[ViewVC] Diff of: src/trunk/UPDATING

Comparing trunk/UPDATING (file contents):
Revision 6841 by laffer1, Sat Oct 4 14:23:36 2014 UTC vs.
Revision 8465 by laffer1, Sun Sep 18 22:20:09 2016 UTC

+Updating Information for MidnightBSD users.
-+
+20160916:
-+
+        The random(4) support for the VIA hardware random number
-+
+        generator (`PADLOCK') is no longer enabled unconditionally.
-+
+        Add the PADLOCK_RNG option in the custom kernel config if
-+
+        needed.  The GENERIC kernels on i386 and amd64 do include the
-+
+        option, so the change only affects the custom kernel
-+
+        configurations.
-+
-+
+        A new version of ZFS (pool version 5000) has been merged.
-+
+        Starting with this version the old system of ZFS pool versioning
-+
+        is superseded by "feature flags". This concept enables forward
-+
+        compatibility against certain future changes in functionality of ZFS
-+
+        pools. The first two read-only compatible "feature flags" for ZFS
-+
+        pools are "com.delphix:async_destroy" and "com.delphix:empty_bpobj".
-+
+        For more information read the new zpool-features(7) manual page.
-+
+        Please refer to the "ZFS notes" section of this file for information
-+
+        on upgrading boot ZFS pools.
-+
-+
+20160906:
-+
+        Add support for the MosChip MCS9904 four serial ports
-+
+        controller.
-+
-+
+        Add support for walltimestamp in DTrace.
-+
-+
+        Various gdb improvments.
-+
-+
+        ZFS
-+
+        Import the zio nop-write improvement from Illumos. To reduce I/O,
-+
+        nop-write omits overwriting data if the checksum (cryptographically
-+
+        secure) of new data matches the checksum of existing data.
-+
+        It also saves space if snapshots are in use.
-+
-+
+        It currently works only on datasets with enabled compression, disabled
-+
+        deduplication and sha256 checksums.
-+
-+
+        Add loader(8) tunable to enable/disable nopwrite functionality:
-+
+        vfs.zfs.nopwrite_enabled
-+
-+
+        Introduce a new dataset aclmode setting "restricted" to protect ACL's
-+
+        being destroyed or corrupted by a drive-by chmod.
-+
-+
+        New loader-only tunables:
-+
+        vfs.zfs.sync_pass_deferred_free
-+
+        vfs.zfs.sync_pass_dont_compress
-+
+        vfs.zfs.sync_pass_rewrite
-+
-+
+        chkgrp(8) add support for q flag
-+
-+
+        Fix problem with the Samsung 840 PRO series SSD detection.
-+
+        The device reports support for SATA Asynchronous Notification in its
-+
+        IDENTIFY data, but returns error on attempt to enable that feature.
-+
+        Make SATA XPT of CAM only report these errors, but not fail the device.
-+
-+
+20160905:
-+
+        Add a resource limit for the total number of kqueues
-+
+        available to the user. Kqueue now saves the ucred of the
-+
+        allocating thread, to correctly decrement the counter on close.
-+
+        Based on FreeBSD SVN 256849
-+
-+
+        Import netcat from OpenBSD 5.2
-+
-+
+20160904:
-+
+        Introduced experimental TCP sysctls starting with
-+
+        net.inet.tcp.experimental.initcwnd10
-+
-+
+20160814:
-+
+        switched default desktop port to midnightbsd-desktop. This gives us flexibility to change it
-+
+        in the release after the fact.
-+
-+
+        tzdata 2016a
-+
-+
+20160811:
-+
+        libdispatch 210
-+
-+
+        Added quirks for several models of SSDs to enable advanced format/4k mode. List includes
-+
+        Samsung 830, 840, 850 and 750 series, Intel x25 and a few Toshiba models. Also
-+
+        added WD Red drives.
-+
-+
+        Updated list of pci device vendors.
-+
-+
+        Updated list of usb devices.
-+
-+
+20160807:
-+
+        Implement several changes to libmport to fix some memory corruption issues.
