http://blog.gmane.org/gmane.os.openbsd.security.announce hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.os.openbsd.security.announce/96 <pre>Welcome to the security-announce mailing list! Your password at OpenBSD Mailing List Server is Azeqqk To leave this mailing list, send the following command in the body of a message to majordomo&lt; at &gt;openbsd.org: approve Azeqqk unsubscribe security-announce goosa-security-announce&lt; at &gt;lo.gmane.org This command will work even if your address changes. For that reason, among others, it is important that you keep a copy of this message. To post a message to the mailing list, send it to security-announce&lt; at &gt;openbsd.org If you need help or have questions about the mailing list, please contact the people who manage the list by sending a message to owner-security-announce&lt; at &gt;openbsd.org You can manage your subscription by visiting the following WWW location: &lt;http://lists.openbsd.org/cgi-bin/mj_wwwusr/domain=openbsd.org/goosa-security-announce%40lo.gmane.org&gt; </pre> owner-security-announce< at >openbsd.org 2011-12-03T00:11:04 http://permalink.gmane.org/gmane.os.openbsd.security.announce/95 <pre>The SSL/TLS protocol is subject to man-in-the-middle attacks related to renegotiation (described in draft-ietf-tls-renegotiation-00) allowing a MITM to inject chosen plaintext to the beginning of the application data. Practical attacks exist against HTTPS and possibly other protocols. In -current, OpenSSL's ability to accept renegotiations has been disabled by default. Patches are available for OpenBSD 4.6 and 4.5: ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.5/common/010_openssl.patch ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.6/common/004_openssl.patch These are also available in the 4.5 and 4.6 -stable branches. </pre> Stuart Henderson 2009-11-26T09:41:59 http://permalink.gmane.org/gmane.os.openbsd.security.announce/94 <pre>XMM exceptions are incorrectly handled in the OpenBSD/i386 kernel, resulting in a kernel panic that can be triggered by a local user. This issue has been fixed in -current. Source code patches are available for OpenBSD 4.4, 4.5 and 4.6. Patch for OpenBSD 4.6: ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.6/i386/002_xmm.patch Patch for OpenBSD 4.5: ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.5/i386/008_xmm.patch Patch for OpenBSD 4.4: ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.4/i386/015_xmm.patch These patches are also available in the OPENBSD_4_6, OPENBSD_4_5 and OPENBSD_4_4 patch branches. Thanks to Slava Pestov for reporting this issue. </pre> Joel Sing 2009-10-05T11:21:27 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.os.openbsd.security.announce