ViewVC Help
View File | Revision Log | Show Annotations | Download File | View Changeset | Root Listing
root/src/trunk/UPDATING
(Generate patch)

Comparing trunk/UPDATING (file contents):
Revision 3394 by laffer1, Sat May 1 00:14:17 2010 UTC vs.
Revision 6983 by laffer1, Fri Mar 20 00:53:47 2015 UTC

# Line 1 | Line 1
1 < Updating Information for MidnightBSD users
1 > Updating Information for MidnightBSD users.
2  
3 + 20150319:
4 +        OpenSSL 0.9.8.zf
5 +
6 +        mksh R50e
7 +
8 + 20150306:
9 +        Upgrade OpenSSL to 0.9.8ze
10 +
11 + 20150225:
12 +        Fix two security vulnerabilities.
13 +
14 +        1. BIND servers which are configured to perform DNSSEC validation and which
15 +        are using managed keys (which occurs implicitly when using
16 +        "dnssec-validation auto;" or "dnssec-lookaside auto;") may exhibit
17 +        unpredictable behavior due to the use of an improperly initialized
18 +        variable.
19 +
20 +        CVE-2015-1349
21 +
22 +        2. An integer overflow in computing the size of IGMPv3 data buffer can result
23 +        in a buffer which is too small for the requested operation.
24 +
25 +        This can result in a DOS attack.
26 +
27 + 20141211:
28 +        Fix a security issue with file and libmagic that can allow
29 +        an attacker to create a denial of service attack on any
30 +        program that uses libmagic.
31 +
32 + 20141109:
33 +        Fix building perl during buildworld when the GDBM port is installed.
34 +
35 + 20141106:
36 +        tzdata 2014i
37 +
38 + 20141102:
39 +        serf 1.3.8
40 +
41 + 20141031:
42 +        tnftp 20141031 fixes a security vulnerability with tnftp,
43 +        CVE-2014-8517.
44 +
45 + 20141028:
46 +        OpenSSL 0.9.8zc
47 +
48 + 20141021:
49 +        Fix several security vulnerabilities in routed, rtsold,
50 +        and namei with respect to Capsicum sandboxes looking up
51 +        nonexistent path names and leaking memory.
52 +
53 +        The input path in routed(8) will accept queries from any source and
54 +        attempt to answer them.  However, the output path assumes that the
55 +        destination address for the response is on a directly connected
56 +        network.
57 +
58 +        Due to a missing length check in the code that handles DNS parameters,
59 +        a malformed router advertisement message can result in a stack buffer
60 +        overflow in rtsold(8).
61 +
62 + 20141011:
63 +        mksh R50d - fix field splitting regression and null
64 +        pointer dereference
65 +
66 +        xz 5.0.7
67 +
68 +        OpenSSH 6.6p1
69 +
70 + 20141004:
71 +        mksh R50c - security update for environment var bug with
72 +        foo vs foo+    
73 +
74 + 20141002:
75 +        sqlite 3.8.6
76 +
77 +        sudo 1.7.8 - some issues with the current version, but we're slowly
78 +        getting up to date.
79 +
80 + 20141001:
81 +        mksh R50b
82 +
83 +        libmport now supports plist commands @dir, @owner, @group, @mode.
84 +
85 +        sudo 1.7.6p2
86 +
87 + 20140916:
88 +        Fix a security issue with TCP SYN.
89 +
90 +        When a segment with the SYN flag for an already existing connection arrives,
91 +        the TCP stack tears down the connection, bypassing a check that the
92 +        sequence number in the segment is in the expected window.
93 +
94 + 20140909:
95 +        Fixed a bug with our clearenv(3) implementation that caused segfaults
96 +        with some programs including Dovecot.
97 +
98 +        OpenSSL security patch:
99 +
100 +        The receipt of a specifically crafted DTLS handshake message may cause OpenSSL
101 +        to consume large amounts of memory. [CVE-2014-3506]
102 +
103 +        The receipt of a specifically crafted DTLS packet could cause OpenSSL to leak
104 +        memory. [CVE-2014-3507]
105 +
106 +        A flaw in OBJ_obj2txt may cause pretty printing functions such as
107 +        X509_name_oneline, X509_name_print_ex et al. to leak some information from
108 +        the stack. [CVE-2014-3508]
109 +
110 +        OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to
111 +        a denial of service attack. [CVE-2014-3510]
112 +
113 + 20140902:
114 +        We're now 0.6-CURRENT
115 +
116 +        Update USB quirks to support K70 Corsair keyboard, and several
117 +        other devices.
118 +
119 + 20140827:
120 +        Perl 5.18.2
121 +
122 + 20140728:
123 +        Jails now run shutdown scripts.
124 +
125 + 20140710:
126 +        Fix a vulnerability in the control message API. A buffer is not properly cleared
127 +        before sharing with userland.
128 +
129 + 20140701:
130 +        MKSH R50
131 +
132 + 20140630:
133 +        File 5.19
134 +
135 + 20140605:
136 +        Fix four security issues with OpenSSL
137 +
138 + 20140604:
139 +        Sendmail failed to properly set close-on-exec for open file descriptors.
140 +
141 +        ktrace page fault kernel trace entries were set to an incorrect size which resulted
142 +        in a leak of information.
143 +
144 + 20140430:
145 +        Fix a TCP reassembly bug that could result in a DOS attack
146 +        of the system. It may be possible to obtain portions
147 +        of kernel memory as well.
148 +
149 + 20140411:
150 +        Update zlib to 1.2.7
151 +
152 + 20140122:
153 +        Support for username with length 32. Previous limit was 16
154 +
155 + 20140114:
156 +        Fix two security vulnerabilities.
157 +
158 +        bsnmpd contains a stack overflow when sent certain queries.
159 +
160 +        bind 9.8 when using NSEC3-signed zones zones, will crash with special
161 +        crafted packets.
162 +
163 + 20131228:
164 +        Imported FreeBSD 9.2 usb stack (plus z87 patches from stable)
165 +
166 +        Updated em(4), igb(4) and ixgbe(4)
167 +
168 +        MidnightBSD now works with Z87 Intel chipsets.
169 +
170 + 20131207:
171 +        Remove sparc64 architecture. It hasn't been working for awhile
172 +        and it's not useful for desktops anymore.
173 +
174 + 20131205:
175 +        OpenSSH 6.4p1
176 +
177 + 20131203:
178 +        Perl 5.18.1 imported.
179 +
180 +        Update less to v458
181 +
182 + 20131130:
183 +        Remove named from base. We still include the client utilities for
184 +        now until replacements can be found.
185 +
186 + 20131004:
187 +        rarpd supports vlan(4) and has a pid flag. (from FreeBSD)
188 +
189 + 20130917:
190 +        Support for 65,536 routing tables was added.  A new fib specific
191 +        field has been added to mbuf.  This is an increase from 16.
192 +
193 + 20130910:
194 +        Security updates: (kern.osreldate 5001)
195 +
196 +        nullfs(5)
197 +
198 +        The nullfs(5) implementation of the VOP_LINK(9) VFS operation does not
199 +        check whether the source and target of the link are both in the same
200 +        nullfs instance.  It is therefore possible to create a hardlink from a
201 +        location in one nullfs instance to a file in another, as long as the
202 +        underlying (source) filesystem is the same.
203 +
204 +        ifioctl
205 +
206 +        As is commonly the case, the IPv6 and ATM network layer ioctl request
207 +        handlers are written in such a way that an unrecognized request is
208 +        passed on unmodified to the link layer, which will either handle it or
209 +        return an error code.
210 +
211 +        Network interface drivers, however, assume that the SIOCSIFADDR,
212 +        SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK requests have been
213 +        handled at the network layer, and therefore do not perform input
214 +        validation or verify the caller's credentials.  Typical link-layer
215 +        actions for these requests may include marking the interface as "up"
216 +        and resetting the underlying hardware.
217 +
218 + 20130824:
219 +        Fix a bug in sendmail 8.14.7 that interferes with how it
220 +        handles AAAA records interoperating with Microsoft DNS servers.
221 +        FreeBSD has already reported this to Sendmail and a fix
222 +        will be included in the next release.
223 +
224 +        Subversion 1.8.1 is now in the base system as a static
225 +        binary.  It has limited functionality, but can be used to
226 +        checkout/commit code.  It is named svnlite.
227 +
228 + 20130822:
229 +        Fix two security vulnerabilities.
230 +
231 +        Fix an integer overflow in IP_MSFILTER (IP MULTICAST).
232 +        This could be exploited to read memory by a user process.
233 +
234 +        When initializing the SCTP state cookie being sent in INIT-ACK chunks,
235 +        a buffer allocated from the kernel stack is not completely initialized.
236 +
237 +        Import xz 5.0.4
238 +
239 +        Import sqlite 3.7.17
240 +
241 +        Import BIND 9.8.5-P2
242 +
243 + 20130814:
244 +        mksh R48 imported.
245 +
246 +        Sendmail 8.14.7 imported.
247 +
248 + 20130717:
249 +        libmport bug was fixed causing hash verification to fail.
250 +
251 +        virtio(4) imported from FreeBSD 9-stable. SCSI support not
252 +        included.
253 +
254 + 20130612:
255 +        RELENG_0_4 created for 0.4. Development continues on 0.5.
256 +
257 + 20130402:
258 +        Update BIND and OpenSSL to resolve security advisories.
259 +
260 + 20130305:
261 +        MKSH R44 imported.
262 +
263 + 20130213:
264 +        MKSH R42b imported
265 +
266 + 20130211:
267 +        MKSH R42 imported
268 +
269 + 20130125:
270 +        MKSH R41 imported
271 +
272 + 20130122:
273 +        OpenSSH 5.8p2 imported
274 +
275 +        SQLite 3.7.15.2 imported
276 +
277 +        Fixed a longstanding bug in libmport extrating new index files.
278 +
279 + 20120710:
280 +        BSD licensed sort imported from FreeBSD-CURRENT
281 +
282 +        For now, GNU sort is installed as gnusort, but it will
283 +        go away in time.
284 +
285 + 20120708:
286 +        tcsh 6.18.01 imported.
287 +
288 +        NetBSD's iconv imported.
289 +
290 +        libc gains strnlen(3), memrchr(3), stpncpy(3).
291 +
292 + 20120612:
293 +        BIND security update related to CVE-2012-1667.
294 +
295 +        Zero length resource records can cause BIND to crash resulting
296 +        in a DOS attack or information disclosure.
297 +
298 + 20120407:
299 +        mksh R40f (fixes regression)
300 +
301 + 20120328:
302 +        mksh R40e
303 +
304 +        Perl 5.14.2
305 +
306 + 20120229:
307 +        cpucontrol(8) and cpuctl(4) added from FreeBSD 7-stable.
308 +
309 + 20120209:
310 +        mDNSResponder 333.10 imported
311 +
312 + 20111227:
313 +        import raid5 module for GEOM, graid5(8)
314 +
315 +        This is experimental and known to use a lot of kernel
316 +        memory.
317 +
318 + 20111223:
319 +        telnetd: fix a root exploit from a fixed buffer that was not checked
320 +
321 +        pam: don't allow escape from policy path.  Exploitable in KDE, etc.
322 +
323 +        Fix pam_ssh module:
324 +
325 +        If the pam_ssh module is enabled, attackers may be able to gain access
326 +        to user accounts which have unencrypted SSH private keys.
327 +
328 +        This has to due with the way that openssl works.  It ignores unencrpted data.
329 +
330 +        Fix security issue with chroot and ftpd.
331 +
332 +        nsdispatch(3) doesn't know it's working in a chroot and some
333 +        operations can cause files to get reloaded causing a security
334 +        hole in things like ftpd.
335 +
336 + 20111217:
337 +        libdialog/dialog upgraded to an lgpl version. As it's not
338 +        backwardly compatable, include the old libdialog as libodialog
339 +
340 + 20111212:
341 +        mksh r40d imported
342 +
343 + 20111210:
344 +        re(4) and rl(4) updated to support new chips.
345 +
346 +        GEOM synced with FreeBSD 7-stable.
347 +
348 +        MidnightBSD GPT partition types created in sys/gpt.h and
349 +        setup in boot loader and GEOM.
350 +
351 +        amdsbwd(4) (amd watchdog for south bridge) updated to support
352 +        8xx series chipset.
353 +
354 + 20111207:
355 +        import bsd grep from FreeBSD/OpenBSD.
356 +
357 +        MK_BSD_GREP controls which grep is installed
358 +        as grep with the other as bsdgrep or gnugrep.
359 +
360 + 20111122:
361 +        mksh vR40c imported.
362 +
363 + 20111117:
364 +        BIND 9.6 ESV R5 P1
365 +
366 + 20111107:
367 +        tzdata 2011n
368 +
369 + 20111026:
370 +        mDNSResponder v320
371 +
372 +        BIND 9.6 ESV R5
373 +
374 + 20111022:
375 +        cflow 0.0.6 imported
376 +
377 + 20111020:
378 +        less v436 imported
379 +
380 +        amdsbwd(4) AMD southbridge watchdog
381 +
382 + 20111019:
383 +        awk 20110810 imported
384 +
385 +        et(4) Agere Gigabit Ethernet/Fast Ethernet driver added, but
386 +        not included in GENERIC kernel.  The kernel module needs
387 +        testing before we can include it in GENERIC.
388 +
389 +        intr_bind code ported to allow an IRQ to be bound to one
390 +        specific CPU core.
391 +
392 + 20111017:
393 +        Time Zone Data v. 2011l (Released 10 October 2011)
394 +
395 +        Updated list of countries (iso3166) to work with new timezone data.
396 +
397 + 20111015:
398 +        Introduce CPU Affinity in MidnightBSD. cpuset(1) can be used
399 +        to control which core or group of cores can be used for a given
400 +        process. Several new system calls were added to support this
401 +        functionality in the running kernel and for 32bit binary
402 +        compatibility on amd64.
403 +
404 +        The scheduler default has been changed to ULE in i386 and
405 +        amd64.  Changes were made to both schedulers (4BSD AND ULE)
406 +        for this feature.
407 +
408 +        This work is based on Jeff Roberson's FreeBSD 7.1 patches.
409 +
410 + 20111004:
411 +        Fix a problem with unix socket handling caused by the recent
412 +        patch to unix socket path handling. This allows network
413 +        apps to work under the linuxolator again.
414 +
415 + 20111001:
416 +        Import libfetch & fetch(1) from FreeBSD 9. Passive FTP is
417 +        now default and an environment variable must be set to use
418 +        active.
419 +
420 + 20110930:
421 +        Introduce quirks handling for several umass devices including
422 +        USB cameras.  Add workaround for Cyberpower UPS devices.
423 +
424 +        Bring in further bug fixes from FreeBSD and NetBSD for alc(4).
425 +        Stale ip/tcp header pointers are no longer used, lockups fixed
426 +        when network cable is unplugged on bootup, enable TX checksum
427 +        offloading.
428 +
429 +        Add a new man page for gcache(8), a useful geom class when
430 +        working with large raid3 sets.
431 +
432 +        Restore previous workaround for Cypress pata storage controller.
433 +
434 + 20110929:
435 +        Sync ath(4) with FreeBSD 7.3.
436 +
437 +        The following modules are no longer available, and should be
438 +        removed from loader.conf:
439 +        ath_hal ath_rate_amrr ath_rate_onoe ath_rate_sample
440 +
441 +        alc(4) would hibernate when a cable was unplugged and often
442 +        required bring the interface down and up to "wake up" so that
443 +        a connection could be established.  Disable hibernation.
444 +
445 + 20110928:
446 +        Fix security issues with gzip and compress related to .Z
447 +        files that are corrupted.
448 +
449 +        Fix path validation with unix domain sockets.
450 +
451 + 20110917:
452 +        Remove dependance on mports perl for generating releases as
453 +        it's in the base system.
454 +
455 + 20110914:
456 +        Import xz 5.0.3 with liblzma 5.0.3
457 +
458 + 20110813:
459 +        synced the sparc64 GENERIC kernel configuration with amd64.
460 +
461 + 20110806:
462 +        sqlite 3.7.7.1 imported
463 +
464 +        msearch(1), libmsearch and msearch.import added.  msearch(1) provides
465 +        a full text search command line tool.  libmsearch can also be used
466 +        to build a graphical based search in the future. You can enable
467 +        index building for msearch in periodic.conf or manually run the
468 +        /usr/libexec/msearch.index tool.  Full text indexes take considerable
469 +        space in /var.  I'm using approximately 500MB currently.
470 +
471 +        Fix a long standing bug with the periodic script to check package
472 +        versions.  This will be obsolete with mport though.
473 +
474 + 20110710:
475 +        kdb_enter_why added to MidnightBSD to allow the kernel debugger to
476 +        know why it's in use and thus script can be run.
477 +
478 +        Yet another problem with the perl manifest was fixed
479 +
480 + 20110709:
481 +        cpufreq(1) is a new utility to monitor CPU frequency which may change
482 +        with use of powerd(8) and cpufreq(4).
483 +
484 + 20110612:
485 +        Update mksh to R40
486 +
487 +        Catch up ObsoleteFiles.inc to remove Perl 5.10.x.  Good to run when
488 +        updating current (cd /usr/src && make check-old)
489 +
490 + 20110528:
491 +        Fix CVE-2011-1910 in BIND 9.6.x.  This affects caching resolvers.
492 +
493 + 20110526:
494 +        newfs:
495 +        Raised the default blocksize for UFS/FFS filesystems from
496 +        16K to 32K and the default fragment size from 2K to 4K.
497 +
498 +        This should slightly imporve performance on "advanced format"
499 +        hard drives such as the WD EARS drives. Drives of this type
500 +        have emulation modes that slow down with lower sizes.  Of course
501 +        the drive must still be aligned properly when using fdisk.
502 +
503 + 20110521:
504 +        mport tool now has a deleteall command.  This can be used to remove
505 +        all packages from a system.
506 +
507 +        A few bugs with the perl 5.14 import have been fixed.
508 +
509 + 20110518:
510 +        Perl 5.14.0
511 +
512 + 20110517:
513 +        Sendmail 8.14.5
514 +
515 + 20110314:
516 +        DRM/DRI code updated to support newer video cards. (FreeBSD 7.1)
517 +
518 +        cdevpriv wrappers added
519 +
520 +        nss_mdns hack introduced to work around linking problem.
521 +
522 +        dnsextd fixed after update to mDNSResponder code.
523 +
524 + 20110308:
525 +        Introduce liblzma & xz 5.0.1 to the base system
526 +
527 +        Patch for OpenSSL security issue CVE-2011-0014.
528 +
529 +        "OSREVISION 4004"
530 +
531 +        nsswitch module for multicast dns (nss_mdns) added.
532 +
533 +        tzdata2011c
534 +
535 + 20110220:
536 +        cam(4) syncronized with FreeBSD 7.3.
537 +
538 + 20110219:
539 +        amdtemp(4) updated to support sensors framework.
540 +
541 + 20110217:
542 +        Perl 5.10.1 imported
543 +
544 + 20110216:
545 +        Introduce igb(4) and split Intel Gigabit Ethernet adapters between
546 +        igb(4) and em(4).  Newer devices use igb(4).  The code has moved
547 +        to sys/dev/e1000 for both devices in the kernel. igb(4) has
548 +        been placed in GENERIC on i386 and amd64.
549 +
550 +        Update bfe(4) to support newer devices and WOL.
551 +
552 + 20110215:
553 +        age(4) added.
554 +
555 + 20110208:
556 +        BIND 9.6.3 which fixes a bug with DNSSEC records getting added.
557 +
558 + 20110206:
559 +        eeemon(4) added to monitor Asus Eee PC.
560 +
561 + 20110205:
562 +        OpenSSH 5.7p1
563 +
564 +        GNU sort 6.9 (coreutils)
565 +
566 + 20110203:
567 +        one true awk 20100523 imported
568 +
569 +        sqlite 3.7.5
570 +
571 +        OpenSSL 0.9.8q
572 +
573 + 20110202:
574 +        tcsh 6.17.00
575 +
576 +        file 5.05
577 +
578 + 20110122:
579 +        Import it(4) and lm(4), with support for Super I/O hardware monitors. This
580 +        uses the sensors framework ported by Constantine A. Murenin (GSOC2007)
581 +
582 + 20110120:
583 +        BIND 9.6.2-P3
584 +
585 +        sudo 1.7.4-p6
586 +
587 + 20110115:
588 +        Add experimental jme(4) for Jmicron ethernet devices.
589 +
590 + 20101130:
591 +        A double free exists in the SSL client ECDH handling code, when
592 +        processing specially crafted public keys with invalid prime
593 +        numbers. [CVE-2010-2939]
594 +
595 + 20101120:
596 +        Several portions of the kernel and userland code related to UFS file
597 +        systems (and UFS2) cannot properly handle inode counts above 2^31 due
598 +        to use of int types.  Based on a patch from FreeBSD, I've modified
599 +        our UFS2 implementation to handle unsigned values for inode counts
600 +        which should allow for file systems greater than 16TB.
601 +
602 +        newfs and growfs was also modified.
603 +
604 + 20101110:
605 +        Fix a security issue with pseudofs which could result in running code in kernel
606 +        context or a kernel panic depending on system configuration.  This affects file
607 +        systems such as procfs for instance.
608 +
609 + 20101021:
610 +        sysrc is a utility to print and modify name/value pairs in /etc/rc.conf easily.
611 +        This is similar to functions present in many linux distros. The utility was
612 +        written by Devin Teske for FreeBSD.
613 +
614 + 20100920:
615 +        bzip2 security patch for integer overflow.
616 +
617 + 20100905:
618 +        MidnightBSD RELENG_0_3 branch created.  Aggressive development continues here
619 +        for 0.4.
620 +
621 + 20100902:
622 +        Fix a security issue with libutil that allows users to bypass cpu limits in
623 +        login.conf in some cases.  This combined with OpenSSH for example can allow
624 +        the user to get more resources than they're allowed.
625 +
626 + 20100822:
627 +        Import Apple's mDNSResponder (mdnsd).
628 +
629 + 20100814:
630 +        libdispatch added to MidnightBSD.  This provides functionality found in
631 +        Mac OS X's GCD.  We do not have blocks support yet.  As this code is
632 +        licensed under Apache 2, we create a new MK_APACHE option so that
633 +        it's not required for all users to run code under a license they
634 +        may not like.
635 +
636 + 20100713:
637 +        mbuf readonly fix related to sendfile(2) data corruption.
638 +
639 + 20100704:
640 +        brainfuck(1) imported from MirBSD.
641 +
642 + 20100505:
643 +        zlib 1.2.5
644 +
645   20100430:
646          Sudo 1.7.2p6 imported
647  
# Line 850 | Line 1492 | Contact Warner Losh if you have any questions about yo
1492   this document.
1493  
1494   $FreeBSD: src/UPDATING,v 1.416.2.18 2006/02/22 11:51:57 yar Exp $
1495 < $MidnightBSD: src/UPDATING,v 1.87 2010/03/21 20:05:10 laffer1 Exp $
1495 > $MidnightBSD$

Comparing trunk/UPDATING (property cvs2svn:cvs-rev):
Revision 3394 by laffer1, Sat May 1 00:14:17 2010 UTC vs.
Revision 6983 by laffer1, Fri Mar 20 00:53:47 2015 UTC

# Line 1 | Line 0
1 1.88

Comparing trunk/UPDATING (property svn:keywords):
Revision 3394 by laffer1, Sat May 1 00:14:17 2010 UTC vs.
Revision 6983 by laffer1, Fri Mar 20 00:53:47 2015 UTC

# Line 0 | Line 1
1 + MidnightBSD=%H

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines