ViewVC Help
View File | Revision Log | Show Annotations | Download File | View Changeset | Root Listing
root/src/trunk/UPDATING
(Generate patch)

Comparing trunk/UPDATING (file contents):
Revision 1598 by laffer1, Fri May 16 22:38:32 2008 UTC vs.
Revision 7782 by laffer1, Mon Sep 5 16:20:48 2016 UTC

# Line 1 | Line 1
1 < Updating Information for MidnightBSD users
1 > Updating Information for MidnightBSD users.
2  
3 < Items affecting the mports and packages system can be found in
4 < /usr/mports/UPDATING.
3 > 20160905:
4 >        Add a resource limit for the total number of kqueues
5 >        available to the user. Kqueue now saves the ucred of the
6 >        allocating thread, to correctly decrement the counter on close.
7 >        Based on FreeBSD SVN 256849
8  
9 + 20160814:
10 +        switched default desktop port to midnightbsd-desktop. This gives us flexibility to change it
11 +        in the release after the fact.
12 +
13 +        tzdata 2016a
14 +
15 + 20160811:
16 +        libdispatch 210
17 +
18 +        Added quirks for several models of SSDs to enable advanced format/4k mode. List includes
19 +        Samsung 830, 840, 850 and 750 series, Intel x25 and a few Toshiba models. Also
20 +        added WD Red drives.
21 +
22 +        Updated list of pci device vendors.
23 +
24 +        Updated list of usb devices.
25 +
26 + 20160807:
27 +        Implement several changes to libmport to fix some memory corruption issues.
28 +
29 + 20160806:
30 +        sqlite3 3.13.0
31 +
32 + 20160805:
33 +        Merged fixes for libmport that improve error handling when installing packages. Also
34 +        support mkdir -p like behavior for plist entries.
35 +
36 + 20160531:
37 +        Fix four security issues with MidnightBSD.
38 +
39 +        The implementation of TIOCGSERIAL ioctl(2) does not clear the output
40 +        struct before sending to userland in the linux emulation layer.
41 +
42 +        The compat 43 stat(2) system call exposes kernel stack to userland.
43 +
44 +        libarchive - CVE-2015-2304 and CVE-2013-0211 fix issues with
45 +        cpio directory traversal and an integer signedness error in the archive
46 +        write zip data routine.
47 +
48 +
49 + 20160528:
50 +        Fixed minor issues with mined(1) and msearch(1).
51 +
52 + 20160526:
53 +        Add support for Ivybridge and Haswell Intel CPUs to hwpmc(4).
54 +
55 +        Fix libpmc(3) build with clang compiler.
56 +
57 + 20160519:
58 +        Kernel Security updates
59 +
60 +        atkbd(4) - Incorrect signedness comparison in the ioctl(2) handler allows a malicious
61 +        local user to overwrite a portion of the kernel memory.
62 +
63 +        Incorrect argument handling in sendmsg(2)
64 +
65 +        Incorrect argument handling in the socket code allows malicious local
66 +        user to overwrite large portion of the kernel memory.
67 +
68 + 20160505:
69 +        OpenSSL security patch
70 +
71 +        The padding check in AES-NI CBC MAC was rewritten to be in constant time
72 +        by making sure that always the same bytes are read and compared against
73 +        either the MAC or padding bytes. But it no longer checked that there was
74 +        enough data to have both the MAC and padding bytes. [CVE-2016-2107]
75 +
76 +        An overflow can occur in the EVP_EncodeUpdate() function which is used for
77 +        Base64 encoding of binary data. [CVE-2016-2105]
78 +
79 +        An overflow can occur in the EVP_EncryptUpdate() function, however it is
80 +        believed that there can be no overflows in internal code due to this problem.
81 +        [CVE-2016-2106]
82 +
83 +        When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
84 +        a short invalid encoding can casuse allocation of large amounts of memory
85 +        potentially consuming excessive resources or exhausting memory.
86 +        [CVE-2016-2109]
87 +
88 + 20160412:
89 +        0.8 stable branch created. Continue development as 0.9.
90 +
91 +        Fix several issues with wait6 system call addition.
92 +
93 + 20160409:
94 +        libmport now supports two new plist formats:
95 +        @(root,wheel,4775) myfile
96 +        @dir(root,wheel,775) mydir
97 +
98 +        On delete, absoluate paths are now handled properly.
99 +
100 + 20160317:
101 +        OpenSSH doesn't have the luck of the Irish.
102 +
103 +        Fix a security issue with OpenSSH X11 forwarding that can allow an attacker
104 +        run shell commands on the call to xauth.
105 +
106 +        Incorrect argument validation in sysarch(2)
107 +
108 +        A special combination of sysarch(2) arguments, specify a request to
109 +        uninstall a set of descriptors from the LDT.  The start descriptor
110 +        is cleared and the number of descriptors are provided.  Due to invalid
111 +        use of a signed intermediate value in the bounds checking during argument
112 +        validity verification, unbound zero'ing of the process LDT and adjacent
113 +        memory can be initiated from usermode.
114 +
115 +        Patch obtained from FreeBSD.
116 +
117 + 20160229:
118 +        top now displays information on ZFS arc cache.
119 +
120 + 20160228:
121 +        llvm + clang 3.3 is now the default compiler in MidnightBSD.
122 +
123 + 20160222:
124 +        Introduce pipe2 to linux emulation layer.
125 +
126 + 20160114:
127 +        OpenSSL
128 +
129 +        The signature verification routines will crash with a NULL pointer dereference
130 +        if presented with an ASN.1 signature using the RSA PSS algorithm and absent
131 +        mask generation function parameter. [CVE-2015-3194]
132 +
133 +        When presented with a malformed X509_ATTRIBUTE structure, OpenSSL will leak
134 +        memory. [CVE-2015-3195]
135 +
136 +        If PSK identity hints are received by a multi-threaded client then the values
137 +        are incorrectly updated in the parent SSL_CTX structure.  [CVE-2015-3196]
138 +
139 +        Fix security on bsnmpd configuration file during installation.
140 +
141 +        TCP MD5 signature denial of service
142 +
143 +        A programming error in processing a TCP connection with both TCP_MD5SIG
144 +        and TCP_NOOPT socket options may lead to kernel crash.
145 +
146 +        SCTP
147 +
148 +        A lack of proper input checks in the ICMPv6 processing in the SCTP stack
149 +        can lead to either a failed kernel assertion or to a NULL pointer
150 +        dereference.  In either case, a kernel panic will follow.
151 +
152 + 20160102:
153 +        Happy New Year
154 +
155 + 20151101:
156 +        Increase kern.ipc.somaxconn default to 256.
157 +
158 + 20151017:
159 +        Add initial statistics api to libmport and a driver to print
160 +        it in mport(1).
161 +
162 + 20151002:
163 +        Revised rpcbind(8) patch to fix issues with NIS
164 +
165 + 20150930:
166 +        In rpcbind(8), netbuf structures are copied directly, which would result in
167 +        two netbuf structures that reference to one shared address buffer.  When one
168 +        of the two netbuf structures is freed, access to the other netbuf structure
169 +        would result in an undefined result that may crash the rpcbind(8) daemon.
170 +
171 + 20150926:
172 +        libmport now supports @preexec, @postexec, @preunexec and @postunexec
173 +        to replace @exec and @unexec.  
174 +
175 +        pre exec runs afer pre-install scripts but before actual installation
176 +
177 +        post exec runs after install but before post install scripts and
178 +        pkg message.
179 +
180 +        pre unexec runs before pre uninstall scripts
181 +
182 +        post unexec runs before de-install scripts and after file removal.
183 +
184 + 20150917:
185 +        Fix kqueue write events for files > 2GB
186 +
187 + 20150825:
188 +        kernel:
189 +        fix a security issue on amd64 where the GS segment CPU register can be changed via
190 +        userland value in kernel mode by using an IRET with #SS or #NP exceptions.
191 +
192 +        openssh:
193 +        A programming error in the privileged monitor process of the sshd(8)
194 +        service may allow the username of an already-authenticated user to be
195 +        overwritten by the unprivileged child process.
196 +
197 +        A use-after-free error in the privileged monitor process of he sshd(8)
198 +        service may be deterministically triggered by the actions of a
199 +        compromised unprivileged child process.
200 +
201 +        A use-after-free error in the session multiplexing code in the sshd(8)
202 +        service may result in unintended termination of the connection.
203 +
204 + 20150818:
205 +        expat security fix
206 +
207 + 20150815:
208 +        libc changes:
209 +        setmode(3) now returns errno consistently on error.
210 +        libc will compile without error using clang
211 +
212 + 20150814:
213 +        wait6 system call added.
214 +
215 +        date(1) now handles non numeric numbers passed to -r
216 +        like GNU coreutils for improved compatibility.
217 +
218 + 20150811:
219 +        ata(4) AMD Hudson2 SATA controller support.
220 +        Intel lynxpoint SATA.
221 +
222 +        Fix some const warnings when building several device drivers
223 +        with llvm/clang.
224 +
225 +        Sync cas(4) with FreeBSD 9-stable.
226 +
227 +        Fix some minor issues with ath(4).
228 +
229 + 20150809:
230 +        xz 5.0.8
231 +
232 + 20150808:
233 +        libmport now logs installation and removal of packages to syslog.
234 +
235 + 20150805:
236 +        routed - fix a potential security issue where traffic from outside
237 +        the network can disrupt routing.
238 +
239 +        bsd patch - fix a bug with ed(1) scripts allowing unsanitized input
240 +        to run.
241 +
242 + 20150802:
243 +        jansson 2.7 library added. (libjansson is a JSON library in C)
244 +
245 + 20150728:
246 +        Heimdal 1.5.2 (kerberos implementation)
247 +
248 +        OpenSSL 1.0.1o
249 +
250 +        cpucontrol(8) now supports VIA CPUs. Synced with FreeBSD 9.2.
251 +
252 +        TCP Resassemly resource exhaustion bug:
253 +        There is a mistake with the introduction of VNET, which converted the
254 +        global limit on the number of segments that could belong to reassembly
255 +        queues into a per-VNET limit.  Because mbufs are allocated from a
256 +        global pool, in the presence of a sufficient number of VNETs, the
257 +        total number of mbufs attached to reassembly queues can grow to the
258 +        total number of mbufs in the system, at which point all network
259 +        traffic would cease.
260 +        Obtained from: FreeBSD 8
261 +
262 +        OpenSSH
263 +
264 +        Fix two security vulnerabilities:
265 +        OpenSSH clients does not correctly verify DNS SSHFP records when a server
266 +        offers a certificate. [CVE-2014-2653]
267 +
268 +        OpenSSH servers which are configured to allow password authentication
269 +        using PAM (default) would allow many password attempts. A bug allows
270 +        MaxAuthTries to be bypassed. [CVE-2015-5600]
271 +
272 +
273 +        Switch to bsdpatch (from FreeBSD & OpenBSD)
274 +
275 + 20150726:
276 +        BSD Sort updated
277 +
278 +        sqlite 3.8.10.2
279 +
280 + 20150725:
281 +        Import reallocarray from OpenBSD's libc.  
282 +
283 +        The reallocarray() function is similar to realloc() except it operates on
284 +        nmemb members of size size and checks for integer overflow in the
285 +        calculation nmemb * size.
286 +
287 + 20150722:
288 +        Fix a bug where TCP connections transitioning to LAST_ACK
289 +        state can get stuck. This can result in a denial of service.
290 +
291 + 20150715:
292 +        libmport now supports @shell and @sample in plists. This means that
293 +        a shell port can automatically add an entry to /etc/shells and remove
294 +        it upon uninstallation. For sample files, a copy is made without the
295 +        .sample extension if one does not exist and it is removed automatically
296 +        only if the md5 hash of the two files is the same.
297 +
298 + 20150709:
299 +        flex 2.5.39
300 +
301 + 20150702:
302 +        ZFS in MidnightBSD now supports lz4 compression. You can enable it
303 +        with zfs set compression=lz4 pool/path.
304 +
305 +        Verify it's working with
306 +        zfs get compressratio pool/path
307 +        du -h -s *
308 +
309 +        Note you must write new data when turning on compression to see
310 +        changes. Existing files are not compressed.
311 +
312 +        Note: While we used the same basic implementation of lz4 that
313 +        FreeBSD and OpenZFS uses, we did not yet implement features support
314 +        and the zfs version still reports 28. This may come in a future update
315 +        to ZFS.
316 +
317 + 20150621:
318 +        libmport now automatically stops services when deleting packages.