-+
-+
+20160806:
-+
+        sqlite3 3.13.0
-+
-+
+20160805:
-+
+        Merged fixes for libmport that improve error handling when installing packages. Also
-+
+        support mkdir -p like behavior for plist entries.
-+
-+
+20160531:
-+
+        Fix four security issues with MidnightBSD.
-+
-+
+        The implementation of TIOCGSERIAL ioctl(2) does not clear the output
-+
+        struct before sending to userland in the linux emulation layer.
-+
-+
+        The compat 43 stat(2) system call exposes kernel stack to userland.
-+
-+
+        libarchive - CVE-2015-2304 and CVE-2013-0211 fix issues with
-+
+        cpio directory traversal and an integer signedness error in the archive
-+
+        write zip data routine.
-+
-+
-+
+20160528:
-+
+        Fixed minor issues with mined(1) and msearch(1).
-+
-+
+20160526:
-+
+        Add support for Ivybridge and Haswell Intel CPUs to hwpmc(4).
-+
-+
+        Fix libpmc(3) build with clang compiler.
-+
-+
+20160519:
-+
+        Kernel Security updates
-+
-+
+        atkbd(4) - Incorrect signedness comparison in the ioctl(2) handler allows a malicious
-+
+        local user to overwrite a portion of the kernel memory.
-+
-+
+        Incorrect argument handling in sendmsg(2)
-+
-+
+        Incorrect argument handling in the socket code allows malicious local
-+
+        user to overwrite large portion of the kernel memory.
-+
-+
+20160505:
-+
+        OpenSSL security patch
-+
-+
+        The padding check in AES-NI CBC MAC was rewritten to be in constant time
-+
+        by making sure that always the same bytes are read and compared against
-+
+        either the MAC or padding bytes. But it no longer checked that there was
-+
+        enough data to have both the MAC and padding bytes. [CVE-2016-2107]
-+
-+
+        An overflow can occur in the EVP_EncodeUpdate() function which is used for
-+
+        Base64 encoding of binary data. [CVE-2016-2105]
-+
-+
+        An overflow can occur in the EVP_EncryptUpdate() function, however it is
-+
+        believed that there can be no overflows in internal code due to this problem.
-+
+        [CVE-2016-2106]
-+
-+
+        When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
-+
+        a short invalid encoding can casuse allocation of large amounts of memory
-+
+        potentially consuming excessive resources or exhausting memory.
-+
+        [CVE-2016-2109]
-+
-+
+20160412:
-+
+.8 stable branch created. Continue development as 0.9.
-+
-+
+        Fix several issues with wait6 system call addition.
-+
-+
+20160409:
-+
+        libmport now supports two new plist formats:
-+
+        @(root,wheel,4775) myfile
-+
+        @dir(root,wheel,775) mydir
-+
-+
+        On delete, absoluate paths are now handled properly.
-+
-+
+20160317:
-+
+        OpenSSH doesn't have the luck of the Irish.
-+
-+
+        Fix a security issue with OpenSSH X11 forwarding that can allow an attacker
-+
+        run shell commands on the call to xauth.
-+
-+
+        Incorrect argument validation in sysarch(2)
-+
-+
+        A special combination of sysarch(2) arguments, specify a request to
-+
+        uninstall a set of descriptors from the LDT.  The start descriptor
-+
+        is cleared and the number of descriptors are provided.  Due to invalid
-+
+        use of a signed intermediate value in the bounds checking during argument
-+
+        validity verification, unbound zero'ing of the process LDT and adjacent
-+
+        memory can be initiated from usermode.
-+
-+
+        Patch obtained from FreeBSD.
-+
-+
+20160229:
-+
+        top now displays information on ZFS arc cache.
-+
-+
+20160228:
-+
+        llvm + clang 3.3 is now the default compiler in MidnightBSD.
-+
-+
+20160222:
-+
+        Introduce pipe2 to linux emulation layer.
-+
-+
+20160114:
-+
+        OpenSSL
-+
-+
+        The signature verification routines will crash with a NULL pointer dereference
-+
+        if presented with an ASN.1 signature using the RSA PSS algorithm and absent
-+
+        mask generation function parameter. [CVE-2015-3194]
-+
-+
+        When presented with a malformed X509_ATTRIBUTE structure, OpenSSL will leak
-+
+        memory. [CVE-2015-3195]
-+
-+
+        If PSK identity hints are received by a multi-threaded client then the values
-+
+        are incorrectly updated in the parent SSL_CTX structure.  [CVE-2015-3196]
-+
-+
+        Fix security on bsnmpd configuration file during installation.
-+
-+
+        TCP MD5 signature denial of service
-+
-+
+        A programming error in processing a TCP connection with both TCP_MD5SIG
-+
+        and TCP_NOOPT socket options may lead to kernel crash.
-+
-+
+        SCTP
-+
-+
+        A lack of proper input checks in the ICMPv6 processing in the SCTP stack
-+
+        can lead to either a failed kernel assertion or to a NULL pointer
-+
+        dereference.  In either case, a kernel panic will follow.
-+
-+
+20160102:
-+
+        Happy New Year
-+
-+
+20151101:
-+
+        Increase kern.ipc.somaxconn default to 256.
-+
-+
+20151017:
-+
+        Add initial statistics api to libmport and a driver to print
-+
+        it in mport(1).
-+
-+
+20151002:
-+
+        Revised rpcbind(8) patch to fix issues with NIS
-+
-+
+20150930:
-+
+        In rpcbind(8), netbuf structures are copied directly, which would result in
-+
+        two netbuf structures that reference to one shared address buffer.  When one
-+
+        of the two netbuf structures is freed, access to the other netbuf structure
-+
+        would result in an undefined result that may crash the rpcbind(8) daemon.
-+
-+
+20150926:
-+
+        libmport now supports @preexec, @postexec, @preunexec and @postunexec
-+
+        to replace @exec and @unexec.
-+
-+
+        pre exec runs afer pre-install scripts but before actual installation
-+
-+
+        post exec runs after install but before post install scripts and
-+
+        pkg message.
-+
-+
+        pre unexec runs before pre uninstall scripts
-+
-+
+        post unexec runs before de-install scripts and after file removal.
-+
-+
+20150917:
-+
+        Fix kqueue write events for files > 2GB
-+
-+
+20150825:
-+
+        kernel:
-+
+        fix a security issue on amd64 where the GS segment CPU register can be changed via
-+
+        userland value in kernel mode by using an IRET with #SS or #NP exceptions.
-+
-+
+        openssh:
-+
+        A programming error in the privileged monitor process of the sshd(8)
-+
+        service may allow the username of an already-authenticated user to be
-+
+        overwritten by the unprivileged child process.
-+
-+
+        A use-after-free error in the privileged monitor process of he sshd(8)
-+
+        service may be deterministically triggered by the actions of a
-+
+        compromised unprivileged child process.
-+
-+
+        A use-after-free error in the session multiplexing code in the sshd(8)
-+
+        service may result in unintended termination of the connection.
-+
-+
+20150818:
-+
+        expat security fix
-+
-+
+20150815:
-+
+        libc changes:
-+
+        setmode(3) now returns errno consistently on error.
-+
+        libc will compile without error using clang
-+
-+
+20150814:
-+
+        wait6 system call added.
-+
-+
+        date(1) now handles non numeric numbers passed to -r
-+
+        like GNU coreutils for improved compatibility.
-+
-+
+20150811:
-+
+        ata(4) AMD Hudson2 SATA controller support.
-+
+        Intel lynxpoint SATA.
-+
-+
+        Fix some const warnings when building several device drivers
-+
+        with llvm/clang.
-+
-+
+        Sync cas(4) with FreeBSD 9-stable.
-+
-+
+        Fix some minor issues with ath(4).
-+
-+
+20150809:
-+
+        xz 5.0.8
-+
-+
+20150808:
-+
+        libmport now logs installation and removal of packages to syslog.
-+
-+
+20150805:
-+
+        routed - fix a potential security issue where traffic from outside
-+
+        the network can disrupt routing.
-+
-+
+        bsd patch - fix a bug with ed(1) scripts allowing unsanitized input
-+
+        to run.
