Syspatch 1-3 Available for OpenBSD 6.7

[hitest]

Syspatch 1-3 Available for OpenBSD 6.7 (all architectures).

http://www.openbsd.org/errata67.html

[hitest]

Syspatch 4-6 available for all architectures.

[CiotBSD]

Patch for perl on 6.6, 6.7!

Several problems in Perl's regular expression compiler could lead to corruption of the intermediate language state of a compiled regular expression

No reboot; no daemon to restart!

[CiotBSD]

New patch for HID descriptors on 6.6, 6.7

Malicious HID descriptors could be misparsed.

Reboot your machines

[hitest]

Originally Posted by CiotBSD

New patch for HID descriptors on 6.6, 6.7

Reboot your machines

Thanks. Done.

[ripe]

Originally Posted by hitest

Thanks. Done.

Same.

[CiotBSD]

New patch for libc on 6.6, 6.7

libc's resolver could get into a corrupted state.

No need to reboot machine; maybe restart some services

[CiotBSD]

New patch for libgcrypto, named x509, on 6.6, 6.7

libcrypto may fail to build a valid certificate chain due to expired untrusted issuer certificates.

No need to reboot machine; nor restart services.

[CiotBSD]

New patch, named shmget, on 6.6, 6.7.

shmget IPC_STAT leaked some kernel data

Need to reboot machine, because these affect the kernel.

[PapaParrot]

Thanks,both Hitest and CiotBSD I appreciate these, I don't go checking for sys patches every day, and before you started telling us, sometimes when I did check there were so many it took a while to do them, now it is just a 1 or 2 at max,.. thanks

[jggimi]

You have two additional options that do not depend on Hitest or CiotBSD:

1. Add

   syspatch -c

   to /etc/daily.local, and be informed if there are new patches whenever daily(8) runs.
2. Subscribe to the announce@ mailing list, and get informed of new patches when they are posted.

[CiotBSD]

I hope no problem to continue to post here when patch is announced?!

@jggimi: Y. I subscribed since few months.

[fvgit]

Originally Posted by CiotBSD

I hope no problem to continue to post here when patch is announced?!

I'm sure jggimi didn't mean it that way. He just pointed out two possibilites for automatic notifications which can be quite useful. We're talking about potentially security relevant information after all. The sooner you receive it, the better.

[jggimi]

Correct. I also wanted to be sure PapaParrot was aware that the Project makes this information available in multiple ways to the user community, and that users don't need to depend on third party forums like this one to discover it.

[PapaParrot]

Thanks jggimi, yes I knew that, and a 3rd way, just type syspatch , if there are no new patches it just returns to the prompt, but I generally do not even think about checking, and when I see new posts here, it is a good reminder,..the same applies to the new releases, when they are ready...I am all ways surprised at how fast time goes by, Yes I could just check the OpenBsd.org website for announcements, or subscribe to the mail list, but since I check this forum daily for any new posts, on OpenBsd, it is the most convenient for me. A year or 2 could quickly , easily go by before it occurred to me to check for new releases, I do think about syspatch, more often though,...but before this thread started, it might be several weeks before I checked, ... as I all ready mentioned. To many "kids" I guess, grandchildren, and great grandchildren,... sorry, to drift off topic....my mind wanders a lot these days.
==== edited ==========
ahh, now that you mention it

to /etc/daily.local, and be informed if there are new patches whenever daily(8) runs.

I need to check that as well, there probably are over 100 messages to read , or delete.---
not as bad as I thought,

-Mutt: /var/mail/papaparrot [Msgs:60 New:18 Old:35

all parrot.org daily output

[jggimi]

By default, daily(8) runs at 01:30 local time.

[CiotBSD]

New patch for tty on 6.6, 6.7

tty subsystem abuse can impact performance badly.

Need to reboot machine, because these affect the kernel.

[ripe]

Applied, thx!

[CiotBSD]

New patch for tty — again — on 6.6, 6.7

Only pty devices need reprint delays.

Need to reboot machine, because these affect the kernel.

[CiotBSD]

Two patches:

- for iked, on 6.6, 6.7:

In iked, incorrect use of EVP_PKEY_cmp allows an authentication bypass

Restart the service.

- for rpki-client on 6.7:

In rpki-client, incorrect use of EVP_PKEY_cmp allows an authentication bypass.

Restart the client.