OpenBSD 7.3 is released.

YesItsMe · 10-04-2023, 02:53 AM

Syspatch 017 (all architectures):
Fix several input validation errors in libX11 and libXpm. CVE-2023-43785 CVE-2023-43786 CVE-2023-43787 CVE-2023-43788 CVE-2023-43789

YesItsMe · 10-26-2023, 05:26 AM

Syspatch 018 (all architectures):
Fix several input validation errors in the X server. CVE-2023-5367 CVE-2023-5380 CVE-2023-5574

Syspatch 019 (all architectures):
A network buffer that had to be split at certain length could crash the kernel.

YesItsMe · 11-20-2023, 03:27 PM

Syspatch 020 (all architectures):
httpd(8): Avoid a NULL dereference when handling a malformed fastcgi request.

YesItsMe · 11-28-2023, 01:41 PM

Syspatch 021 (all architectures):
A crafted regular expression when compiled by perl can cause a one-byte attacker controlled buffer overflow in a heap allocated buffer. CVE-2023-47038

YesItsMe · 12-10-2023, 09:23 AM

Syspatch 022 (amd64):
vmm(4) restored stale GDTR & TR values on vm exit which could lead to memory corruption or kernel deadlocks.

YesItsMe · 12-15-2023, 07:09 AM

Syspatch 023 (all architectures):
Fix out of bounds memory accesses in XRandR and XKB X server extensions. CVE-2023-6377 CVE-2023-6478

YesItsMe · 12-19-2023, 03:12 PM

Syspatch 024 (all architectures):
An SSH protocol weakness (the Terrapin Attack) exists that allows an on-path adversary to disable keystroke timing obfuscation.

YesItsMe · 01-16-2024, 03:20 PM

Syspatch 025 (all architectures):
Fix multiple xserver heap buffer overflows, out of bounds memory accesses and memory corruption. CVE-2023-6816 CVE-2024-0229 CVE-2024-21885 CVE-2024-21886 CVE-2024-0408 CVE-2024-0409

YesItsMe · 02-14-2024, 12:42 PM

Syspatch 026 (all architectures):
DNSSEC protocol vulnerabilities have been discovered that render various DNSSEC validators victims of Denial Of Service while trying to validate specially crafted DNSSEC responses. Fix CVE-2023-50387 and CVE-2023-50868 in unwind(8) and unbound(8).

YesItsMe · 03-18-2024, 10:32 AM

Syspatch 027 (all architectures):
In libexpat fix billion laughs attack vulnerability CVE-2024-28757.

YesItsMe · 04-04-2024, 08:32 AM

Syspatch 028 (all architectures):
Fix multiple heap buffer overread and data leakage in the X11 server Xi extension and use after free in the Render extention. CVE-2024-31080 CVE-2024-31081 CVE-2024-31083