319 +
320 +        The package must have installed an rc.d script in /usr/local/etc
321 +        for this to work. This is equivalent to running service <name> onestop
322 +
323 + 20150618:
324 +        Sendmail
325 +
326 +        With the recent changes to OpenSSL to block 512 bit certificates,
327 +        sendmail can't connect with TLS to some servers.
328 +
329 +        Increase the default size to 1024 bit for client connections to
330 +        match the server configuration.
331 +
332 +        ZFS
333 +
334 +        Added ZFS TRIM support which is enabled by default. To disable
335 +        ZFS TRIM support set vfs.zfs.trim.enabled=0 in loader.conf.
336 +
337 +        Creating new ZFS pools and adding new devices to existing pools
338 +        first performs a full device level TRIM which can take a significant
339 +        amount of time. The sysctl vfs.zfs.vdev.trim_on_init can be set to 0
340 +        to disable this behaviour.
341 +
342 +        ZFS TRIM requires the underlying device support BIO_DELETE which
343 +        is currently provided by methods such as ATA TRIM and SCSI UNMAP
344 +        via CAM, which are typically supported by SSD's.
345 +
346 +        Stats for ZFS TRIM can be monitored by looking at the sysctl's
347 +        under kstat.zfs.misc.zio_trim.
348 +
349 +        rc.d
350 +
351 +        Reworked handling of cleanvar and FILESYSTEMS so that FILESYSTEMS
352 +        implies everything is mounted and ready to go.
353 +
354 +        Changed how ip6addressctl maps IPv6 on startup.
355 +
356 + 20150613:
357 +        tzdata 2015d
358 +
359 + 20150612:
360 +        OpenSSL 0.9.8zg
361 +
362 + 20150419:
363 +        MidnightBSD 0.6 stable branch created. Continue 0.7
364 +        development.
365 +
366 + 20150418:
367 +        sqlite 3.8.9
368 +
369 + 20150407:
370 +        Fix two security vulnerabilities:
371 +
372 +        The previous fix for IGMP had an overflow issue. This has been corrected.
373 +
374 +        ipv6: The Neighbor Discover Protocol allows a local router to advertise a
375 +        suggested Current Hop Limit value of a link, which will replace
376 +        Current Hop Limit on an interface connected to the link on the MidnightBSD
377 +        system.
378 +
379 + 20150319:
380 +        OpenSSL 0.9.8.zf
381 +
382 +        mksh R50e
383 +
384 +        Apple mDNSResponder 561.1.1
385 +
386 + 20150306:
387 +        Upgrade OpenSSL to 0.9.8ze
388 +
389 + 20150225:
390 +        Fix two security vulnerabilities.
391 +
392 +        1. BIND servers which are configured to perform DNSSEC validation and which
393 +        are using managed keys (which occurs implicitly when using
394 +        "dnssec-validation auto;" or "dnssec-lookaside auto;") may exhibit
395 +        unpredictable behavior due to the use of an improperly initialized
396 +        variable.
397 +
398 +        CVE-2015-1349
399 +
400 +        2. An integer overflow in computing the size of IGMPv3 data buffer can result
401 +        in a buffer which is too small for the requested operation.
402 +
403 +        This can result in a DOS attack.
404 +
405 + 20141211:
406 +        Fix a security issue with file and libmagic that can allow
407 +        an attacker to create a denial of service attack on any
408 +        program that uses libmagic.
409 +
410 + 20141109:
411 +        Fix building perl during buildworld when the GDBM port is installed.
412 +
413 + 20141106:
414 +        tzdata 2014i
415 +
416 + 20141102:
417 +        serf 1.3.8
418 +
419 + 20141031:
420 +        tnftp 20141031 fixes a security vulnerability with tnftp,
421 +        CVE-2014-8517.
422 +
423 + 20141028:
424 +        OpenSSL 0.9.8zc
425 +
426 + 20141021:
427 +        Fix several security vulnerabilities in routed, rtsold,
428 +        and namei with respect to Capsicum sandboxes looking up
429 +        nonexistent path names and leaking memory.
430 +
431 +        The input path in routed(8) will accept queries from any source and
432 +        attempt to answer them.  However, the output path assumes that the
433 +        destination address for the response is on a directly connected
434 +        network.
435 +
436 +        Due to a missing length check in the code that handles DNS parameters,
437 +        a malformed router advertisement message can result in a stack buffer
438 +        overflow in rtsold(8).
439 +
440 + 20141011:
441 +        mksh R50d - fix field splitting regression and null
442 +        pointer dereference
443 +
444 +        xz 5.0.7
445 +
446 +        OpenSSH 6.6p1
447 +
448 + 20141004:
449 +        mksh R50c - security update for environment var bug with
450 +        foo vs foo+    
451 +
452 + 20141002:
453 +        sqlite 3.8.6
454 +
455 +        sudo 1.7.8 - some issues with the current version, but we're slowly
456 +        getting up to date.
457 +
458 + 20141001:
459 +        mksh R50b
460 +
461 +        libmport now supports plist commands @dir, @owner, @group, @mode.
462 +
463 +        sudo 1.7.6p2
464 +
465 + 20140916:
466 +        Fix a security issue with TCP SYN.
467 +
468 +        When a segment with the SYN flag for an already existing connection arrives,
469 +        the TCP stack tears down the connection, bypassing a check that the
470 +        sequence number in the segment is in the expected window.
471 +
472 + 20140909:
473 +        Fixed a bug with our clearenv(3) implementation that caused segfaults
474 +        with some programs including Dovecot.
475 +
476 +        OpenSSL security patch:
477 +
478 +        The receipt of a specifically crafted DTLS handshake message may cause OpenSSL
479 +        to consume large amounts of memory. [CVE-2014-3506]
480 +
481 +        The receipt of a specifically crafted DTLS packet could cause OpenSSL to leak
482 +        memory. [CVE-2014-3507]
483 +
484 +        A flaw in OBJ_obj2txt may cause pretty printing functions such as
485 +        X509_name_oneline, X509_name_print_ex et al. to leak some information from
486 +        the stack. [CVE-2014-3508]
487 +
488 +        OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to
489 +        a denial of service attack. [CVE-2014-3510]
490 +
491 + 20140902:
492 +        We're now 0.6-CURRENT
493 +
494 +        Update USB quirks to support K70 Corsair keyboard, and several
495 +        other devices.
496 +
497 + 20140827:
498 +        Perl 5.18.2
499 +
500 + 20140728:
501 +        Jails now run shutdown scripts.
502 +
503 + 20140710:
504 +        Fix a vulnerability in the control message API. A buffer is not properly cleared
505 +        before sharing with userland.
506 +
507 + 20140701:
508 +        MKSH R50
509 +
510 + 20140630:
511 +        File 5.19
512 +
513 + 20140605:
514 +        Fix four security issues with OpenSSL
515 +
516 + 20140604:
517 +        Sendmail failed to properly set close-on-exec for open file descriptors.
518 +
519 +        ktrace page fault kernel trace entries were set to an incorrect size which resulted
520 +        in a leak of information.
521 +
522 + 20140430:
523 +        Fix a TCP reassembly bug that could result in a DOS attack
524 +        of the system. It may be possible to obtain portions
525 +        of kernel memory as well.
526 +
527 + 20140411:
528 +        Update zlib to 1.2.7
529 +
530 + 20140122:
531 +        Support for username with length 32. Previous limit was 16
532 +
533 + 20140114:
534 +        Fix two security vulnerabilities.
535 +
536 +        bsnmpd contains a stack overflow when sent certain queries.
537 +
538 +        bind 9.8 when using NSEC3-signed zones zones, will crash with special
539 +        crafted packets.
540 +
541 + 20131228:
542 +        Imported FreeBSD 9.2 usb stack (plus z87 patches from stable)
543 +
544 +        Updated em(4), igb(4) and ixgbe(4)
545 +
546 +        MidnightBSD now works with Z87 Intel chipsets.
547 +
548 + 20131207:
549 +        Remove sparc64 architecture. It hasn't been working for awhile
550 +        and it's not useful for desktops anymore.
551 +
552 + 20131205:
553 +        OpenSSH 6.4p1
554 +
555 + 20131203:
556 +        Perl 5.18.1 imported.
557 +
558 +        Update less to v458
559 +
560 + 20131130:
561 +        Remove named from base. We still include the client utilities for
562 +        now until replacements can be found.
563 +
564 + 20131004:
565 +        rarpd supports vlan(4) and has a pid flag. (from FreeBSD)
566 +
567 + 20130917:
568 +        Support for 65,536 routing tables was added.  A new fib specific
569 +        field has been added to mbuf.  This is an increase from 16.
570 +
571 + 20130910:
572 +        Security updates: (kern.osreldate 5001)
573 +
574 +        nullfs(5)
575 +
576 +        The nullfs(5) implementation of the VOP_LINK(9) VFS operation does not
577 +        check whether the source and target of the link are both in the same
578 +        nullfs instance.  It is therefore possible to create a hardlink from a
579 +        location in one nullfs instance to a file in another, as long as the
580 +        underlying (source) filesystem is the same.
581 +
582 +        ifioctl
583 +
584 +        As is commonly the case, the IPv6 and ATM network layer ioctl request
585 +        handlers are written in such a way that an unrecognized request is
586 +        passed on unmodified to the link layer, which will either handle it or
587 +        return an error code.
588 +
589 +        Network interface drivers, however, assume that the SIOCSIFADDR,
590 +        SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK requests have been
591 +        handled at the network layer, and therefore do not perform input
592 +        validation or verify the caller's credentials.  Typical link-layer
593 +        actions for these requests may include marking the interface as "up"
594 +        and resetting the underlying hardware.
595 +
596 + 20130824:
597 +        Fix a bug in sendmail 8.14.7 that interferes with how it
598 +        handles AAAA records interoperating with Microsoft DNS servers.
599 +        FreeBSD has already reported this to Sendmail and a fix
600 +        will be included in the next release.
601 +
602 +        Subversion 1.8.1 is now in the base system as a static
603 +        binary.  It has limited functionality, but can be used to
604 +        checkout/commit code.  It is named svnlite.
605 +
606 + 20130822:
607 +        Fix two security vulnerabilities.
608 +
609 +        Fix an integer overflow in IP_MSFILTER (IP MULTICAST).
610 +        This could be exploited to read memory by a user process.
611 +
612 +        When initializing the SCTP state cookie being sent in INIT-ACK chunks,
613 +        a buffer allocated from the kernel stack is not completely initialized.
614 +
615 +        Import xz 5.0.4
616 +
617 +        Import sqlite 3.7.17
618 +
619 +        Import BIND 9.8.5-P2
620 +
621 + 20130814:
622 +        mksh R48 imported.
623 +
624 +        Sendmail 8.14.7 imported.
625 +
626 + 20130717:
627 +        libmport bug was fixed causing hash verification to fail.
628 +
629 +        virtio(4) imported from FreeBSD 9-stable. SCSI support not
630 +        included.
631 +
632 + 20130612:
633 +        RELENG_0_4 created for 0.4. Development continues on 0.5.
634 +
635 + 20130402:
636 +        Update BIND and OpenSSL to resolve security advisories.
637 +
638 + 20130305:
639 +        MKSH R44 imported.
640 +
641 + 20130213:
642 +        MKSH R42b imported
643 +
644 + 20130211:
645 +        MKSH R42 imported
646 +
647 + 20130125:
648 +        MKSH R41 imported
649 +
650 + 20130122:
651 +        OpenSSH 5.8p2 imported
652 +
653 +        SQLite 3.7.15.2 imported
654 +
655 +        Fixed a longstanding bug in libmport extrating new index files.
656 +
657 + 20120710:
658 +        BSD licensed sort imported from FreeBSD-CURRENT
659 +
660 +        For now, GNU sort is installed as gnusort, but it will
661 +        go away in time.
662 +
663 + 20120708:
664 +        tcsh 6.18.01 imported.
665 +
666 +        NetBSD's iconv imported.
667 +
668 +        libc gains strnlen(3), memrchr(3), stpncpy(3).
669 +
670 + 20120612:
671 +        BIND security update related to CVE-2012-1667.
672 +
673 +        Zero length resource records can cause BIND to crash resulting
674 +        in a DOS attack or information disclosure.
675 +
676 + 20120407:
677 +        mksh R40f (fixes regression)
678 +
679 + 20120328:
680 +        mksh R40e
681 +
682 +        Perl 5.14.2
683 +
684 + 20120229:
685 +        cpucontrol(8) and cpuctl(4) added from FreeBSD 7-stable.
686 +
687 + 20120209:
688 +        mDNSResponder 333.10 imported
689 +
690 + 20111227:
691 +        import raid5 module for GEOM, graid5(8)
692 +
693 +        This is experimental and known to use a lot of kernel
694 +        memory.
695 +
696 + 20111223:
697 +        telnetd: fix a root exploit from a fixed buffer that was not checked
698 +
699 +        pam: don't allow escape from policy path.  Exploitable in KDE, etc.
700 +
701 +        Fix pam_ssh module:
702 +
703 +        If the pam_ssh module is enabled, attackers may be able to gain access
704 +        to user accounts which have unencrypted SSH private keys.
705 +
706 +        This has to due with the way that openssl works.  It ignores unencrpted data.
707 +
708 +        Fix security issue with chroot and ftpd.
709 +
710 +        nsdispatch(3) doesn't know it's working in a chroot and some
711 +        operations can cause files to get reloaded causing a security
712 +        hole in things like ftpd.
713 +
714 + 20111217:
715 +        libdialog/dialog upgraded to an lgpl version. As it's not
716 +        backwardly compatable, include the old libdialog as libodialog
717 +
718 + 20111212:
719 +        mksh r40d imported
720 +
721 + 20111210:
722 +        re(4) and rl(4) updated to support new chips.
723 +
724 +        GEOM synced with FreeBSD 7-stable.
725 +
726 +        MidnightBSD GPT partition types created in sys/gpt.h and
727 +        setup in boot loader and GEOM.
728 +
729 +        amdsbwd(4) (amd watchdog for south bridge) updated to support
730 +        8xx series chipset.
731 +
732 + 20111207:
733 +        import bsd grep from FreeBSD/OpenBSD.
734 +
735 +        MK_BSD_GREP controls which grep is installed
736 +        as grep with the other as bsdgrep or gnugrep.
737 +
738 + 20111122:
739 +        mksh vR40c imported.
740 +
741 + 20111117:
742 +        BIND 9.6 ESV R5 P1
743 +
744 + 20111107:
745 +        tzdata 2011n
746 +
747 + 20111026:
748 +        mDNSResponder v320
749 +
750 +        BIND 9.6 ESV R5
751 +
752 + 20111022:
753 +        cflow 0.0.6 imported
754 +
755 + 20111020:
756 +        less v436 imported
757 +
758 +        amdsbwd(4) AMD southbridge watchdog
759 +
760 + 20111019:
761 +        awk 20110810 imported
762 +
763 +        et(4) Agere Gigabit Ethernet/Fast Ethernet driver added, but
764 +        not included in GENERIC kernel.  The kernel module needs
765 +        testing before we can include it in GENERIC.
766 +
767 +        intr_bind code ported to allow an IRQ to be bound to one
768 +        specific CPU core.
769 +
770 + 20111017:
771 +        Time Zone Data v. 2011l (Released 10 October 2011)
772 +
773 +        Updated list of countries (iso3166) to work with new timezone data.
774 +
775 + 20111015:
776 +        Introduce CPU Affinity in MidnightBSD. cpuset(1) can be used
777 +        to control which core or group of cores can be used for a given
778 +        process. Several new system calls were added to support this
779 +        functionality in the running kernel and for 32bit binary
780 +        compatibility on amd64.
781 +
782 +        The scheduler default has been changed to ULE in i386 and
783 +        amd64.  Changes were made to both schedulers (4BSD AND ULE)
784 +        for this feature.
785 +
786 +        This work is based on Jeff Roberson's FreeBSD 7.1 patches.
787 +
788 + 20111004:
789 +        Fix a problem with unix socket handling caused by the recent
790 +        patch to unix socket path handling. This allows network
791 +        apps to work under the linuxolator again.
792 +
793 + 20111001:
794 +        Import libfetch & fetch(1) from FreeBSD 9. Passive FTP is
795 +        now default and an environment variable must be set to use
796 +        active.
797 +
798 + 20110930:
799 +        Introduce quirks handling for several umass devices including
800 +        USB cameras.  Add workaround for Cyberpower UPS devices.
801 +
802 +        Bring in further bug fixes from FreeBSD and NetBSD for alc(4).
803 +        Stale ip/tcp header pointers are no longer used, lockups fixed
804 +        when network cable is unplugged on bootup, enable TX checksum
805 +        offloading.
806 +
807 +        Add a new man page for gcache(8), a useful geom class when
808 +        working with large raid3 sets.
809 +
810 +        Restore previous workaround for Cypress pata storage controller.
811 +
812 + 20110929:
813 +        Sync ath(4) with FreeBSD 7.3.
814 +
815 +        The following modules are no longer available, and should be
816 +        removed from loader.conf:
817 +        ath_hal ath_rate_amrr ath_rate_onoe ath_rate_sample
818 +
819 +        alc(4) would hibernate when a cable was unplugged and often
820 +        required bring the interface down and up to "wake up" so that
821 +        a connection could be established.  Disable hibernation.
822 +
823 + 20110928:
824 +        Fix security issues with gzip and compress related to .Z
825 +        files that are corrupted.
826 +
827 +        Fix path validation with unix domain sockets.
828 +
829 + 20110917:
830 +        Remove dependance on mports perl for generating releases as
831 +        it's in the base system.
832 +
833 + 20110914:
834 +        Import xz 5.0.3 with liblzma 5.0.3
835 +
836 + 20110813:
837 +        synced the sparc64 GENERIC kernel configuration with amd64.
838 +
839 + 20110806:
840 +        sqlite 3.7.7.1 imported
841 +
842 +        msearch(1), libmsearch and msearch.import added.  msearch(1) provides
843 +        a full text search command line tool.  libmsearch can also be used
844 +        to build a graphical based search in the future. You can enable
845 +        index building for msearch in periodic.conf or manually run the
846 +        /usr/libexec/msearch.index tool.  Full text indexes take considerable
847 +        space in /var.  I'm using approximately 500MB currently.
848 +
849 +        Fix a long standing bug with the periodic script to check package
850 +        versions.  This will be obsolete with mport though.
851 +
852 + 20110710:
853 +        kdb_enter_why added to MidnightBSD to allow the kernel debugger to
854 +        know why it's in use and thus script can be run.
855 +
856 +        Yet another problem with the perl manifest was fixed
857 +
858 + 20110709:
859 +        cpufreq(1) is a new utility to monitor CPU frequency which may change
860 +        with use of powerd(8) and cpufreq(4).
861 +
862 + 20110612:
863 +        Update mksh to R40
864 +
865 +        Catch up ObsoleteFiles.inc to remove Perl 5.10.x.  Good to run when
866 +        updating current (cd /usr/src && make check-old)
867 +
868 + 20110528:
869 +        Fix CVE-2011-1910 in BIND 9.6.x.  This affects caching resolvers.
870 +
871 + 20110526:
872 +        newfs:
873 +        Raised the default blocksize for UFS/FFS filesystems from
874 +        16K to 32K and the default fragment size from 2K to 4K.
875 +
876 +        This should slightly imporve performance on "advanced format"
877 +        hard drives such as the WD EARS drives. Drives of this type
878 +        have emulation modes that slow down with lower sizes.  Of course
879 +        the drive must still be aligned properly when using fdisk.
880 +
881 + 20110521:
882 +        mport tool now has a deleteall command.  This can be used to remove
883 +        all packages from a system.
884 +
885 +        A few bugs with the perl 5.14 import have been fixed.
886 +
887 + 20110518:
888 +        Perl 5.14.0
889 +
890 + 20110517:
891 +        Sendmail 8.14.5
892 +
893 + 20110314:
894 +        DRM/DRI code updated to support newer video cards. (FreeBSD 7.1)
895 +
896 +        cdevpriv wrappers added
897 +
898 +        nss_mdns hack introduced to work around linking problem.
899 +
900 +        dnsextd fixed after update to mDNSResponder code.
901 +
902 + 20110308:
903 +        Introduce liblzma & xz 5.0.1 to the base system
904 +
905 +        Patch for OpenSSL security issue CVE-2011-0014.
906 +
907 +        "OSREVISION 4004"
908 +
909 +        nsswitch module for multicast dns (nss_mdns) added.
910 +
911 +        tzdata2011c
912 +
913 + 20110220:
914 +        cam(4) syncronized with FreeBSD 7.3.
915 +
916 + 20110219:
917 +        amdtemp(4) updated to support sensors framework.
918 +
919 + 20110217:
920 +        Perl 5.10.1 imported
921 +
922 + 20110216:
923 +        Introduce igb(4) and split Intel Gigabit Ethernet adapters between
924 +        igb(4) and em(4).  Newer devices use igb(4).  The code has moved
925 +        to sys/dev/e1000 for both devices in the kernel. igb(4) has
926 +        been placed in GENERIC on i386 and amd64.
927 +
928 +        Update bfe(4) to support newer devices and WOL.
929 +
930 + 20110215:
931 +        age(4) added.
932 +
933 + 20110208:
934 +        BIND 9.6.3 which fixes a bug with DNSSEC records getting added.
935 +
936 + 20110206:
937 +        eeemon(4) added to monitor Asus Eee PC.
938 +
939 + 20110205:
940 +        OpenSSH 5.7p1
941 +
942 +        GNU sort 6.9 (coreutils)
943 +
944 + 20110203:
945 +        one true awk 20100523 imported
946 +
947 +        sqlite 3.7.5
948 +
949 +        OpenSSL 0.9.8q
950 +
951 + 20110202:
952 +        tcsh 6.17.00
953 +
954 +        file 5.05
955 +
956 + 20110122:
957 +        Import it(4) and lm(4), with support for Super I/O hardware monitors. This
958 +        uses the sensors framework ported by Constantine A. Murenin (GSOC2007)
959 +
960 + 20110120:
961 +        BIND 9.6.2-P3
962 +
963 +        sudo 1.7.4-p6
964 +
965 + 20110115:
966 +        Add experimental jme(4) for Jmicron ethernet devices.
967 +
968 + 20101130:
969 +        A double free exists in the SSL client ECDH handling code, when
970 +        processing specially crafted public keys with invalid prime
971 +        numbers. [CVE-2010-2939]
972 +
973 + 20101120:
974 +        Several portions of the kernel and userland code related to UFS file
975 +        systems (and UFS2) cannot properly handle inode counts above 2^31 due
976 +        to use of int types.  Based on a patch from FreeBSD, I've modified
977 +        our UFS2 implementation to handle unsigned values for inode counts
978 +        which should allow for file systems greater than 16TB.
979 +
980 +        newfs and growfs was also modified.
981 +
982 + 20101110:
983 +        Fix a security issue with pseudofs which could result in running code in kernel
984 +        context or a kernel panic depending on system configuration.  This affects file
985 +        systems such as procfs for instance.
986 +
987 + 20101021:
988 +        sysrc is a utility to print and modify name/value pairs in /etc/rc.conf easily.
989 +        This is similar to functions present in many linux distros. The utility was
990 +        written by Devin Teske for FreeBSD.
991 +
992 + 20100920:
993 +        bzip2 security patch for integer overflow.
994 +
995 + 20100905:
996 +        MidnightBSD RELENG_0_3 branch created.  Aggressive development continues here
997 +        for 0.4.
998 +
999 + 20100902:
1000 +        Fix a security issue with libutil that allows users to bypass cpu limits in
1001 +        login.conf in some cases.  This combined with OpenSSH for example can allow
1002 +        the user to get more resources than they're allowed.
1003 +
1004 + 20100822:
1005 +        Import Apple's mDNSResponder (mdnsd).
1006 +
1007 + 20100814:
1008 +        libdispatch added to MidnightBSD.  This provides functionality found in
1009 +        Mac OS X's GCD.  We do not have blocks support yet.  As this code is
1010 +        licensed under Apache 2, we create a new MK_APACHE option so that
1011 +        it's not required for all users to run code under a license they
1012 +        may not like.
1013 +
1014 + 20100713:
1015 +        mbuf readonly fix related to sendfile(2) data corruption.
1016 +
1017 + 20100704:
1018 +        brainfuck(1) imported from MirBSD.
1019 +
1020 + 20100505:
1021 +        zlib 1.2.5
1022 +
1023 + 20100430:
1024 +        Sudo 1.7.2p6 imported
1025 +
1026 + 20100321:
1027 +        Update zlib to 1.2.4
1028 +
1029 + 20100319:
1030 +        Removed i586 from default i386 generic kernel.
