[Midnightbsd-cvs] [MidnightBSD/src] 7b5804: In some cases, the `tcp-setmss` handler may free t...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 7b5804f1146746404af17611f5d4f98c9820210c
      https://github.com/MidnightBSD/src/commit/7b5804f1146746404af17611f5d4f98c9820210c
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2025-12-16 (Tue, 16 Dec 2025)

  Changed paths:
    M sys/netpfil/ipfw/pmod/tcpmod.c

  Log Message:
  -----------
  In some cases, the `tcp-setmss` handler may free the packet data and throw an
error without halting the rule processing engine.  A subsequent rule can then
allow the traffic after the packet data is gone, resulting in a NULL pointer
dereference.

Fixes a DOS issue.

Obtained from: FreeBSD


  Commit: 0ddfbfc7f509b0720248673b0107048c1e258879
      https://github.com/MidnightBSD/src/commit/0ddfbfc7f509b0720248673b0107048c1e258879
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2025-12-16 (Tue, 16 Dec 2025)

  Changed paths:
    M usr.sbin/rtsold/rtsol.c

  Log Message:
  -----------
  The rtsol(8) and rtsold(8) programs do not validate the domain search list
options provided in router advertisement messages; the option body is passed
to resolvconf(8) unmodified.

resolvconf(8) is a shell script which does not validate its input.  A lack of
quoting meant that shell commands pass as input to resolvconf(8) may be
executed.

Obtained from: FreeBSD


  Commit: 37672fb8d5faef2b0eb395428ebd29ec06355df8
      https://github.com/MidnightBSD/src/commit/37672fb8d5faef2b0eb395428ebd29ec06355df8
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2025-12-16 (Tue, 16 Dec 2025)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  fix two security issues.


Compare: https://github.com/MidnightBSD/src/compare/4d43da246fe9...37672fb8d5fa

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications