<html lang='en'>
<head>
<meta content='text/html; charset=utf-8' http-equiv='Content-Type'>
<title>
GitLab
</title>
</meta>
</head>
<style>
img {
max-width: 100%;
height: auto;
}
p.details {
font-style:italic;
color:#777
}
.footer p {
font-size:small;
color:#777
}
pre.commit-message {
white-space: pre-wrap;
}
.file-stats a {
text-decoration: none;
}
.file-stats .new-file {
color: #090;
}
.file-stats .deleted-file {
color: #B00;
}
</style>
<body>
<div class='content'>
<h3>
Eric S. Raymond pushed to branch master
at <a href="https://gitlab.com/NTPsec/ntpsec">NTPsec / ntpsec</a>
</h3>
<h4>
Commits:
</h4>
<ul>
<li>
<strong><a href="https://gitlab.com/NTPsec/ntpsec/commit/142a55cbc5fa86886bb4d9932fecc0518beb1d58">142a55cb</a></strong>
<div>
<span>by Eric S. Raymond</span>
<i>at 2016-03-20T22:11:23-04:00</i>
</div>
<pre class='commit-message'>In NEWS, record some forward-ported bug fixes.</pre>
</li>
</ul>
<h4>1 changed file:</h4>
<ul>
<li class='file-stats'>
<a href='#diff-0'>
NEWS
</a>
</li>
</ul>
<h4>Changes:</h4>
<li id='diff-0'>
<a href='https://gitlab.com/NTPsec/ntpsec/commit/142a55cbc5fa86886bb4d9932fecc0518beb1d58#diff-0'>
<strong>
NEWS
</strong>
</a>
<hr>
<pre class="highlight"><code><span style="color: #000000;background-color: #ffdddd">--- a/NEWS
</span><span style="color: #000000;background-color: #ddffdd">+++ b/NEWS
</span><span style="color: #aaaaaa">@@ -6,6 +6,16 @@ Much of the traditional function of a news file is now better addressed
</span> by browsing the comments in the revision history. This file will focus
on user-visible changes.
<span style="color: #000000;background-color: #ddffdd">+== Repository head ==
+
+The following reflect forward-ported fixes to Classic:
+
+[Bug 2772] adj_systime overflows tv_usec
+[Bug 2829] Look at pipe_fds in ntpd.c
+[Bug 2887] fudge stratum only accepts values [0..16].
+[Bug 2937] (NTPQ) nextvar() missing length check
+[Bug 2958] ntpq: fatal error messages need a final newline. Craig Leres.
+
</span> == 2016-03-15: 0.9.2 ==
Point release.
<span style="color: #aaaaaa">@@ -152,22 +162,22 @@ the 0.9.0 beta release.
</span> * [Bug 2883] ntpd crashes on exit with empty driftfile. Miroslav Lichvar.
* [Bug 2886] Misspelling: "outlyer" should be "outlier"
* [Bug 2890] Ignore ENOBUFS on routing netlink socket. Konstantin Khlebnikov.
<span style="color: #000000;background-color: #ddffdd">+* [Bug 2901] Clients that receive a KoD should validate the origin
+ timestamp field (CVE-2015-7704, CVE-2015-7705)
</span> * [Bug 2902] configuration directives "pidfile" and "driftfile"
should be local-only. (patch by Miroslav Lichvar) (CVE-2015-7703)
* [Bug 2909] Slow memory leak in CRYPTO_ASSOC (CVE-2015-7701)
<span style="color: #000000;background-color: #ffdddd">-* [Bug 2941] NAK to the Future: Symmetric association authentication
- bypass via crypto-NAK (CVE-2015-7871)
-* [Bug 2922] decodenetnum() will ASSERT botch instead of returning
- FAIL on some bogus values (CVE-2015-7855)
-* [Bug 2921] Password Length Memory Corruption Vulnerability (CVE-2015-7854)
-* [Bug 2920] Invalid length data provided by a custom refclock driver
- could cause a buffer overflow (CVE-2015-7853)
-* [Bug 2919] ntpq atoascii() potential memory corruption (CVE-2015-7852)
</span><span style="color: #000000;background-color: #ddffdd">+* [Bug 2916] trusted key use-after-free (CVE-2015-7849)
</span> * [Bug 2918] saveconfig Directory Traversal Vulnerability. (OpenVMS)
(CVE-2015-7851)
<span style="color: #000000;background-color: #ffdddd">-* [Bug 2916] trusted key use-after-free (CVE-2015-7849)
-* [Bug 2901] Clients that receive a KoD should validate the origin
- timestamp field (CVE-2015-7704, CVE-2015-7705)
</span><span style="color: #000000;background-color: #ddffdd">+* [Bug 2919] ntpq atoascii() potential memory corruption (CVE-2015-7852)
+* [Bug 2920] Invalid length data provided by a custom refclock driver
+ could cause a buffer overflow (CVE-2015-7853)
+* [Bug 2921] Password Length Memory Corruption Vulnerability (CVE-2015-7854)
+* [Bug 2922] decodenetnum() will ASSERT botch instead of returning
+ FAIL on some bogus values (CVE-2015-7855)
+* [Bug 2941] NAK to the Future: Symmetric association authentication
+ bypass via crypto-NAK (CVE-2015-7871)
</span>
Additionally the NTPsec team is aware of the following vulnerabilities
impacting autokey: CVE-2015-7691, CVE-2015-7692, CVE-2015-7702. NTPsec
</code></pre>
<br>
</li>
</div>
<div class='footer' style='margin-top: 10px;'>
<p>
—
<br>
<a href="https://gitlab.com/NTPsec/ntpsec/commit/142a55cbc5fa86886bb4d9932fecc0518beb1d58">View it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Commit","url":"https://gitlab.com/NTPsec/ntpsec/commit/142a55cbc5fa86886bb4d9932fecc0518beb1d58"}}</script>
</p>
</div>
</body>
</html>