-+
-+
+20150802:
-+
+        jansson 2.7 library added. (libjansson is a JSON library in C)
-+
-+
+20150728:
-+
+        Heimdal 1.5.2 (kerberos implementation)
-+
-+
+        OpenSSL 1.0.1o
-+
-+
+        cpucontrol(8) now supports VIA CPUs. Synced with FreeBSD 9.2.
-+
-+
+        TCP Resassemly resource exhaustion bug:
-+
+        There is a mistake with the introduction of VNET, which converted the
-+
+        global limit on the number of segments that could belong to reassembly
-+
+        queues into a per-VNET limit.  Because mbufs are allocated from a
-+
+        global pool, in the presence of a sufficient number of VNETs, the
-+
+        total number of mbufs attached to reassembly queues can grow to the
-+
+        total number of mbufs in the system, at which point all network
-+
+        traffic would cease.
-+
+        Obtained from: FreeBSD 8
-+
-+
+        OpenSSH
-+
-+
+        Fix two security vulnerabilities:
-+
+        OpenSSH clients does not correctly verify DNS SSHFP records when a server
-+
+        offers a certificate. [CVE-2014-2653]
-+
-+
+        OpenSSH servers which are configured to allow password authentication
-+
+        using PAM (default) would allow many password attempts. A bug allows
-+
+        MaxAuthTries to be bypassed. [CVE-2015-5600]
-+
-+
-+
+        Switch to bsdpatch (from FreeBSD & OpenBSD)
-+
-+
+20150726:
-+
+        BSD Sort updated
-+
-+
+        sqlite 3.8.10.2
-+
-+
+20150725:
-+
+        Import reallocarray from OpenBSD's libc.
-+
-+
+        The reallocarray() function is similar to realloc() except it operates on
-+
+        nmemb members of size size and checks for integer overflow in the
-+
+        calculation nmemb * size.
-+
-+
+20150722:
-+
+        Fix a bug where TCP connections transitioning to LAST_ACK
-+
+        state can get stuck. This can result in a denial of service.
-+
-+
+20150715:
-+
+        libmport now supports @shell and @sample in plists. This means that
-+
+        a shell port can automatically add an entry to /etc/shells and remove
-+
+        it upon uninstallation. For sample files, a copy is made without the
-+
+        .sample extension if one does not exist and it is removed automatically
-+
+        only if the md5 hash of the two files is the same.
-+
-+
+20150709:
-+
+        flex 2.5.39
-+
-+
+20150702:
-+
+        ZFS in MidnightBSD now supports lz4 compression. You can enable it
-+
+        with zfs set compression=lz4 pool/path.
-+
-+
+        Verify it's working with
-+
+        zfs get compressratio pool/path
-+
+        du -h -s *
-+
-+
+        Note you must write new data when turning on compression to see
-+
+        changes. Existing files are not compressed.
-+
-+
+        Note: While we used the same basic implementation of lz4 that
-+
+        FreeBSD and OpenZFS uses, we did not yet implement features support
-+
+        and the zfs version still reports 28. This may come in a future update
-+
+        to ZFS.
-+
-+
+20150621:
-+
+        libmport now automatically stops services when deleting packages.
-+
-+
+        The package must have installed an rc.d script in /usr/local/etc
-+
+        for this to work. This is equivalent to running service <name> onestop
-+
-+
+20150618:
-+
+        Sendmail
-+
-+
+        With the recent changes to OpenSSL to block 512 bit certificates,
-+
+        sendmail can't connect with TLS to some servers.
-+
-+
+        Increase the default size to 1024 bit for client connections to
-+
+        match the server configuration.
-+
-+
+        ZFS
-+
-+
+        Added ZFS TRIM support which is enabled by default. To disable
-+
+        ZFS TRIM support set vfs.zfs.trim.enabled=0 in loader.conf.
-+
-+
+        Creating new ZFS pools and adding new devices to existing pools
-+
+        first performs a full device level TRIM which can take a significant
-+
+        amount of time. The sysctl vfs.zfs.vdev.trim_on_init can be set to 0
-+
+        to disable this behaviour.
-+
-+
+        ZFS TRIM requires the underlying device support BIO_DELETE which
-+
+        is currently provided by methods such as ATA TRIM and SCSI UNMAP
-+
+        via CAM, which are typically supported by SSD's.
-+
-+
+        Stats for ZFS TRIM can be monitored by looking at the sysctl's
-+
+        under kstat.zfs.misc.zio_trim.
-+
-+
+        rc.d
-+
-+
+        Reworked handling of cleanvar and FILESYSTEMS so that FILESYSTEMS
-+
+        implies everything is mounted and ready to go.
-+
-+
+        Changed how ip6addressctl maps IPv6 on startup.
-+
-+
+20150613:
-+
+        tzdata 2015d
-+
-+
+20150612:
-+
+        OpenSSL 0.9.8zg
-+
-+
+20150419:
-+
+        MidnightBSD 0.6 stable branch created. Continue 0.7
-+
+        development.
-+
-+
+20150418:
-+
+        sqlite 3.8.9
-+
-+
+20150407:
-+
+        Fix two security vulnerabilities:
-+
-+
+        The previous fix for IGMP had an overflow issue. This has been corrected.
-+
-+
+        ipv6: The Neighbor Discover Protocol allows a local router to advertise a
-+
+        suggested Current Hop Limit value of a link, which will replace
-+
+        Current Hop Limit on an interface connected to the link on the MidnightBSD
-+
+        system.
-+
-+
+20150319:
-+
+        OpenSSL 0.9.8.zf
-+
-+
+        mksh R50e
-+
-+
+        Apple mDNSResponder 561.1.1
-+
-+
+20150306:
-+
+        Upgrade OpenSSL to 0.9.8ze
-+
-+
+20150225:
-+
+        Fix two security vulnerabilities.
-+
-+
+. BIND servers which are configured to perform DNSSEC validation and which
-+
+        are using managed keys (which occurs implicitly when using
-+
+        "dnssec-validation auto;" or "dnssec-lookaside auto;") may exhibit
-+
+        unpredictable behavior due to the use of an improperly initialized
-+
+        variable.
-+
-+
+        CVE-2015-1349
-+
-+
+. An integer overflow in computing the size of IGMPv3 data buffer can result
-+
+        in a buffer which is too small for the requested operation.
-+
-+
+        This can result in a DOS attack.
-+
-+
+20141211:
-+
+        Fix a security issue with file and libmagic that can allow
-+
+        an attacker to create a denial of service attack on any
-+
+        program that uses libmagic.
-+
-+
+20141109:
-+
+        Fix building perl during buildworld when the GDBM port is installed.
-+
-+
+20141106:
-+
+        tzdata 2014i
-+
-+
+20141102:
-+
+        serf 1.3.8
-+
-+
+20141031:
-+
+        tnftp 20141031 fixes a security vulnerability with tnftp,
-+
+        CVE-2014-8517.
-+
-+
+20141028:
-+
+        OpenSSL 0.9.8zc
-+
-+
+20141021:
-+
+        Fix several security vulnerabilities in routed, rtsold,
-+
+        and namei with respect to Capsicum sandboxes looking up
-+
+        nonexistent path names and leaking memory.
-+
-+
+        The input path in routed(8) will accept queries from any source and
-+
+        attempt to answer them.  However, the output path assumes that the
-+
+        destination address for the response is on a directly connected
-+
+        network.
-+
-+
+        Due to a missing length check in the code that handles DNS parameters,
-+
+        a malformed router advertisement message can result in a stack buffer
-+
+        overflow in rtsold(8).
-+
-+
+20141011:
-+
+        mksh R50d - fix field splitting regression and null
-+
+        pointer dereference
-+
-+
+        xz 5.0.7
-+
-+
+        OpenSSH 6.6p1
-+
+20141004:
+        mksh R50c - security update for environment var bug with
+        foo vs foo+

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing trunk/UPDATING (file contents): Revision 6841 by laffer1, Sat Oct 4 14:23:36 2014 UTC vs. Revision 8465 by laffer1, Sun Sep 18 22:20:09 2016 UTC

Diff Legend

Comparing trunk/UPDATING (file contents):
Revision 6841 by laffer1, Sat Oct 4 14:23:36 2014 UTC vs.
Revision 8465 by laffer1, Sun Sep 18 22:20:09 2016 UTC