summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fix OpenSSH Denial of Service vulnerability. [SA-17:06]releng/11.0delphij2017-08-104-1/+15
| | | | | | Fix VNET kernel panic with asynchronous I/O. [EN-17:07] Approved by: so
* Fix heimdal KDC-REP service name validation vulnerability [SA-17:05]delphij2017-07-123-4/+8
| | | | Approved by: so
* Fix ipfilter(4) fragment handling panic.delphij2017-04-273-2/+6
| | | | | Security: FreeBSD-SA-17:04.ipfilter Approved by: so
* Fix multiple vulnerabilities of ntp. [SA-17:03]delphij2017-04-12410-73545/+16363
| | | | | | Xen migration enhancements. [EN-17:05] Approved by: so
* Fix multiple vulnerabilities of OpenSSL. [SA-17:02]delphij2017-02-23481-5864/+4741
| | | | | | | | | | | | | | Fix system hang when booting when PCI-express HotPlug is enabled. [EN-17:01] Fix NIS master updates are not pushed to NIS slave. [EN-17:02] Fix compatibility with Hyper-V/storage after KB3172614 or KB3179574. [EN-17:03] Make makewhatis output reproducible. [EN-17:04] Approved by: so
* Fix multiple vulnerabilities of OpenSSH.delphij2017-01-115-10/+54
| | | | | | | Security: FreeBSD-SA-17:01.openssh Security: CVE-2016-10009 Security: CVE-2016-10010 Approved by: so
* Fix multiple vulnerabilities of ntp.delphij2016-12-22184-3779/+7377
| | | | Approved by: so
* Merge r309688: address regressions in SA-16:37.libc.glebius2016-12-073-7/+10
| | | | | | PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Approved by: so
* Fix possible login(1) argument injection in telnetd(8). [SA-16:36]glebius2016-12-065-24/+61
| | | | | | | | | | | | | | | | Fix link_ntoa(3) buffer overflow in libc. [SA-16:37] Fix possible escape from bhyve(8) virtual machine. [SA-16:38] Fix warnings about valid time zone abbreviations. [EN-16:19] Update timezone database information. [EN-16:20] Fix incorrectly defined unicode character(s). [EN-16:21] Security: FreeBSD-SA-16:36.telnetd Security: FreeBSD-SA-16:37.libc Security: FreeBSD-SA-16:38.bhyve Errata Notice: FreeBSD-EN-16:19.tzcode Errata Notice: FreeBSD-EN-16:20.tzdata Errata Notice: FreeBSD-EN-16:21.localedef Approved by: so
* Merge r308330 by bapt:glebius2016-12-063-16/+15
| | | | | | | | | localedef: Fix ctype dump (fixed wide spread errors) See original commit for longer description. Errata Notice: EN-16:21 Approved by: so
* Update tzdata to 2016i.glebius2016-12-0626-932/+8215
| | | | | | | | | | | | Note: because of what appears to be a missing MFC to stable branches, these patches were generated by doing: % rsync -av stable/11/contrib/tzdata releng/11.x/contrib % svn add releng/11.x/contrib/tzdata Errata Notice: EN-16:20 Submitted by: gjb Approved by: so
* Merge r307358 from stable/11:glebius2016-12-052-33/+11
| | | | | | | | | | | | | | | | | Incorporate a change from OpenBSD by millert@OpenBSD.org Don't warn about valid time zone abbreviations. POSIX through 2000 says that an abbreviation cannot start with ':', and cannot contain ',', '-', '+', NUL, or a digit. POSIX from 2001 on changes this rule to say that an abbreviation can contain only '-', '+', and alphanumeric characters from the portable character set in the current locale. To be portable to both sets of rules, an abbreviation must therefore use only ASCII letters." Adapted from tzcode2015f. Errata Notice: EN-16:19.tzcode Submitted by: bapt Approved by: so
* Fix Fix OpenSSH remote Denial of Service vulnerability.delphij2016-11-023-1/+6
| | | | | Security: FreeBSD-SA-16:33.openssh Approved by: so
* Revised SA-16:15. The initial patch didn't cover all possible overflowsglebius2016-10-254-6/+15
| | | | | | | | | | based on passing incorrect parameters to sysarch(2). [1] Fix unchecked array reference in the VGA device emulation code. [2] Security: SA-16:15 [1] Security: SA-16:32 [2] Approved by: so
* EN-16:18: loader may hang during bootglebius2016-10-251-6/+14
| | | | | | | | | | A programming error in GELIBoot causes the loader to attempt to read past the end of the disk if the size of the final partition is not a multiple of 4 kB. Merge r306834 from stable/11. Approved by: so
* Update releng/11.0 to 11.0-RELEASE-p1.gjb2016-09-281-1/+1
| | | | | Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* MFS r306418: portsnap: only move expected snapshot contents from snap/ to files/emaste2016-09-281-0/+7
| | | | | | | | | | | | Previously it was possible to smuggle in addional files that would be used by later portsnap runs. Now we only move those files expected to be in the snapshot into files/ and require that there are no unexpected files. This was used by portsnap attacks 2, 3, and 4 in the "non-cryptanalytic attacks against FreeBSD update components" anonymous gist. Approved by: re (gjb)
* Merge from stable/11 bspatch, portsnap, and libarchive fixes:emaste2016-09-2717-415/+1073
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | === bspatch === MFS r306213: bspatch Capsicumization, sanity checks, and other improvements r304691: bspatch: apply style(9) Make style changes (and trivial refactoring of open calls) now in order to reduce noise in diffs for future capsicum changes. r304807 (allanjude): Capsicumize bspatch Move all of the fopen() and open() calls to the top of main() Restrict each FD to least privilege (read/seek only, write only, etc) cap_enter(), and make all except the output FD read/seek only. r304821: bspatch: remove output file in the case of error r305486: bspatch: add sanity checks on sizes to avoid integer overflow Note that this introduces an explicit 2GB limit, but this was already implicit in variable and function argument types. This is based on the "non-cryptanalytic attacks against freebsd update components" anonymous gist. Further refinement is planned. r305737: bspatch: remove superfluous newlines from errx strings r305822: bspatch: use #define for header size instead of magic number r306026: bspatch: Remove backwards-compatibility sys/capability.h support bspatch previously included sys/capability.h or sys/capsicum.h based on __FreeBSD_version, as FreeBSD is the upstream for bsdiff and we may see this file incorporated into other third-party software. The Capsicum header is now installed as sys/capsicum.h in stable/10 and FreeBSD 10.3, so we can just use sys/capsicum.h and simplify the logic. With this change, bspatch is identical between head, stable/11 and releng/11.0. === portsnap === MFS r305648 (delphij): MFC r305469: Ensure that we always open only files that is named by explicitly using shell redirections instead of having gzip(1) to decide what file to open. Issue reported in the "non-cryptanalytic attacks against freebsd update components" anonymous gist. === libarchive === MFS r305754 (mm): MFC r305422: Sync libarchive with vendor Vendor issues fixed: PR #777: Multiple bugfixes for setup_acls() This includes a bugfix for a bug that caused ACLs not to be read properly for files and directories inside subdirectories and as a result not being stored or being incorrectly stored in tar archives. MFS r306321 (mm): MFC r305819: Sync libarchive with vendor including important security fixes. Issues fixed (FreeBSD): PR #778: ACL error handling Issue #745: Symlink check prefix optimization is too aggressive Issue #746: Hard links with data can evade sandboxing restrictions This update fixes the vulnerability #3 and vulnerability #4 as reported in "non-cryptanalytic attacks against FreeBSD update components". https://gist.github.com/anonymous/e48209b03f1dd9625a992717e7b89c4f Fix for vulnerability #2 has already been merged. Approved by: re (gjb), so (glebius)
* Merge r306343 by jkim:glebius2016-09-26375-376/+394
| | | | | | | Merge OpenSSL 1.0.2j. Approved by: so Approved by: re (implicit)
* Prepare for 11.0-RELEASE builds.gjb2016-09-221-1/+1
| | | | | Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Anticipate when we will be ready to announce 11.0-RELEASE.gjb2016-09-221-0/+3
| | | | | Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Statically set __FreeBSD_version for 11.0-RELEASE.gjb2016-09-221-1/+1
| | | | | Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Remove dual-revision entries, and prefer the latter, unbreakinggjb2016-09-221-10/+9
| | | | | | | | URLs to svnweb. Submitted by: jkim Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Add a link to the 'installation.html' section for freebsd-update(8)gjb2016-09-221-0/+6
| | | | | | | | usage information. Suggested by: theraven Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Change the entity for arm64 from 'aarch64' to 'arm64'.gjb2016-09-221-1/+1
| | | | | | Submitted by: emaste Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document r306198, OpenSSL 1.0.2i.gjb2016-09-221-3/+3
| | | | | Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* MFS: r306195jkim2016-09-22595-2460/+5413
| | | | | | Merge OpenSSL 1.0.2i. Approved by: re (gjb, implicit), so (delphij)
* Regenerate.bdrewery2016-09-211-229/+217
| | | | Approved by: re (gjb, implicit)
* Disable SYSTEM_COMPILER by default.bdrewery2016-09-211-1/+1
| | | | | | | | | | | | | | | This is a direct commit to releng/11.0. Having it enabled can lead to a situation where building on one system and installing on another will fail due to not finding cc in the OBJDIR. An actual fix will be made on head separately. PR: 212877 Relnotes: yes Sponsored by: Dell EMC Isilon Approved by: re (gjb)
* Add c++filt, missed in the previous commit.gjb2016-09-211-0/+1
| | | | | | Submitted by: emaste Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Fix ELF Tool Chain revision for releng/11.0.gjb2016-09-211-4/+5
| | | | | | | | Replace elfcopy with objcopy/strip. Submitted by: emaste Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Correct the entry for r291292, if_enc(4) was updated to be loaded viagjb2016-09-211-4/+3
| | | | | | | | kldload(8) during runtime, not newly added. Submitted by: Harry Schmalzbauer Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* - Remove various '[arch]' references where it is redundant.gjb2016-09-211-24/+20
| | | | | | | | | | - Further clarifications to the CUBIEBOARD2 kernel rename, iwn(4) addition, explicitly noting ia64 is Itanium(tm), various other fixes. Submitted by: theraven Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document r301033 was sponsored by the FreeBSD Foundation.gjb2016-09-211-3/+4
| | | | | | Submitted by: trasz Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document r296177, dtsec(4) driver addition.gjb2016-09-211-0/+16
| | | | | | | | | | Document r298237, SMP booting for Book-E platforms was fixed. Document r297001, Book-E can address up to 36-bits of physical RAM. Document r297977, Book-E now supports e500mc and e5500. Submitted by: jhibbits Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document r291292, if_enc(4) addition.gjb2016-09-211-0/+6
| | | | | | Submitted by: ae Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document r298243, BIOS+UEFI addition to bsdinstall(8).gjb2016-09-211-0/+8
| | | | | | Submitted by: martymac Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Revise the entry for r287197, ifconfig(8) did not change, the wirelessgjb2016-09-201-1/+1
| | | | | | | networking stack changed. Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document physical wireless devices are no longer listed by defaultgjb2016-09-201-0/+6
| | | | | | | | in ifconfig(8) output. Submitted by: woodsb02 Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Fix an incorrect svn revision.gjb2016-09-201-2/+3
| | | | | | | | Link to the binmiscctl(8) manual in the r266531 entry. Submitted by: sbruno Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Tweak the nvi(1) entry to be less clumsy-sounding.gjb2016-09-201-1/+1
| | | | | | Submitted by: lidl Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Tweak wording and add clarifications for several sections.gjb2016-09-201-16/+18
| | | | | | Submitted by: dhw Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Update the manual page path for 11.0-RELEASE.gjb2016-09-201-1/+1
| | | | | Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document r291716, camdd(8).gjb2016-09-201-0/+18
| | | | | | Submitted by: ken Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document r297678, uuencode(1) '-r' option.gjb2016-09-201-0/+9
| | | | | | | | Document r302558, ul(1) truncation bug fix. Submitted by: gahr Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Wording fixes and further clarifications.gjb2016-09-201-7/+8
| | | | | | Submitted by: cperciva Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document r300779, dummynet(4) AQM addition.gjb2016-09-201-0/+7
| | | | | | Submitted by: truckman Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Document r289315, resolver reloads resolv.conf if mtime changes.gjb2016-09-201-1/+6
| | | | | | | | Fix a spacing nit while here. Submitted by: vangyzen Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* - Remove redundant wording.gjb2016-09-201-77/+70
| | | | | | | | | | | | - Update MK_ARM_EABI entry to note it is the default. - Reword the entry for r290910. - Fix various wording nits. - Remove redundant '[arch]' tags where they are already specified. - Various rewordings. Submitted by: theraven (first pass from his feedback) Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
* Expand the r285387 entry to include information for cases wheregjb2016-09-201-0/+8
| | | | | | | | NUMA may be disabled due to system BIOS. Submitted by: vangyzen Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
OpenPOWER on IntegriCloud