1031 +
1032 + 20100317:
1033 +        Update to tzdata2010e (time zones).  This includes changes in
1034 +        Mexico.
1035 +
1036 +        Add support for several newer sound cards via hda including
1037 +        ATI and Realtek chipsets.
1038 +
1039 + 20100313:
1040 +        CPU detection has been changed.  VIA Padlock detection added.
1041 +
1042 + 20100312:
1043 +        Fix a number of bugs and compiler warnings in libmport. Handle
1044 +        plus signs in paths for mport.check-fake
1045 +
1046 + 20100311:
1047 +        mksh R39c
1048 +
1049 + 20100309:
1050 +        Sudo 1.7.2p5
1051 +
1052 +        sqlite3 3.6.23
1053 +
1054 +        mksh R39b
1055 +
1056 +        libffi (ffi) 3.0.9
1057 +
1058 + 20100206:
1059 +        WITHOUT_LIB32 is no longer needed on AMD64.  GCC was fixed to
1060 +        properly pass arguments to ld.
1061 +
1062 +        re(4) and rl(4) have been updated to support several new
1063 +        realtek chipsets.  Performance has been improved on re(4).
1064 +
1065 + 20100204:
1066 +        Fix a bug cropping up on AMD64 MidnightBSD with sftp
1067 +        segfaulting.  
1068 +
1069 + 20100116:
1070 +        Import ash changes from FreeBSD (bin/sh) 8-Stable.
1071 +
1072 +        BIND 9.6.1-P2
1073 +
1074 + 20100110:
1075 +        Import Sendmail 8.14.4. Fix for SSL vulnerability.
1076 +
1077 +        posix_spawn(3) added to MidnightBSD libc.  Users may need to build and
1078 +        install libc before doing a full buildworld when upating from 0.2 or
1079 +        older current systems.
1080 +
1081 +        kqueue(2) was modified to support portions of libdispatch functionality.
1082 +
1083 + 20100106:
1084 +        Bind security update.  Fix a bug with DNSSEC that causes negative
1085 +        cache entries and thus a possible DNS cache poisoning attack.
1086 +
1087 +        Fix a bug in ZFS that can reset permissions on system crashes.
1088 +
1089 + 20091228:
1090 +        amdtemp(4) was added.  It allows one to monitor to the temperature
1091 +        of an AMD CPU such as a Phenom.
1092 +
1093 + 20091205:
1094 +        OpenSSL security fix
1095 +
1096 +        The SSL version 3 and TLS protocols support session renegotiation without
1097 +        cryptographically tying the new session parameters to the old parameters.
1098 +
1099 + 20091128:
1100 +        OpenBSD sensors framework imported including sensorsd(8)
1101 +
1102 + 20091126:
1103 +        OpenNTPD 4.4 import
1104 +
1105 +        Update OpenSSH to 5.3p1
1106 +
1107 +        mksh R39
1108 +
1109 + 20091124:
1110 +        cpdup updated from DragonFly to 1.15
1111 +
1112 +        tzdata2009s updated with latest timezone data for November 2009.
1113 +
1114 + 20091010:
1115 +        amd64 users should use WITHOUT_LIB32=yes in /etc/make.conf for now
1116 +        to test current.
1117 +
1118 +        Revert unicode filename fixes from ntfs code.  This was causing chaos
1119 +        on amd64 systems.
1120 +
1121 + 20091006:
1122 +        Update timezone data with tzdata2009n with the Pakistan and
1123 +        Argentina changes.
1124 +
1125 +        Sync several userland utilities with versions from FreeBSD 7.0 in
1126 +        sbin and usr.sbin.
1127 +
1128 + 20090919:
1129 +        Update timezone data with tzdate2009m from September 2009.
1130 +
1131 + 20090729:
1132 +        Patch for Bind 9 security vulnerability. a dynmaic update packet
1133 +        can trigger an assertion and cause named to exit
1134 +
1135 + 20090606:
1136 +        Remove PCC from the base system.  This compiler will not work
1137 +        as a system compiler for us as we've got some userland investment
1138 +        in C++ code and may have Objective-C in the future.  We're stuck
1139 +        with a solution that supports these three languages at a minimum.
1140 +
1141 +        I had wanted to keep it as an optional compiler because it is
1142 +        fast, however too many users want to try to use it for the base
1143 +        system which makes no sense.
1144 +
1145 +        A hack was added for Cypress based usb hard drive enclosures to
1146 +        the kernel.  This should cut down on commands it claims to support
1147 +        but does not (at the cam layer).  Found while testing ZFS on
1148 +        an external device.
1149 +
1150 + 20090520:
1151 +        The powerd daemon no longer starts automatically to improve
1152 +        compatibility with many systems.  However, there is a new
1153 +        installer option in the startup section to enable it. This
1154 +        makes it easier to enable for users that have working systems. I                thought it was only a problem on older hardware, but it freaks
1155 +        out my new Phenom too.
1156 +
1157 + 20090502:
1158 +        OpenSSH 5.2p1 import
1159 +
1160 +        ale(4) connected to the build. (kernel module only)
1161 +
1162 + 20090501:
1163 +        Imported makefs utility from NetBSD/FreeBSD
1164 +
1165 + 20090422:
1166 +        OpenSSL security update
1167 +
1168 +        The function ASN1_STRING_print_ex does not properly validate the lengths
1169 + of BMPString or UniversalString objects before attempting to print them.
1170 +
1171 + 20090415:
1172 +        Created a Symbol.map for libc/ohash symbols
1173 +
1174 +        Updated several usr/bin usr/sbin utilities.
1175 +
1176 +        Corrected a bug with Makefile.inc1 causing the bootstrap
1177 +        tools to fail.
1178 +
1179 + 20090405:
1180 +        xorg 7.4 wants to configure its input devices via hald which does not
1181 +        yet work with USB. If the keyboard/mouse does not work in xorg then
1182 +        add
1183 +                Option "AllowEmptyInput" "off"
1184 +        to your ServerLayout section.  This will cause X to use the configured
1185 +        kbd and mouse sections from your xorg.conf
1186 +
1187 + 20090403:
1188 +        mksh was disconnected a few day ago do to bugs with
1189 +        buildworld and mports.  Now, connect it back
1190 +        for use as /bin/sh with a conditional called
1191 +        MK_ASH.  By default, ash is the standard /bin/sh
1192 +        but we may change this later.  This will allow further
1193 +        testing by users and developers of mksh without
1194 +        causing an unpleasant default experience.  In the
1195 +        long run, we need to fix mksh compatibility.
