summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fix OpenSSH Denial of Service vulnerability. [SA-17:06]releng/10.3delphij2017-08-103-1/+10
| | | | Approved by: so
* Add the missed Heimdal patch, freebsd-update bits are not affected.delphij2017-07-121-2/+2
| | | | | Noticed by: gordon Approved by: so
* Fix heimdal KDC-REP service name validation vulnerability [SA-17:05]delphij2017-07-1212-127/+214
| | | | | | Boot compatibility improvements with Azure VMs. [EN-17:06] Approved by: so
* Fix ipfilter(4) fragment handling panic.delphij2017-04-273-2/+6
| | | | | Security: FreeBSD-SA-17:04.ipfilter Approved by: so
* Fix multiple vulnerabilities of ntp. [SA-17:03]delphij2017-04-12285-49603/+16394
| | | | | | Xen migration enhancements. [EN-17:05] Approved by: so
* Fix OpenSSL RC4_MD5 cipher vulnerability.delphij2017-02-233-1/+7
| | | | Approved by: so
* Fix multiple vulnerabilities of OpenSSH.delphij2017-01-115-10/+54
| | | | | | | Security: FreeBSD-SA-17:01.openssh Security: CVE-2016-10009 Security: CVE-2016-10010 Approved by: so
* Fix multiple vulnerabilities of ntp.delphij2016-12-22184-3780/+7378
| | | | Approved by: so
* Merge r309688: address regressions in SA-16:37.libc.glebius2016-12-073-7/+10
| | | | | | PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Approved by: so
* Fix possible login(1) argument injection in telnetd(8). [SA-16:36]glebius2016-12-065-24/+59
| | | | | | | | | | | | | | Fix link_ntoa(3) buffer overflow in libc. [SA-16:37] Fix possible escape from bhyve(8) virtual machine. [SA-16:38] Fix warnings about valid time zone abbreviations. [EN-16:19] Update timezone database information. [EN-16:20] Security: FreeBSD-SA-16:36.telnetd Security: FreeBSD-SA-16:37.libc Security: FreeBSD-SA-16:38.bhyve Errata Notice: FreeBSD-EN-16:19.tzcode Errata Notice: FreeBSD-EN-16:20.tzdata Approved by: so
* Update tzdata to 2016i.glebius2016-12-0526-932/+8215
| | | | | | | | | | | | Note: because of what appears to be a missing MFC to stable branches, these patches were generated by doing: % rsync -av stable/10/contrib/tzdata releng/10.x/contrib/tzdata % svn add releng/10.x/contrib/tzdata Errata Notice: EN-16:19 Submitted by: gjb Approved by: so
* Merge r307359 from stable/10:glebius2016-12-052-33/+11
| | | | | | | | | | | | | | | | | Incorporate a change from OpenBSD by millert@OpenBSD.org Don't warn about valid time zone abbreviations. POSIX through 2000 says that an abbreviation cannot start with ':', and cannot contain ',', '-', '+', NUL, or a digit. POSIX from 2001 on changes this rule to say that an abbreviation can contain only '-', '+', and alphanumeric characters from the portable character set in the current locale. To be portable to both sets of rules, an abbreviation must therefore use only ASCII letters." Adapted from tzcode2015f. Errata Notice: EN-16:19.tzcode Submitted by: bapt Approved by: so
* Fix OpenSSH remote Denial of Service vulnerability. [SA-16:33]delphij2016-11-028-1/+44
| | | | | | | | Fix OpenSSL remote DoS vulnerability. [SA-16:35] Security: FreeBSD-SA-16:33.openssh Security: FreeBSD-SA-16:35.openssl Approved by: so
* Revised SA-16:15. The initial patch didn't cover all possible overflowsglebius2016-10-253-2/+11
| | | | | | | based on passing incorrect parameters to sysarch(2). Security: SA-16:15 Approved by: so
* EN-16:17: virtual memory issues.glebius2016-10-255-51/+65
| | | | | | | | | | | | | | | | | | Due to increased parallelism and optimizations in several parts of the system, the previously latent bugs in VM become much easier to trigger, affecting a significant number of the FreeBSD users. The exact technical details of the issues are provided in the commit messages of the merged revisions, which are listed below with short summaries. r301184 prevent parallel object collapses, fixes object lifecycle r301436 do not leak the vm object lock, fixes overcommit disable r302243 avoid the active object marking for vm.vmtotal sysctl, fixes "vodead" hangs r302513 vm_fault() race with the vm_object_collapse(), fixes spurious SIGSEGV r303291 postpone BO_DEAD, fixes panic on fast vnode reclaim Approved by: so
* Remove duplicate file content from patch misapplication in r306941emaste2016-10-143-303/+0
| | | | | | | The three files affected were tests and aren't normally built so this had no user-facing effect in the normal case. Approved by: so
* Fix bspatch heap overflow vulnerability. [SA-16:29]delphij2016-10-1014-203/+1255
| | | | | | | | Fix multiple portsnap vulnerabilities. [SA-16:30] Fix multiple libarchive vulnerabilities. [SA-16:31] Approved by: so
* Apply upstream revision 3612ff6fcec0e3d1f2a598135fe12177c0419582:delphij2016-09-263-4/+7
| | | | | | | | | | | | Fix overflow check in BN_bn2dec() Fix an off by one error in the overflow check added by 07bed46 ("Check for errors in BN_bn2dec()"). This fixes a regression introduced in SA-16:26.openssl. Submitted by: jkim PR: 212921 Approved by: so
* Fix multiple OpenSSL vulnerabilitites.delphij2016-09-2318-92/+223
| | | | | Approved by: so Security: FreeBSD-SA-16:26.openssl
* Release 6 errata notices for 10.3-RELEASE, all related to Microsoft Hyper-V.glebius2016-08-1210-153/+332
| | | | | Submitted by: Dexuan Cui <decui microsoft.com>, gjb Approved by: so
* Fix bspatch heap overflow vulnerability. [SA-16:25]delphij2016-07-254-2/+14
| | | | | | | Fix freebsd-update(8) support of FreeBSD 11.0 release distribution. [EN-16:09] Approved by: so
* Fix multiple ntp vulnerabilities.delphij2016-06-04161-3086/+4306
| | | | | Security: FreeBSD-SA-16:24.ntp Approved by: so
* Fix kernel stack disclosure in Linux compatibility layer. [SA-16:20]glebius2016-05-315-1/+14
| | | | | | | | Fix kernel stack disclosure in 4.3BSD compatibility layer. [SA-16:21] Security: SA-16:20 Security: SA-16:21 Approved by: so
* Merge r300361 by mm@:glebius2016-05-316-4/+44
| | | | | | | | | Backport security fix for absolute path traversal vulnerability in bsdcpio. Security: CVE-2015-2304 Security: SA-16:22 Approved by: so
* - Use unsigned version of min() when handling arguments of SETFKEY ioctl.glebius2016-05-174-2/+12
| | | | | | | | | | | | - Validate that user supplied control message length in sendmsg(2) is not negative. Security: SA-16:18 Security: CVE-2016-1886 Security: SA-16:19 Security: CVE-2016-1887 Submitted by: C Turt <cturt hardenedbsd.org> Approved by: so
* Fix multiple OpenSSL vulnerabilitites. [SA-16:17]delphij2016-05-0412-28/+81
| | | | | | | | | | Fix performance regression in libc hash(3). [EN-16:06] Fix excessive latency in x86 IPI delivery. [EN-16:07] Fix memory leak in ZFS. [EN-16:08] Approved by: so
* Fix ntp multiple vulnerabilities.delphij2016-04-29187-1243/+4544
| | | | Approved by: so
* Update releng/10.3 to -RELEASE status in preparation for the finalmarius2016-03-251-1/+1
| | | | | | 10.3-RELEASE builds. Approved by: re (implicit)
* Anticipate the expected 10.3-RELEASE date.marius2016-03-251-0/+3
| | | | Approved by: re (implicit)
* Set the static abitag to the current value of __FreeBSD_version.marius2016-03-251-1/+1
| | | | Approved by: re (implicit)
* Prune empty sections.gjb2016-03-251-107/+0
| | | | | Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* - Update relnotes items:hrs2016-03-241-4/+57
| | | | | | | | | | | | | | | | grdc(6) 12-hour mode fixed, inetd(8) crash with IPv6 address fixed, netstat(1) statistics counter divided by 1024 fixed, rc.d/netif now updates only static routes, vt(4) kern.vt.bell_enable, puc(4) MSI support, epair(4) and lagg(4) cloner vnet jail support, epair(4) panic fixed, lagg(4) per-interface sysctl nodes replaced with ifconfig flags, lagg(4) panic fixed, SIOCGDRLST_IN6 and SIOCGPRLST_IN6 ioctls removed. Approved by: re (implicit)
* - Update relnotes items:hrs2016-03-241-4/+32
| | | | | | | | | | | reword description about ar -D/-U option, camcontrol(8) fwdonwload improvements, pkill -j jailname support, timeout(1) added, ypinit(8) eui64 NIS map, kern.features.invariants sysctl added. Approved by: re (implicit)
* - Update relnotes items:hrs2016-03-241-6/+61
| | | | | | | | | | | | | | | | last reboot now works again, mv(1) return value has been fixed, mkimg(1) dynamic VHD format fixed, pw(8) userdel/usermod -y option, watchdogd(8) -x option added, rc.firewall now uses ipfw tables when firewall_type="SIMPLE", imxwdt driver fixed, uart(4) PPS polarity fixed, user(4) dev.uart.pps_mode added, uftdi(4) new ioctls to read/write eeprom, legacy ata(4) drivers removed. Approved by: re (implicit)
* Fix FPIs.hrs2016-03-244-12/+18
| | | | Approved by: re (implicit)
* - Fix FPIs and catalog entries.hrs2016-03-242-27/+77
| | | | | | | | | | | | | | | | | | | | - Fix typos. - Update relnotes items: ctladm(8) return value bugfix, ifconfig -v now displays SFP/SFP+ data, add updstream changeset id to the libarchive(3) improvement, vt(4) ALT_BREAK_TO_DEBUGGER support added, thread_create() API added, pms(4) removed from GENERIC for amd64/i386, kern.racct.enable fixed, cxgbe(4) firmware updated to 1.14.4.0, pf(4) logging issue fixed, LLENTRY_DELETED event in NDP fixed. - Edit items: s/Timezone data files/Time zone database/, -manage-gids flag is for nfsuserd, not nfsd. Approved by: re (implicit)
* In preparation for 10.3-RELEASE, revert r296976, i. e. the merge ofmarius2016-03-231-1/+0
| | | | | | | | | | | | | | r296416 (head) and r296969 (stable/10) respectively. With SAVESIGVEC enabled, csh(1) and tcsh(1) leak signal masks after spawning external commands. This causes strange effects like for example SIGTERM not being delivered to rc(8) scripts on shutdown albeit these use sh(1), if csh(1) or tcsh(1) are used as login shell of root. As such r296976 causes way more problems than it solves. It is anticipated that a proper changeset for the original problem will be issued as an Errata Notice post-10.3-RELEASE. PR: 208132 Approved by: re (gjb)
* Update releng/10.3 to RC3 in preparation for 10.3-RC3 builds.marius2016-03-181-1/+1
| | | | Approved by: re (implicit)
* MFC: r296996allanjude2016-03-171-5/+5
| | | | | | | Remove 50% ZFS conditional from bsdinstall/zfsboot PR: 208094 Approved by: re (marius)
* Add paragraph about isp(4) improvements.mav2016-03-171-0/+5
| | | | Approved by: re (implicit)
* MFC 296416:mp2016-03-171-0/+1
| | | | | | | | | | | Signal handling within tcsh vfork code path will conflict with some system libraries (such as libthr) which maintain their own signal state. This change adds the tcsh SAVESIGVEC option to save and restore the sigvecs for the signals the child modifies before it execs. Reviewed by: kib, rwatson Reported by: kib Approved by: re
* Merge r296956:glebius2016-03-161-2/+2
| | | | | | | | | | | Due to invalid use of a signed intermediate value in the bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode. Submitted by: CORE Security Patch by: kib Security: SA-16:15 Approved by: re (implicit)
* MFC 296943:ian2016-03-161-1/+1
| | | | | | | | Require firewall setup before running rc.d/netwait, otherwise the ping packets sent by netwait may not get through. PR: 207916 Approved by: re (marius)
* MFC r296908:kib2016-03-162-6/+8
| | | | | | Force the desired alignment of the user save area. Approved by: re (marius)
* MFS r296911:bdrewery2016-03-151-4/+10
| | | | | | | Filemon: Attach from the child to avoid racing with the parent attach. Relnotes: yes Approved by: re (marius)
* MFS r296797:dchagin2016-03-151-0/+5
| | | | | | | | MFC r296542: Load linux64 module for amd64 if Linux abi enabled. Reviewed by: emaste@ Approved by: re (marius) Differential Revision: https://reviews.freebsd.org/D5567
* MFC r296320:kib2016-03-153-7/+14
| | | | | | | | Adjust _callout_stop_safe() return value for the subr_sleepqueue.c needs when migrating callout was blocked, but running one was not. PR: 200992 Approved by: re (marius)
* Correct program name: s/shutdown/reboot/gjb2016-03-151-1/+1
| | | | | | Submitted by: Harald Schmalzbauer Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Add missing xml:id to reduce diff when copying to doc/ tree.gjb2016-03-145-15/+20
| | | | | Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Remove a few references to 9.2 and earlier.gjb2016-03-141-2/+2
| | | | | Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
OpenPOWER on IntegriCloud