Patches for the OpenBSD base system are distributed as unified diffs.
Each patch is cryptographically signed with the
signify(1) tool and contains
usage instructions.
All the following patches are also available in one
tar.gz file
for convenience.
Patches for supported releases are also incorporated into the
-stable branch.
002: RELIABILITY FIX: October 1, 2014All architectures
If IPv6 autoconf is active on an interface and the autoconfprivacy extension is used,
redundant addresses are added whenever an autoconfprivacy address expires.
The autoconfprivacy extension is used by default and can be disabled with ifconfig(8)
as a workaround:
003: SECURITY FIX: October 1, 2014All architectures
nginx can reuse cached SSL sessions in unrelated contexts, allowing virtual
host confusion attacks in some configurations.
This issue was assigned CVE-2014-3616.
A source code patch exists which remedies this problem.
007: RELIABILITY FIX: November 17, 2014All architectures
A PF rule using an IPv4 address
followed by an IPv6 address and then a dynamic address, e.g. "pass
from {192.0.2.1 2001:db8::1} to (pppoe0)", will have an incorrect /32
mask applied to the dynamic address.
A source code patch exists which remedies this problem.
009: RELIABILITY FIX: November 18, 2014All architectures
httpd was developed very rapidly in the weeks before 5.6 release, and
it has a few flaws. It would be nice to get these flaws fully
remediated before the next release, and that requires the community to
want to use it. Therefore here is a "jumbo" patch that brings in the
most important fixes.
A source code patch exists which remedies this problem. Unfortunately the source tree found on the CD set contains a slightly different
checkout, from just before the release was finished and is missing a few httpd
commits. Therefore, the patch above will not apply correctly. Users are encouraged
to use cvs to get the latest httpd sources if interested.
012: RELIABILITY FIX: December 9, 2014All architectures
Fix a denial of service where a malicious authority could make the resolver chase an
endless series of delegations. (CVE-2014-8602)
A source code patch exists which remedies this problem.
014: SECURITY FIX: December 9, 2014All architectures
One year after Ilja van Sprundel discovered and reported a large number
of issues in the way the X server code base handles requests from X clients,
they have been fixed.
X Advisory
A source code patch exists which remedies this problem.
021: RELIABILITY FIX: April 17, 2015All architectures
Fix a logic error in smtpd handling of SNI.
This could allow a remote user to crash the server or provoke a disconnect of other sessions.
A source code patch exists which remedies this problem.
024: SECURITY FIX: April 30, 2015All architectures
Multiple issues in tar/pax/cpio:
extracting a malicious archive could create files outside of
the current directory without using pre-existing symlinks to 'escape',
and could change the timestamps and modes on preexisting files
tar without -P would permit extraction of paths with ".." components
there was a buffer overflow in the handling of pax extension headers
028: RELIABILITY FIX: July 26, 2015All architectures
A kernel memory leak could be triggered by an unprivileged user in
a failure case when using execve under systrace.
A source code patch exists which remedies this problem.
029: SECURITY FIX: July 26, 2015All architectures
The patch utility could be made to invoke arbitrary commands via
the obsolete SCCS and RCS support when processing a crafted input file.
This patch deletes the SCCS and RCS support.
A source code patch exists which remedies this problem.
031: SECURITY FIX: October 1, 2015All architectures
Fix multiple reliability and security issues in smtpd:
local and remote users could make smtpd crash or stop serving requests.
a buffer overflow in the unprivileged, non-chrooted smtpd (lookup)
process could allow a local user to cause a crash or potentially
execute arbitrary code.
a use-after-free in the unprivileged, non-chrooted smtpd (lookup)
process could allow a remote attacker to cause a crash or potentially
execute arbitrary code.
hardlink and symlink attacks allowed a local user to unset chflags or
leak the first line of an arbitrary file.
033: RELIABILITY FIX: October 15, 2015All architectures
The OBJ_obj2txt function in libcrypto contains a one byte buffer overrun
and memory leak, as reported by Qualys Security.
A source code patch exists which remedies this problem.