1196 +
1197 + 20090328:
1198 +        Bring in mksh R37 from CVS. The dot.mkshrc files for root
1199 +        and skel were changed.  mksh(1) now replaces ash aka sh(1)
1200 +        as the default /bin/sh.  Please report bugs with
1201 +        ports, etc. The ash code will remain in the repo for awhile
1202 +        as I decide if we'll add something like MK_SHELL_ASH as
1203 +        an optional build parameter.  
1204 +
1205 +        ahd was disconnected from the lint environment until
1206 +        the compiler bug is sorted (by updating gcc?)
1207 +
1208 +        Remove freebsd-tips from fortune files and change the
1209 +        default for login and profile.
1210 +
1211 + 20090327:
1212 +        Update libarchive to 2.5.5, tar, and add bsdcpio.
1213 +
1214 +        Also previously, ctriv has been connecting Perl 5.10
1215 +        to the build (part of os).  This will have an impact
1216 +        on mports.
1217 +
1218 + 20090325:
1219 +        Update Bind to 9.4.3-P1
1220 +
1221 +        Update mksh to R36b
1222 +
1223 +        Update tcpdump to 3.9.8, fix libpcap to work with current.
1224 +
1225 +        Update pnpinfo, sync with FreeBSD.
1226 +
1227 + 20090115:
1228 +        Fix a problem with DNSSEC and BIND.
1229 +
1230 + 20090110:
1231 +        For applications using OpenSSL for SSL connections, an invalid SSL
1232 +        certificate may be interpreted as valid.  This could for example be
1233 +        used by an attacker to perform a man-in-the-middle attack.
1234 +
1235 +        Other applications which use the OpenSSL EVP API may similarly be
1236 +        affected.
1237 +
1238 +        Stop cross site request forgery attacks in lukemftpd
1239 +
1240 + 20090104:
1241 +        Import GNU libreadline 5.2
1242 +
1243 + 20090101:
1244 +        Update time zone data to 2008i.
1245 +
1246 + 20081231:
1247 +        Correct a problem where bluetooth and netgraph sockets are not
1248 +        properly initialized.
1249 +
1250 +        Happy 2009.
1251 +
1252 + 20081206:
1253 +        Due to the massive change in the underlying system under way,
1254 +        we're naming the next release 1.0.  The sys/sys/param.h was
1255 +        changed accordingly.  ipfilter and ncurses were corrected
1256 +        using __MidnightBSD__ tests in the code.  
1257 +
1258 +        The GENERIC kernel config was caught up on i386 today.  Consider
1259 +        i386 still broken, but amd64 is running again.
1260 +
1261 +        mdoc.local was updated with the new MidnightBSD version info.
1262 +
1263 +        batt(1) was rewritten in C.  It now supports several flags and
1264 +        runs about 8 times faster on my laptop.  The default output
1265 +        shows the number of minutes of battery life remaining and the
1266 +        percentage.  You can use -u to display the number of batteries or
1267 +        -c to get script friendly output.  Consult the man page for more.
1268 +
1269 + 20081204:
1270 +        Work has completed on importing ZFS, jemalloc, several
1271 +        new devices, SCTP, updated pf, a new tempfs, linuxolator 2.6 kernel
1272 +        support, improved locking for file desc., audit (openbsm),
1273 +        openssl .98e, nfe, imporved intel high def audio, midi, updated
1274 +        intel gigabit (em), support for several wifi cards (intel), ...
1275 +
1276 +        Renamed 0.3-CURRENT officially. Switched to using MidnightBSD version
1277 +        data from param.h instead of the FreeBSD version.  This means
1278 +        testing is now possible in the ports tree for the version
1279 +        and that any ports or code relying on the FreeBSD version from
1280 +        sys/sys/param.h will need to be fixed.
1281 +
1282 + 20080905:
1283 +        update nve(4) to support new hardware.
1284 +
1285 + 20080801:
1286 +        Import OpenBSM 1.0
1287 +
1288 +        Modify src/release to create 3 isos instead of 2 for packages.
1289 +
1290 +        etc/rc.d/firstboot now enables kdm, gnustep + slim and bsdstats.
1291 +
1292 +        Many ia64, alpha, powerpc items were removed.
1293 +
1294 +        The recent diffutils 2.8.7 import was fixed.
1295 +
1296 + 20080703:
1297 +        pcc was not installed properly when setting DESTDIR for live cds,
1298 +        or posibly jails.
1299 +
1300 + 20080627:
1301 +        Add firmware(9), WEP, CCMP, TKIP to GENERIC.
1302 +
1303 +        Add glabel to GENERIC.
1304 +
1305 +        Intel ICH8 mobile chipset used on some iMacs included with ata.
1306 +
1307 +        pcc connected to the build on i386. (alternative compiler)
1308 +
1309 +        ath added to GENERIC.  (Atheros wireless NICs) on amd64/i386
1310 +
1311 + 20080528:
1312 +        Sendmail 8.14.3
1313 +
1314   20080516:
1315          ssh-vulnkey allows you to look for vulnerable ssh keys that
1316          were generated on Debian and Ubuntu hosts over the last
# Line 562 | Line 1870 | Contact Warner Losh if you have any questions about yo
1870   this document.
1871  
1872   $FreeBSD: src/UPDATING,v 1.416.2.18 2006/02/22 11:51:57 yar Exp $
1873 < $MidnightBSD: src/UPDATING,v 1.36 2008/05/01 04:46:25 laffer1 Exp $
1873 > $MidnightBSD$

Comparing trunk/UPDATING (property cvs2svn:cvs-rev):
Revision 1598 by laffer1, Fri May 16 22:38:32 2008 UTC vs.
Revision 7782 by laffer1, Mon Sep 5 16:20:48 2016 UTC

# Line 1 | Line 0
1 1.37

Comparing trunk/UPDATING (property svn:keywords):
Revision 1598 by laffer1, Fri May 16 22:38:32 2008 UTC vs.
Revision 7782 by laffer1, Mon Sep 5 16:20:48 2016 UTC

# Line 0 | Line 1
1 + MidnightBSD=%H

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines