:   <jtd2004a sbcglobal.net>
Approved by:    so

Fix possible login(1) argument injection in telnetd(8). [SA-16:36]
Fix link_ntoa(3) buffer overflow in libc. [SA-16:37]
Fix possible escape from bhyve(8) virtual machine. [SA-16:38]
Fix warnings about valid time zone abbreviations. [EN-16:19]
Update timezone database information. [EN-16:20]
Fix incorrectly defined unicode character(s). [EN-16:21]

Security:       FreeBSD-SA-16:36.telnetd
Security:       FreeBSD-SA-16:37.libc
Security:       FreeBSD-SA-16:38.bhyve
Errata Notice:  FreeBSD-EN-16:19.tzcode
Errata Notice:  FreeBSD-EN-16:20.tzdata
Errata Notice:  FreeBSD-EN-16:21.localedef
Approved by:    so

Merge r308330 by bapt:

  localedef: Fix ctype dump (fixed wide spread errors)

See original commit for longer description.

Errata Notice:  EN-16:21
Approved by:    so

Update tzdata to 2016i.

Note: because of what appears to be a missing MFC to stable branches,
these patches were generated by doing:

 % rsync -av stable/11/contrib/tzdata releng/11.x/contrib
 % svn add releng/11.x/contrib/tzdata

Errata Notice:  EN-16:20
Submitted by:   gjb
Approved by:    so

Merge r307358 from stable/11:

    Incorporate a change from OpenBSD by millert at OpenBSD.org

    Don't warn about valid time zone abbreviations.  POSIX
    through 2000 says that an abbreviation cannot start with ':', and
    cannot contain ',', '-', '+', NUL, or a digit.  POSIX from 2001
    on changes this rule to say that an abbreviation can contain only
    '-', '+', and alphanumeric characters from the portable character
    set in the current locale.  To be portable to both sets of rules,
    an abbreviation must therefore use only ASCII letters."  Adapted
    from tzcode2015f.

Errata Notice:  EN-16:19.tzcode
Submitted by:   bapt
Approved by:    so

Fix Fix OpenSSH remote Denial of Service vulnerability.

Security:       FreeBSD-SA-16:33.openssh
Approved by:    so

Revised SA-16:15.  The initial patch didn't cover all possible overflows
based on passing incorrect parameters to sysarch(2). [1]

Fix unchecked array reference in the VGA device emulation code. [2]

Security:       SA-16:15 [1]
Security:       SA-16:32 [2]
Approved by:    so

EN-16:18: loader may hang during boot

A programming error in GELIBoot causes the loader to attempt to read past
the end of the disk if the size of the final partition is not a multiple of
4 kB.

Merge r306834 from stable/11.

Approved by:    so

Update releng/11.0 to 11.0-RELEASE-p1.

Approved by:    re (implicit)
Sponsored by:   The FreeBSD Foundation

MFS r306418: portsnap: only move expected snapshot contents from snap/ to files/

Previously it was possible to smuggle in addional files that would
be used by later portsnap runs. Now we only move those files expected
to be in the snapshot into files/ and require that there are no
unexpected files.

This was used by portsnap attacks 2, 3, and 4 in the "non-cryptanalytic
attacks against FreeBSD update components" anonymous gist.

Approved by:    re (gjb)

Merge from stable/11 bspatch, portsnap, and libarchive fixes:

=== bspatch ===

MFS r306213: bspatch Capsicumization, sanity checks, and other improvements

r304691: bspatch: apply style(9)

Make style changes (and trivial refactoring of open calls) now in order
to reduce noise in diffs for future capsicum changes.

r304807 (allanjude): Capsicumize bspatch

Move all of the fopen() and open() calls to the top of main()

Restrict each FD to least privilege (read/seek only, write only, etc)

cap_enter(), and make all except the output FD read/seek only.


    [65 lines not shown]

Merge r306343 by jkim:

Merge OpenSSL 1.0.2j.

Approved by:    so
Approved by:    re (implicit)

Prepare for 11.0-RELEASE builds.

Approved by:    re (implicit)
Sponsored by:   The FreeBSD Foundation

Anticipate when we will be ready to announce 11.0-RELEASE.

Approved by:    re (implicit)
Sponsored by:   The FreeBSD Foundation

Statically set __FreeBSD_version for 11.0-RELEASE.

Approved by:    re (implicit)
Sponsored by:   The FreeBSD Foundation

Remove dual-revision entries, and prefer the latter, unbreaking
URLs to svnweb.

Submitted by:   jkim
Approved by:    re (implicit)
Sponsored by:   The FreeBSD Foundation

Add a link to the 'installation.html' section for freebsd-update(8)
usage information.

Suggested by:   theraven
Approved by:    re (implicit)
Sponsored by:   The FreeBSD Foundation

Change the entity for arm64 from 'aarch64' to 'arm64'.

Submitted by:   emaste
Approved by:    re (implicit)
Sponsored by:   The FreeBSD Foundation