CVS commit: src/sys/arch/mips/ingenic

2015-03-19 Thread Michael Lorenz
Module Name:src
Committed By:   macallan
Date:   Thu Mar 19 12:22:00 UTC 2015

Modified Files:
src/sys/arch/mips/ingenic: apbus.c

Log Message:
spin up SMBus clocks before attaching drivers
TODO: only enable clocks for drivers that actually attach


To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.10 src/sys/arch/mips/ingenic/apbus.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/sys/arch/mips/ingenic

2015-03-19 Thread Michael Lorenz
Module Name:src
Committed By:   macallan
Date:   Thu Mar 19 12:22:36 UTC 2015

Modified Files:
src/sys/arch/mips/ingenic: ingenic_regs.h

Log Message:
add SMBus registers


To generate a diff of this commit:
cvs rdiff -u -r1.10 -r1.11 src/sys/arch/mips/ingenic/ingenic_regs.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/sys/dev/pci/ixgbe

2015-03-19 Thread SAITOH Masanobu
Module Name:src
Committed By:   msaitoh
Date:   Thu Mar 19 14:22:23 UTC 2015

Modified Files:
src/sys/dev/pci/ixgbe: ixgbe.c ixv.c

Log Message:
Sync ixg(4) up to FreeBSD r230572.

 - Fix in the interrupt handler to make sure the stack TX queue is processed.
   (FreeBSD r222588)
 - The maximum read size of incoming packets is done in 1024-byte increments.
   The current code was rounding down the maximum frame size instead of
   routing up, resulting in a read size of 1024 bytes, in the non-jumbo
   frame case, and splitting the packets across multiple mbufs.
   (FreeBSD r225045)
 - Consequently the above problem exposed another issue, which is when
   packets were splitted across multiple mbufs, and all of the mbufs in the
   chain have the M_PKTHDR flag set. (FreeBSD r225045)
 - Use the correct constant for conversion between interrupt rate
   and EITR values (the previous values were off by a factor of 2)
   (FreeBSD r230572)
 - Make dev.ix.N.queueM.interrupt_rate a RW sysctl variable. Changing
   individual values affects the queue immediately, and propagates to all
   interfaces at the next reinit. (FreeBSD r230572)
 - Add dev.ix.N.queueM.irqs rdonly sysctl, to export the actual interrupt
   counts. (FreeBSD r230572)
 - Some netmap related changes.


To generate a diff of this commit:
cvs rdiff -u -r1.21 -r1.22 src/sys/dev/pci/ixgbe/ixgbe.c
cvs rdiff -u -r1.3 -r1.4 src/sys/dev/pci/ixgbe/ixv.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/crypto/external/bsd/openssl/dist

2015-03-19 Thread S.P.Zeidler
Module Name:src
Committed By:   spz
Date:   Thu Mar 19 14:24:55 UTC 2015

Modified Files:
src/crypto/external/bsd/openssl/dist/crypto/asn1: a_type.c tasn_dec.c
src/crypto/external/bsd/openssl/dist/crypto/pkcs7: pk7_doit.c pk7_lib.c
src/crypto/external/bsd/openssl/dist/doc/crypto: d2i_X509.pod
src/crypto/external/bsd/openssl/dist/ssl: s2_lib.c s2_srvr.c

Log Message:
patches for todays' OpenSSL security advisory from OpenSSL, as relevant
to NetBSD base:

OpenSSL Security Advisory [19 Mar 2015]
===

Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)


Severity: High

This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".

This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.

This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.

** issue already committed see last release **
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.

This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.

Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===

Severity: Moderate

The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 1b8ac2b07d02207f2b88e0b009b0bff4ef7eda96

OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit ee5a1253285e5c9f406c8b57b0686319b70c07d8

OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit 1e3ca524cb38ec92deea37629718e98aba43bc5d

OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 7058bd1712828a78d34457b1cfc32bdc1e6d3d33

This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.

ASN.1 structure reuse memory corruption (CVE-2015-0287)
===

Severity: Moderate

Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.

Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 0ca8edbe6ec402e39c9e095f8ae11dba8fa93fc1

OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit a9f34a7aac5fd89f33a34fb71e954b85fbf35875

OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit d96692c933fe02829c3e922bf7f239e0bd003759

OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 5722767d5dc1a3b5505058fe27877fc993fe9a5a

This issue was discovered by Emilia Käsper and a fix developed by
Stephen Henson of the OpenSSL development team.

PKCS7 NULL pointer dereferences (CVE-2015-0289)
===

Severity: Moderate

The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.

Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
otherwise parse PKCS#7 structures from untrusted sources are
affected. OpenSSL clients and servers are not affected.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit e0d6a791c53b64da64277c5565eb89b1cb149fc3

OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit d3d52c73544bba800c2a8f5ef3376358158cf2ca

OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit 1f858109d0556b5864bb6a0aa3e2d177b1cc4552

OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit f20caf7f66cb1eb9ba9562e6097bc7b64d207cb9

This issue was reported to OpenSSL on February 16th 2015 by Michal
Zalewski (Go

CVS commit: [netbsd-5] src/crypto/dist/openssl

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:39:09 UTC 2015

Modified Files:
src/crypto/dist/openssl/crypto/asn1 [netbsd-5]: a_type.c tasn_dec.c
src/crypto/dist/openssl/crypto/pkcs7 [netbsd-5]: pk7_doit.c pk7_lib.c
src/crypto/dist/openssl/doc/crypto [netbsd-5]: d2i_X509.pod
src/crypto/dist/openssl/ssl [netbsd-5]: s2_lib.c s2_srvr.c

Log Message:
Pull up following revision(s) (requested by spz in ticket #1954):
crypto/external/bsd/openssl/dist/ssl/s2_lib.c: revision 1.3
crypto/external/bsd/openssl/dist/crypto/asn1/a_type.c: revision 1.2
crypto/external/bsd/openssl/dist/doc/crypto/d2i_X509.pod: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_doit.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_lib.c: revision 1.2
crypto/external/bsd/openssl/dist/ssl/s2_srvr.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/asn1/tasn_dec.c: revision 1.2
patches for todays' OpenSSL security advisory from OpenSSL, as relevant
to NetBSD base:
OpenSSL Security Advisory [19 Mar 2015]
===
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

Severity: High
This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".
This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
** issue already committed see last release **
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.
This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===
Severity: Moderate
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 1b8ac2b07d02207f2b88e0b009b0bff4ef7eda96
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit ee5a1253285e5c9f406c8b57b0686319b70c07d8
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit 1e3ca524cb38ec92deea37629718e98aba43bc5d
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 7058bd1712828a78d34457b1cfc32bdc1e6d3d33
This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.
ASN.1 structure reuse memory corruption (CVE-2015-0287)
===
Severity: Moderate
Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 0ca8edbe6ec402e39c9e095f8ae11dba8fa93fc1
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit a9f34a7aac5fd89f33a34fb71e954b85fbf35875
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit d96692c933fe02829c3e922bf7f239e0bd003759
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 5722767d5dc1a3b5505058fe27877fc993fe9a5a
This issue was discovered by Emilia K�sper and a fix developed by
Stephen Henson of the OpenSSL development team.
PKCS7 NULL pointer dereferences (CVE-2015-0289)
===
Severity: Moderate
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
otherwise parse PKCS#7 structures from untrusted sources are
affected. OpenSSL clients and servers are n

CVS commit: [netbsd-5] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:39:50 UTC 2015

Modified Files:
src/doc [netbsd-5]: CHANGES-5.3

Log Message:
Ticket 1594.


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.105 -r1.1.2.106 src/doc/CHANGES-5.3

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: [netbsd-5-1] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:40:32 UTC 2015

Modified Files:
src/doc [netbsd-5-1]: CHANGES-5.1.6

Log Message:
Ticket 1594


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.20 -r1.1.2.21 src/doc/CHANGES-5.1.6

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: [netbsd-5-1] src/crypto/dist/openssl

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:40:07 UTC 2015

Modified Files:
src/crypto/dist/openssl/crypto/asn1 [netbsd-5-1]: a_type.c tasn_dec.c
src/crypto/dist/openssl/crypto/pkcs7 [netbsd-5-1]: pk7_doit.c pk7_lib.c
src/crypto/dist/openssl/doc/crypto [netbsd-5-1]: d2i_X509.pod
src/crypto/dist/openssl/ssl [netbsd-5-1]: s2_lib.c s2_srvr.c

Log Message:
Pull up following revision(s) (requested by spz in ticket #1954):
crypto/external/bsd/openssl/dist/ssl/s2_lib.c: revision 1.3
crypto/external/bsd/openssl/dist/crypto/asn1/a_type.c: revision 1.2
crypto/external/bsd/openssl/dist/doc/crypto/d2i_X509.pod: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_doit.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_lib.c: revision 1.2
crypto/external/bsd/openssl/dist/ssl/s2_srvr.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/asn1/tasn_dec.c: revision 1.2
patches for todays' OpenSSL security advisory from OpenSSL, as relevant
to NetBSD base:
OpenSSL Security Advisory [19 Mar 2015]
===
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

Severity: High
This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".
This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
** issue already committed see last release **
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.
This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===
Severity: Moderate
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 1b8ac2b07d02207f2b88e0b009b0bff4ef7eda96
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit ee5a1253285e5c9f406c8b57b0686319b70c07d8
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit 1e3ca524cb38ec92deea37629718e98aba43bc5d
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 7058bd1712828a78d34457b1cfc32bdc1e6d3d33
This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.
ASN.1 structure reuse memory corruption (CVE-2015-0287)
===
Severity: Moderate
Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 0ca8edbe6ec402e39c9e095f8ae11dba8fa93fc1
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit a9f34a7aac5fd89f33a34fb71e954b85fbf35875
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit d96692c933fe02829c3e922bf7f239e0bd003759
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 5722767d5dc1a3b5505058fe27877fc993fe9a5a
This issue was discovered by Emilia K�sper and a fix developed by
Stephen Henson of the OpenSSL development team.
PKCS7 NULL pointer dereferences (CVE-2015-0289)
===
Severity: Moderate
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
otherwise parse PKCS#7 structures from untrusted sources are
affected. OpenSSL clients and serve

CVS commit: [netbsd-5-2] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:41:13 UTC 2015

Modified Files:
src/doc [netbsd-5-2]: CHANGES-5.2.4

Log Message:
Ticket 1594.


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.21 -r1.1.2.22 src/doc/CHANGES-5.2.4

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: [netbsd-5-2] src/crypto/dist/openssl

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:40:51 UTC 2015

Modified Files:
src/crypto/dist/openssl/crypto/asn1 [netbsd-5-2]: a_type.c tasn_dec.c
src/crypto/dist/openssl/crypto/pkcs7 [netbsd-5-2]: pk7_doit.c pk7_lib.c
src/crypto/dist/openssl/doc/crypto [netbsd-5-2]: d2i_X509.pod
src/crypto/dist/openssl/ssl [netbsd-5-2]: s2_lib.c s2_srvr.c

Log Message:
Pull up following revision(s) (requested by spz in ticket #1954):
crypto/external/bsd/openssl/dist/ssl/s2_lib.c: revision 1.3
crypto/external/bsd/openssl/dist/crypto/asn1/a_type.c: revision 1.2
crypto/external/bsd/openssl/dist/doc/crypto/d2i_X509.pod: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_doit.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_lib.c: revision 1.2
crypto/external/bsd/openssl/dist/ssl/s2_srvr.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/asn1/tasn_dec.c: revision 1.2
patches for todays' OpenSSL security advisory from OpenSSL, as relevant
to NetBSD base:
OpenSSL Security Advisory [19 Mar 2015]
===
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

Severity: High
This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".
This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
** issue already committed see last release **
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.
This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===
Severity: Moderate
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 1b8ac2b07d02207f2b88e0b009b0bff4ef7eda96
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit ee5a1253285e5c9f406c8b57b0686319b70c07d8
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit 1e3ca524cb38ec92deea37629718e98aba43bc5d
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 7058bd1712828a78d34457b1cfc32bdc1e6d3d33
This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.
ASN.1 structure reuse memory corruption (CVE-2015-0287)
===
Severity: Moderate
Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 0ca8edbe6ec402e39c9e095f8ae11dba8fa93fc1
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit a9f34a7aac5fd89f33a34fb71e954b85fbf35875
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit d96692c933fe02829c3e922bf7f239e0bd003759
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 5722767d5dc1a3b5505058fe27877fc993fe9a5a
This issue was discovered by Emilia K�sper and a fix developed by
Stephen Henson of the OpenSSL development team.
PKCS7 NULL pointer dereferences (CVE-2015-0289)
===
Severity: Moderate
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
otherwise parse PKCS#7 structures from untrusted sources are
affected. OpenSSL clients and serve

CVS commit: [netbsd-6] src/crypto/external/bsd/openssl/dist

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:45:35 UTC 2015

Modified Files:
src/crypto/external/bsd/openssl/dist/crypto/asn1 [netbsd-6]: a_type.c
tasn_dec.c
src/crypto/external/bsd/openssl/dist/crypto/pkcs7 [netbsd-6]:
pk7_doit.c pk7_lib.c
src/crypto/external/bsd/openssl/dist/doc/crypto [netbsd-6]:
d2i_X509.pod
src/crypto/external/bsd/openssl/dist/ssl [netbsd-6]: s2_lib.c s2_srvr.c

Log Message:
Pull up following revision(s) (requested by spz in ticket #1281):
crypto/external/bsd/openssl/dist/ssl/s2_lib.c: revision 1.3
crypto/external/bsd/openssl/dist/crypto/asn1/a_type.c: revision 1.2
crypto/external/bsd/openssl/dist/doc/crypto/d2i_X509.pod: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_doit.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_lib.c: revision 1.2
crypto/external/bsd/openssl/dist/ssl/s2_srvr.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/asn1/tasn_dec.c: revision 1.2
patches for todays' OpenSSL security advisory from OpenSSL, as relevant
to NetBSD base:
OpenSSL Security Advisory [19 Mar 2015]
===
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

Severity: High
This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".
This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
** issue already committed see last release **
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.
This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===
Severity: Moderate
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 1b8ac2b07d02207f2b88e0b009b0bff4ef7eda96
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit ee5a1253285e5c9f406c8b57b0686319b70c07d8
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit 1e3ca524cb38ec92deea37629718e98aba43bc5d
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 7058bd1712828a78d34457b1cfc32bdc1e6d3d33
This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.
ASN.1 structure reuse memory corruption (CVE-2015-0287)
===
Severity: Moderate
Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 0ca8edbe6ec402e39c9e095f8ae11dba8fa93fc1
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit a9f34a7aac5fd89f33a34fb71e954b85fbf35875
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit d96692c933fe02829c3e922bf7f239e0bd003759
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 5722767d5dc1a3b5505058fe27877fc993fe9a5a
This issue was discovered by Emilia K�sper and a fix developed by
Stephen Henson of the OpenSSL development team.
PKCS7 NULL pointer dereferences (CVE-2015-0289)
===
Severity: Moderate
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
otherwise parse 

CVS commit: [netbsd-6] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:46:02 UTC 2015

Modified Files:
src/doc [netbsd-6]: CHANGES-6.2

Log Message:
Ticket 1281


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.203 -r1.1.2.204 src/doc/CHANGES-6.2

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: [netbsd-6-0] src/crypto/external/bsd/openssl/dist

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:46:24 UTC 2015

Modified Files:
src/crypto/external/bsd/openssl/dist/crypto/asn1 [netbsd-6-0]: a_type.c
tasn_dec.c
src/crypto/external/bsd/openssl/dist/crypto/pkcs7 [netbsd-6-0]:
pk7_doit.c pk7_lib.c
src/crypto/external/bsd/openssl/dist/doc/crypto [netbsd-6-0]:
d2i_X509.pod
src/crypto/external/bsd/openssl/dist/ssl [netbsd-6-0]: s2_lib.c
s2_srvr.c

Log Message:
Pull up following revision(s) (requested by spz in ticket #1281):
crypto/external/bsd/openssl/dist/ssl/s2_lib.c: revision 1.3
crypto/external/bsd/openssl/dist/crypto/asn1/a_type.c: revision 1.2
crypto/external/bsd/openssl/dist/doc/crypto/d2i_X509.pod: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_doit.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_lib.c: revision 1.2
crypto/external/bsd/openssl/dist/ssl/s2_srvr.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/asn1/tasn_dec.c: revision 1.2
patches for todays' OpenSSL security advisory from OpenSSL, as relevant
to NetBSD base:
OpenSSL Security Advisory [19 Mar 2015]
===
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

Severity: High
This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".
This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
** issue already committed see last release **
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.
This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===
Severity: Moderate
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 1b8ac2b07d02207f2b88e0b009b0bff4ef7eda96
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit ee5a1253285e5c9f406c8b57b0686319b70c07d8
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit 1e3ca524cb38ec92deea37629718e98aba43bc5d
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 7058bd1712828a78d34457b1cfc32bdc1e6d3d33
This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.
ASN.1 structure reuse memory corruption (CVE-2015-0287)
===
Severity: Moderate
Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 0ca8edbe6ec402e39c9e095f8ae11dba8fa93fc1
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit a9f34a7aac5fd89f33a34fb71e954b85fbf35875
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit d96692c933fe02829c3e922bf7f239e0bd003759
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 5722767d5dc1a3b5505058fe27877fc993fe9a5a
This issue was discovered by Emilia K�sper and a fix developed by
Stephen Henson of the OpenSSL development team.
PKCS7 NULL pointer dereferences (CVE-2015-0289)
===
Severity: Moderate
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data

CVS commit: [netbsd-6-0] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:46:42 UTC 2015

Modified Files:
src/doc [netbsd-6-0]: CHANGES-6.0.7

Log Message:
Ticket 1281


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.34 -r1.1.2.35 src/doc/CHANGES-6.0.7

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: [netbsd-6-1] src/crypto/external/bsd/openssl/dist

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:47:14 UTC 2015

Modified Files:
src/crypto/external/bsd/openssl/dist/crypto/asn1 [netbsd-6-1]: a_type.c
tasn_dec.c
src/crypto/external/bsd/openssl/dist/crypto/pkcs7 [netbsd-6-1]:
pk7_doit.c pk7_lib.c
src/crypto/external/bsd/openssl/dist/doc/crypto [netbsd-6-1]:
d2i_X509.pod
src/crypto/external/bsd/openssl/dist/ssl [netbsd-6-1]: s2_lib.c
s2_srvr.c

Log Message:
Pull up following revision(s) (requested by spz in ticket #1281):
crypto/external/bsd/openssl/dist/ssl/s2_lib.c: revision 1.3
crypto/external/bsd/openssl/dist/crypto/asn1/a_type.c: revision 1.2
crypto/external/bsd/openssl/dist/doc/crypto/d2i_X509.pod: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_doit.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_lib.c: revision 1.2
crypto/external/bsd/openssl/dist/ssl/s2_srvr.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/asn1/tasn_dec.c: revision 1.2
patches for todays' OpenSSL security advisory from OpenSSL, as relevant
to NetBSD base:
OpenSSL Security Advisory [19 Mar 2015]
===
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

Severity: High
This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".
This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
** issue already committed see last release **
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.
This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===
Severity: Moderate
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 1b8ac2b07d02207f2b88e0b009b0bff4ef7eda96
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit ee5a1253285e5c9f406c8b57b0686319b70c07d8
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit 1e3ca524cb38ec92deea37629718e98aba43bc5d
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 7058bd1712828a78d34457b1cfc32bdc1e6d3d33
This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.
ASN.1 structure reuse memory corruption (CVE-2015-0287)
===
Severity: Moderate
Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 0ca8edbe6ec402e39c9e095f8ae11dba8fa93fc1
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit a9f34a7aac5fd89f33a34fb71e954b85fbf35875
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit d96692c933fe02829c3e922bf7f239e0bd003759
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 5722767d5dc1a3b5505058fe27877fc993fe9a5a
This issue was discovered by Emilia K�sper and a fix developed by
Stephen Henson of the OpenSSL development team.
PKCS7 NULL pointer dereferences (CVE-2015-0289)
===
Severity: Moderate
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data

CVS commit: [netbsd-6-1] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:47:41 UTC 2015

Modified Files:
src/doc [netbsd-6-1]: CHANGES-6.1.6

Log Message:
Ticket 1281


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.34 -r1.1.2.35 src/doc/CHANGES-6.1.6

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: [netbsd-7] src/crypto/external/bsd/openssl/dist

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:50:26 UTC 2015

Modified Files:
src/crypto/external/bsd/openssl/dist/crypto/asn1 [netbsd-7]: a_type.c
tasn_dec.c
src/crypto/external/bsd/openssl/dist/crypto/pkcs7 [netbsd-7]:
pk7_doit.c pk7_lib.c
src/crypto/external/bsd/openssl/dist/doc/crypto [netbsd-7]:
d2i_X509.pod
src/crypto/external/bsd/openssl/dist/ssl [netbsd-7]: s2_lib.c s2_srvr.c

Log Message:
Pull up following revision(s) (requested by spz in ticket #625):
crypto/external/bsd/openssl/dist/ssl/s2_lib.c: revision 1.3
crypto/external/bsd/openssl/dist/crypto/asn1/a_type.c: revision 1.2
crypto/external/bsd/openssl/dist/doc/crypto/d2i_X509.pod: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_doit.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/pkcs7/pk7_lib.c: revision 1.2
crypto/external/bsd/openssl/dist/ssl/s2_srvr.c: revision 1.2
crypto/external/bsd/openssl/dist/crypto/asn1/tasn_dec.c: revision 1.2
patches for todays' OpenSSL security advisory from OpenSSL, as relevant
to NetBSD base:
OpenSSL Security Advisory [19 Mar 2015]
===
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

Severity: High
This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".
This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.
This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.
** issue already committed see last release **
OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.
This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===
Severity: Moderate
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 1b8ac2b07d02207f2b88e0b009b0bff4ef7eda96
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit ee5a1253285e5c9f406c8b57b0686319b70c07d8
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit 1e3ca524cb38ec92deea37629718e98aba43bc5d
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 7058bd1712828a78d34457b1cfc32bdc1e6d3d33
This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.
ASN.1 structure reuse memory corruption (CVE-2015-0287)
===
Severity: Moderate
Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2a
commit 0ca8edbe6ec402e39c9e095f8ae11dba8fa93fc1
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
commit a9f34a7aac5fd89f33a34fb71e954b85fbf35875
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
commit d96692c933fe02829c3e922bf7f239e0bd003759
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.
commit 5722767d5dc1a3b5505058fe27877fc993fe9a5a
This issue was discovered by Emilia K�sper and a fix developed by
Stephen Henson of the OpenSSL development team.
PKCS7 NULL pointer dereferences (CVE-2015-0289)
===
Severity: Moderate
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
otherwise parse P

CVS commit: [netbsd-7] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 16:50:43 UTC 2015

Modified Files:
src/doc [netbsd-7]: CHANGES-7.0

Log Message:
Ticket 625


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.232 -r1.1.2.233 src/doc/CHANGES-7.0

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/external/cddl/osnet/dist/uts/common/fs/zfs

2015-03-19 Thread Taylor R Campbell
Module Name:src
Committed By:   riastradh
Date:   Thu Mar 19 17:16:22 UTC 2015

Modified Files:
src/external/cddl/osnet/dist/uts/common/fs/zfs: dmu.c

Log Message:
Move initialization of XUIO_XUZC_PRIV out of #ifdef PORT_SOLARIS.

This code is not currently used, so no functional change, but it may
be used when we hook zfs into the ubc.


To generate a diff of this commit:
cvs rdiff -u -r1.3 -r1.4 src/external/cddl/osnet/dist/uts/common/fs/zfs/dmu.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: [nick-nhusb] src/sys

2015-03-19 Thread Nick Hudson
Module Name:src
Committed By:   skrll
Date:   Thu Mar 19 17:26:43 UTC 2015

Modified Files:
src/sys/arch/arm/omap [nick-nhusb]: tiotg.c
src/sys/arch/mips/adm5120/dev [nick-nhusb]: ahci.c ahcivar.h
src/sys/dev/usb [nick-nhusb]: aubtfwl.c auvitek.c auvitek_audio.c
auvitek_dtv.c auvitek_video.c auvitekvar.h ehci.c ehcivar.h emdtv.c
emdtv_dtv.c emdtv_ir.c emdtvvar.h ezload.c ezload.h if_athn_usb.c
if_athn_usb.h if_atu.c if_atureg.h if_aue.c if_auereg.h if_axe.c
if_axen.c if_axenreg.h if_axereg.h if_cdce.c if_cdcereg.h if_cue.c
if_cuereg.h if_kue.c if_kuereg.h if_otus.c if_otusvar.h if_rum.c
if_rumvar.h if_run.c if_runvar.h if_smsc.c if_smscvar.h if_udav.c
if_udavreg.h if_upgt.c if_upgtvar.h if_upl.c if_ural.c if_uralvar.h
if_url.c if_urlreg.h if_urndis.c if_urndisreg.h if_urtw.c
if_urtwn.c if_urtwnvar.h if_urtwreg.h if_zyd.c if_zydreg.h irmce.c
moscom.c motg.c motgvar.h ohci.c ohcivar.h pseye.c slurm.c
stuirda.c u3g.c uark.c uatp.c uaudio.c uberry.c ubsa.c
ubsa_common.c ubsavar.h ubt.c uchcom.c ucom.c ucomvar.h ucycom.c
udl.c udl.h udsbr.c udsir.c uep.c uftdi.c ugen.c ugensa.c uhci.c
uhcivar.h uhidev.c uhidev.h uhmodem.c uhso.c uhub.c uipad.c uipaq.c
uirda.c uirdavar.h ukbd.c ulpt.c umass.c umassvar.h umcs.c umct.c
umidi.c umidivar.h umodem_common.c umodemvar.h uplcom.c urio.c
usb.c usb_mem.c usb_mem.h usb_subr.c usbdi.c usbdi.h usbdi_util.c
usbdi_util.h usbdivar.h usbroothub.c uscanner.c uslsa.c usscanner.c
ustir.c uthum.c utoppy.c uvideo.c uvisor.c uvscom.c uyap.c uyurex.c
xhci.c xhcivar.h
src/sys/external/bsd/dwc2 [nick-nhusb]: dwc2.c dwc2var.h
src/sys/external/bsd/dwc2/dist [nick-nhusb]: dwc2_hcd.c dwc2_hcd.h
src/sys/rump/dev/lib/libugenhc [nick-nhusb]: ugenhc.c

Log Message:
Do the same as OpenBSD and get rid of the *_handle typedefs and use
plain structures insteads


To generate a diff of this commit:
cvs rdiff -u -r1.2.8.3 -r1.2.8.4 src/sys/arch/arm/omap/tiotg.c
cvs rdiff -u -r1.12.6.11 -r1.12.6.12 src/sys/arch/mips/adm5120/dev/ahci.c
cvs rdiff -u -r1.5.6.1 -r1.5.6.2 src/sys/arch/mips/adm5120/dev/ahcivar.h
cvs rdiff -u -r1.5.10.3 -r1.5.10.4 src/sys/dev/usb/aubtfwl.c
cvs rdiff -u -r1.9 -r1.9.4.1 src/sys/dev/usb/auvitek.c
cvs rdiff -u -r1.1.40.1 -r1.1.40.2 src/sys/dev/usb/auvitek_audio.c
cvs rdiff -u -r1.6.14.2 -r1.6.14.3 src/sys/dev/usb/auvitek_dtv.c
cvs rdiff -u -r1.6.32.2 -r1.6.32.3 src/sys/dev/usb/auvitek_video.c
cvs rdiff -u -r1.8 -r1.8.4.1 src/sys/dev/usb/auvitekvar.h \
src/sys/dev/usb/if_urtwnvar.h
cvs rdiff -u -r1.234.2.44 -r1.234.2.45 src/sys/dev/usb/ehci.c
cvs rdiff -u -r1.42.14.11 -r1.42.14.12 src/sys/dev/usb/ehcivar.h
cvs rdiff -u -r1.9 -r1.9.14.1 src/sys/dev/usb/emdtv.c
cvs rdiff -u -r1.10.14.1 -r1.10.14.2 src/sys/dev/usb/emdtv_dtv.c \
src/sys/dev/usb/if_atureg.h
cvs rdiff -u -r1.1 -r1.1.32.1 src/sys/dev/usb/emdtv_ir.c \
src/sys/dev/usb/if_urndisreg.h
cvs rdiff -u -r1.3 -r1.3.32.1 src/sys/dev/usb/emdtvvar.h
cvs rdiff -u -r1.15.14.1 -r1.15.14.2 src/sys/dev/usb/ezload.c
cvs rdiff -u -r1.5.66.1 -r1.5.66.2 src/sys/dev/usb/ezload.h
cvs rdiff -u -r1.6.8.2 -r1.6.8.3 src/sys/dev/usb/if_athn_usb.c
cvs rdiff -u -r1.2.16.1 -r1.2.16.2 src/sys/dev/usb/if_athn_usb.h
cvs rdiff -u -r1.50.2.6 -r1.50.2.7 src/sys/dev/usb/if_atu.c
cvs rdiff -u -r1.132.4.5 -r1.132.4.6 src/sys/dev/usb/if_aue.c
cvs rdiff -u -r1.25.24.1 -r1.25.24.2 src/sys/dev/usb/if_auereg.h
cvs rdiff -u -r1.67.4.3 -r1.67.4.4 src/sys/dev/usb/if_axe.c
cvs rdiff -u -r1.3.6.3 -r1.3.6.4 src/sys/dev/usb/if_axen.c
cvs rdiff -u -r1.1 -r1.1.12.1 src/sys/dev/usb/if_axenreg.h
cvs rdiff -u -r1.16 -r1.16.6.1 src/sys/dev/usb/if_axereg.h
cvs rdiff -u -r1.38.14.2 -r1.38.14.3 src/sys/dev/usb/if_cdce.c
cvs rdiff -u -r1.7.24.1 -r1.7.24.2 src/sys/dev/usb/if_cdcereg.h
cvs rdiff -u -r1.68.4.4 -r1.68.4.5 src/sys/dev/usb/if_cue.c
cvs rdiff -u -r1.18.24.1 -r1.18.24.2 src/sys/dev/usb/if_cuereg.h
cvs rdiff -u -r1.81.4.3 -r1.81.4.4 src/sys/dev/usb/if_kue.c
cvs rdiff -u -r1.18 -r1.18.24.1 src/sys/dev/usb/if_kuereg.h
cvs rdiff -u -r1.25.6.2 -r1.25.6.3 src/sys/dev/usb/if_otus.c
cvs rdiff -u -r1.7.12.2 -r1.7.12.3 src/sys/dev/usb/if_otusvar.h
cvs rdiff -u -r1.48.6.3 -r1.48.6.4 src/sys/dev/usb/if_rum.c
cvs rdiff -u -r1.9 -r1.9.34.1 src/sys/dev/usb/if_rumvar.h
cvs rdiff -u -r1.10.6.2 -r1.10.6.3 src/sys/dev/usb/if_run.c
cvs rdiff -u -r1.1 -r1.1.20.1 src/sys/dev/usb/if_runvar.h
cvs rdiff -u -r1.22.2.3 -r1.22.2.4 src/sys/dev/usb/if_smsc.c
cvs rdiff -u -r1.3 -r1.3.4.1 src/sys/dev/usb/if_smscvar.h
cvs rdiff -u -r1.43.4.3 -r1.43.4.4 src/sys/dev/usb/if_udav.c
cvs rdiff -u -r1.9.16.1 -r1.9.16.2 src/sys/dev/usb/if_udavreg.h \
src/sys/dev/usb/if_urlreg.h
cvs rdiff -u -r1.12.4.3 -r1.12.4.4 src/sys/dev/usb/if_upgt.c
cvs rdiff -u -r1.1 -r1.1.44.1 src/sys/dev/usb/if_upgtvar.h \
sr

CVS commit: [netbsd-5] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 18:12:20 UTC 2015

Modified Files:
src/doc [netbsd-5]: CHANGES-5.3

Log Message:
Fix paths in previous.


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.106 -r1.1.2.107 src/doc/CHANGES-5.3

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: [netbsd-5-1] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 18:13:25 UTC 2015

Modified Files:
src/doc [netbsd-5-1]: CHANGES-5.1.6

Log Message:
Fix paths in previous.


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.21 -r1.1.2.22 src/doc/CHANGES-5.1.6

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: [netbsd-5-2] src/doc

2015-03-19 Thread Jeff Rizzo
Module Name:src
Committed By:   riz
Date:   Thu Mar 19 18:14:01 UTC 2015

Modified Files:
src/doc [netbsd-5-2]: CHANGES-5.2.4

Log Message:
Fix paths in previous.


To generate a diff of this commit:
cvs rdiff -u -r1.1.2.22 -r1.1.2.23 src/doc/CHANGES-5.2.4

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src

2015-03-19 Thread Joerg Sonnenberger
Module Name:src
Committed By:   joerg
Date:   Thu Mar 19 19:27:14 UTC 2015

Modified Files:
src/crypto/external/bsd/openssl/lib/libcrypto/arch/arm: aes.inc
src/doc: TODO.clang

Log Message:
Build the AES sources with -fno-integrate-assembler for Clang.


To generate a diff of this commit:
cvs rdiff -u -r1.1 -r1.2 \
src/crypto/external/bsd/openssl/lib/libcrypto/arch/arm/aes.inc
cvs rdiff -u -r1.15 -r1.16 src/doc/TODO.clang

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/lib/libc/arch

2015-03-19 Thread Joerg Sonnenberger
Module Name:src
Committed By:   joerg
Date:   Thu Mar 19 21:22:59 UTC 2015

Modified Files:
src/lib/libc/arch/arm/gen: flt_rounds.c
src/lib/libc/arch/mips/gen: flt_rounds.c
src/lib/libc/arch/or1k/gen: flt_rounds.c
src/lib/libc/arch/powerpc/gen: flt_rounds.c
src/lib/libc/arch/powerpc64/gen: flt_rounds.c
src/lib/libc/arch/riscv/gen: flt_rounds.c
src/lib/libc/arch/sh3/gen: flt_rounds.c

Log Message:
Call libc's fpgetround.


To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 src/lib/libc/arch/arm/gen/flt_rounds.c
cvs rdiff -u -r1.8 -r1.9 src/lib/libc/arch/mips/gen/flt_rounds.c
cvs rdiff -u -r1.1 -r1.2 src/lib/libc/arch/or1k/gen/flt_rounds.c
cvs rdiff -u -r1.11 -r1.12 src/lib/libc/arch/powerpc/gen/flt_rounds.c
cvs rdiff -u -r1.1 -r1.2 src/lib/libc/arch/powerpc64/gen/flt_rounds.c
cvs rdiff -u -r1.1 -r1.2 src/lib/libc/arch/riscv/gen/flt_rounds.c
cvs rdiff -u -r1.5 -r1.6 src/lib/libc/arch/sh3/gen/flt_rounds.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/external/cddl/osnet/sys/sys

2015-03-19 Thread Taylor R Campbell
Module Name:src
Committed By:   riastradh
Date:   Thu Mar 19 22:57:45 UTC 2015

Modified Files:
src/external/cddl/osnet/sys/sys: uio.h

Log Message:
These are expressions, not statements.  No semicolon.


To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 src/external/cddl/osnet/sys/sys/uio.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/sys/arch/arm/vfp

2015-03-19 Thread Matt Thomas
Module Name:src
Committed By:   matt
Date:   Fri Mar 20 00:54:30 UTC 2015

Modified Files:
src/sys/arch/arm/vfp: vfp_init.c

Log Message:
Not only check to see if we own the VFP but that the VFP is enabled.


To generate a diff of this commit:
cvs rdiff -u -r1.44 -r1.45 src/sys/arch/arm/vfp/vfp_init.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/sys/dev/pci

2015-03-19 Thread Michael Lorenz
Module Name:src
Committed By:   macallan
Date:   Fri Mar 20 01:20:16 UTC 2015

Modified Files:
src/sys/dev/pci: wcfb.c

Log Message:
fix copyright & license, make it explicit that this driver is based on
OpenBSD's ifb driver


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 src/sys/dev/pci/wcfb.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/sys/arch/arm/vfp

2015-03-19 Thread Matt Thomas
Module Name:src
Committed By:   matt
Date:   Fri Mar 20 01:27:34 UTC 2015

Modified Files:
src/sys/arch/arm/vfp: vfp_init.c

Log Message:
Remove extra )


To generate a diff of this commit:
cvs rdiff -u -r1.45 -r1.46 src/sys/arch/arm/vfp/vfp_init.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.



CVS commit: src/sys/dev/usb

2015-03-19 Thread matthew green
Module Name:src
Committed By:   mrg
Date:   Fri Mar 20 03:04:48 UTC 2015

Modified Files:
src/sys/dev/usb: uhid.c

Log Message:
don't take the device lock when stopping the uhidev.  that calls
to abort and close pipes, both of which may take an adaptive lock.

fixes a LOCKDEBUG abort see on one particular machine.


To generate a diff of this commit:
cvs rdiff -u -r1.93 -r1.94 src/sys/dev/usb/uhid.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.