*BSD中文用户社区

http://www.openbsd.org/errata47.html


This is the OpenBSD 4.7 release errata & patch list:

For OpenBSD patch branch information, please refer here.

For errata on a certain release, click below:
2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6,
3.7, 3.8, 3.9, 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6.

You can also fetch a tar.gz file containing all the following patches. This file is updated once a day.

The patches below are available in CVS via the OPENBSD_4_7 patch branch.

For more detailed information on how to install patches to OpenBSD, please consult the OpenBSD FAQ.

• 007: RELIABILITY FIX: September 14, 2010 All architectures
  Avoid calling scsi_done() more than once in gdt(4). Fixes a kernel panic triggered by syncing disks during shut down.
  Clear the ITSDONE flag before issuing commands to the SCSI adapter. Fixes handling of retried SCSI commands.
  A source code patch exists which remedies this problem.
• 006: RELIABILITY FIX: July 8, 2010 All architectures
  Restore an unusual XS_SENSE semantic. Fixes dump(8)/restore(8) problems seen on certain tape drives.
  A source code patch exists which remedies this problem.
• 005: RELIABILITY FIX: May 14, 2010 All architectures
  Incorrectly initialized state updates can cause pfsync update storms.
  A source code patch exists which remedies this problem.
• 004: SECURITY FIX: April 23, 2010 All architectures
  The combination of pfsync and IPSEC may crash the kernel.
  A source code patch exists which remedies this problem.
• 003: SECURITY FIX: April 14, 2010 All architectures
  In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL.
  A source code patch exists which remedies this problem.
• 002: RELIABILITY FIX: April 4, 2010 All architectures
  When updating sensors showing the state of RAID volumes mpi(4) allocates temporary memory and then returns it to the kernel as device memory. This causes kernel memory usage to be misrepresented, eventually leading to a denial of service when a resource limit is apparently reached.
  A source code patch exists which remedies this problem.
• 001: RELIABILITY FIX: March 31, 2010 All architectures
  When decrypting packets, the internal decryption functions were not paranoid enough in checking for underruns, which could potentially lead to crashes.
  A source code patch exists which remedies this problem.

For OpenBSD patch branch information, please refer here.

For errata on a certain release, click below:
2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6,
3.7, 3.8, 3.9, 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6.

[email protected]
$OpenBSD: errata47.html,v 1.14 2010/09/14 14:33:33 stephan Exp $

我感觉好像还是4.6稳定点，4.7每次试验东西都或多或少有些问题~

OpenBSD 4.6目前也有12个补丁了，看这里，大部分是可靠性的修补；感觉多数的安全类的修补往往是针对基本系统内的第三方程序，例如：

004: SECURITY FIX: November 26, 2009 All architectures
The SSL/TLS protocol is subject to man-in-the-middle attacks related to renegotiation (see CVE-2009-3555, draft-ietf-tls-renegotiation-00). OpenSSL permitted this protocol feature by default and had no way to disable it.



当然也有涉及自己的：
004: SECURITY FIX: April 23, 2010 All architectures
The combination of pfsync and IPSEC may crash the kernel.
A source code patch exists which remedies this problem.

不过说心里话，我和你有同感 —— 感觉4.6稳定一些，此外i386比amd64更不容易出问题。