From 849c3ecca0621139ff6494ab61adb46889b6e570 Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Tue, 12 Dec 2023 13:55:55 +0100 Subject: [PATCH] fix links (and code responsible for generating) --- collect_changelogs.py | 5 ++--- source/releases/BE_20.1.rst | 10 ++++----- source/releases/BE_20.7.rst | 36 ++++++++++++++++---------------- source/releases/BE_21.10.rst | 16 +++++++-------- source/releases/BE_21.4.rst | 36 ++++++++++++++++---------------- source/releases/BE_22.10.rst | 40 ++++++++++++++++++------------------ source/releases/BE_22.4.rst | 16 +++++++-------- source/releases/BE_23.10.rst | 8 ++++---- source/releases/BE_23.4.rst | 8 ++++---- source/releases/CE_20.1.rst | 10 ++++----- source/releases/CE_20.7.rst | 36 ++++++++++++++++---------------- source/releases/CE_21.1.rst | 38 +++++++++++++++++----------------- source/releases/CE_21.7.rst | 26 +++++++++++------------ source/releases/CE_22.1.rst | 16 +++++++-------- source/releases/CE_22.7.rst | 30 +++++++++++++-------------- source/releases/CE_23.1.rst | 18 ++++++++-------- source/releases/CE_23.7.rst | 24 +++++++++++----------- 17 files changed, 186 insertions(+), 187 deletions(-) diff --git a/collect_changelogs.py b/collect_changelogs.py index 09731c1b..acdaf39a 100755 --- a/collect_changelogs.py +++ b/collect_changelogs.py @@ -57,7 +57,6 @@ def parse_change_log(payload, this_version, links): all_token_links = dict() first_line = False prelude_line = this_version.count(".") == 1 - rst_content = list() lines = payload.split("\n") for idx, line in enumerate(lines): content_line = None @@ -109,7 +108,7 @@ def parse_change_log(payload, this_version, links): for section in ['content', 'prelude']: for token in all_token_links: target_uri = all_token_links[token] - tmp = all_token_links[token].split(':') + tmp = all_token_links[token].split(':', 1) if tmp[0] in links and len(tmp) == 2: target_uri = links[tmp[0]]['url'] version = tmp[1] @@ -120,8 +119,8 @@ def parse_change_log(payload, this_version, links): version = re.sub(match.group(1), match.group(2), tmp[1], count=count) if target_uri.find('%s') > -1: target_uri = target_uri % version - result[section] = result[section].replace(token, " `%s <%s>`__ " % (token, target_uri)) + return result diff --git a/source/releases/BE_20.1.rst b/source/releases/BE_20.1.rst index f3f660ce..9b3ad262 100644 --- a/source/releases/BE_20.1.rst +++ b/source/releases/BE_20.1.rst @@ -153,11 +153,11 @@ Here are the full patch notes: * src: added Novatel Wireless MiFi 8800/8000 support (contributed by rootless4real) * src: fix pf shared forwarding on non-existing interfaces * src: patch in tty 3wire autologin support -* src: fix insufficient packet length validation in libalias `[1] `__ -* src: fix memory disclosure vulnerability in libalias `[2] `__ -* src: fix improper checking in SCTP-AUTH shared key update `[3] `__ -* src: fix use after free in cryptodev module `[4] `__ -* src: update to tzdata 2020a `[5] `__ +* src: fix insufficient packet length validation in libalias `[1] `__ +* src: fix memory disclosure vulnerability in libalias `[2] `__ +* src: fix improper checking in SCTP-AUTH shared key update `[3] `__ +* src: fix use after free in cryptodev module `[4] `__ +* src: update to tzdata 2020a `[5] `__ * ports: ca_root_nss 3.52 * ports: curl 7.70.0 `[6] `__ * ports: dhcp6c v20200512 diff --git a/source/releases/BE_20.7.rst b/source/releases/BE_20.7.rst index 68fe678f..f388d158 100644 --- a/source/releases/BE_20.7.rst +++ b/source/releases/BE_20.7.rst @@ -81,7 +81,7 @@ Here are the full patch notes: * plugins: os-maltrail fixes sensor start without server (contributed by Julio Camargo) * plugins: os-nginx 1.20 `[2] `__ * plugins: os-tinc fixes for latest version (contributed by vnxme) -* src: fix OpenSSL NULL pointer de-reference `[3] `__ +* src: fix OpenSSL NULL pointer de-reference `[3] `__ * src: fix partial scrub of multicast packages * src: free full mbuf chains in iflib when draining transmit queues * src: initialize oifp to avoid bogus results/panics in edge cases @@ -173,12 +173,12 @@ Here are the full patch notes: * src: improve netmap(4) and vale(4) man pages * src: IPV6_PKTINFO support for v4-mapped IPv6 sockets * src: zero-initialize variables in HBSD PaX SEGVGUARD -* src: fix execve/fexecve system call auditing `[3] `__ -* src: fix uninitialized variable in ipfw `[4] `__ -* src: fix race condition in callout CPU migration `[5] `__ -* src: fix ICMPv6 use-after-free in error message handling `[6] `__ -* src: fix multiple vulnerabilities in rtsold `[7] `__ -* src: update timezone database information `[8] `__ +* src: fix execve/fexecve system call auditing `[3] `__ +* src: fix uninitialized variable in ipfw `[4] `__ +* src: fix race condition in callout CPU migration `[5] `__ +* src: fix ICMPv6 use-after-free in error message handling `[6] `__ +* src: fix multiple vulnerabilities in rtsold `[7] `__ +* src: update timezone database information `[8] `__ * ports: krb5 1.18.3 `[9] `__ * ports: nss 3.59 `[10] `__ * ports: openldap 2.4.56 `[11] `__ @@ -321,13 +321,13 @@ Here are the full patch notes: * plugins: os-theme-vicuna 1.1 (contributed by Team Rebellion) * plugins: os-wireguard 1.3 `[4] `__ * plugins: os-zabbix-agent 1.8 `[5] `__ -* src: fix FreeBSD Linux ABI kernel panic `[6] `__ -* src: fix SCTP socket use-after-free `[7] `__ -* src: fix dhclient heap overflow `[8] `__ -* src: fix ure device driver susceptible to packet-in-packet attack `[9] `__ -* src: fix bhyve privilege escalation via VMCS access `[10] `__ -* src: fix bhyve SVM guest escape `[11] `__ -* src: fix ftpd privilege escalation via ftpchroot `[12] `__ +* src: fix FreeBSD Linux ABI kernel panic `[6] `__ +* src: fix SCTP socket use-after-free `[7] `__ +* src: fix dhclient heap overflow `[8] `__ +* src: fix ure device driver susceptible to packet-in-packet attack `[9] `__ +* src: fix bhyve privilege escalation via VMCS access `[10] `__ +* src: fix bhyve SVM guest escape `[11] `__ +* src: fix ftpd privilege escalation via ftpchroot `[12] `__ * src: set PAX_HARDENING_NOSHLIBRANDOM in the RTLD by default * src: fix kernel panic while trying to read multicast stream * ports: mpd 5.9 `[13] `__ @@ -429,10 +429,10 @@ Here are the full patch notes: * plugins: os-udpbroadcastrelay 1.0 (contributed by Team Rebellion) * src: set the current VNET before calling netisr_dispatch() in ng_iface(4) * src: assorted multicast group join/leave corrections -* src: fix vmx driver packet loss and degraded performance `[4] `__ -* src: fix memory corruption in USB network device driver `[5] `__ -* src: fix multiple vulnerabilities in sqlite `[6] `__ -* src: fix sendmsg(2) privilege escalation `[7] `__ +* src: fix vmx driver packet loss and degraded performance `[4] `__ +* src: fix memory corruption in USB network device driver `[5] `__ +* src: fix multiple vulnerabilities in sqlite `[6] `__ +* src: fix sendmsg(2) privilege escalation `[7] `__ * ports: perl 5.32.0 `[8] `__ * ports: squid 4.12 `[9] `__ diff --git a/source/releases/BE_21.10.rst b/source/releases/BE_21.10.rst index 7307409e..28d4e04b 100644 --- a/source/releases/BE_21.10.rst +++ b/source/releases/BE_21.10.rst @@ -46,9 +46,9 @@ Here are the full patch notes: * plugins: os-telegraf 1.12.4 `[5] `__ * plugins: os-wireguard 1.10 `[6] `__ * src: axgbe: validate contents of gpio expander -* src: incorrect XSAVE state size `[7] `__ -* src: vPCI compatibility improvements with certain Hyper-V releases `[8] `__ -* src: vt console buffer overflow `[9] `__ +* src: incorrect XSAVE state size `[7] `__ +* src: vPCI compatibility improvements with certain Hyper-V releases `[8] `__ +* src: vt console buffer overflow `[9] `__ * ports: expat 2.4.2 `[10] `__ * ports: filterlog 0.6 `[11] `__ * ports: flock 2.37.2 @@ -233,8 +233,8 @@ Here are the full patch notes: * src: aesni: avoid a potential out-of-bounds load in aes_encrypt_icm() * src: axgbe: correctly enable RSS driver support by default * src: ixgbe: prevent subsequent I2C bus read timeouts -* src: fix kernel panic in vmci driver initialization `[16] `__ -* src: timezone database information update `[17] `__ +* src: fix kernel panic in vmci driver initialization `[16] `__ +* src: timezone database information update `[17] `__ * ports: dnspython 2.1.0 `[18] `__ * ports: jinja 3.0.1 `[19] `__ * ports: lighttpd 1.4.61 `[20] `__ @@ -386,9 +386,9 @@ Here are the full patch notes: * src: compatibility shim for upcoming rtsold "-M" command line option * src: dhclient support for VLAN 0 decapsulation * src: dhclient: skip_to_semi() consumes semicolon already -* src: fix libfetch out of bounds read `[15] `__ -* src: fix missing error handling in bhyve(8) device models `[16] `__ -* src: fix remote code execution in ggatec(8) `[17] `__ +* src: fix libfetch out of bounds read `[15] `__ +* src: fix missing error handling in bhyve(8) device models `[16] `__ +* src: fix remote code execution in ggatec(8) `[17] `__ * src: iflib: fix partial length accounting error in netmap mode * src: lib: add libnetmap and related patches * src: rtsold: slightly change address read diff --git a/source/releases/BE_21.4.rst b/source/releases/BE_21.4.rst index f065d995..de24c3d4 100644 --- a/source/releases/BE_21.4.rst +++ b/source/releases/BE_21.4.rst @@ -193,11 +193,11 @@ Here are the full patch notes: * plugins: os-telegraf 1.10.1 `[7] `__ * plugins: os-zabbix4-proxy 1.3 `[8] `__ * plugins: os-zabbix5-proxy 1.5 `[9] `__ -* src: SMAP bypass `[10] `__ -* src: missing message validation in libradius `[11] `__ `[12] `__ -* src: pms data corruption `[13] `__ -* src: libcasper: fix descriptors numbers `[14] `__ -* src: linux: prevent integer overflow in futex_requeue `[15] `__ +* src: SMAP bypass `[10] `__ +* src: missing message validation in libradius `[11] `__ `[12] `__ +* src: pms data corruption `[13] `__ +* src: libcasper: fix descriptors numbers `[14] `__ +* src: linux: prevent integer overflow in futex_requeue `[15] `__ * ports: filterlog 0.4 adds label support to output if applicable * ports: libxml fix for CVE-2021-3541 * ports: nss 3.65 `[16] `__ @@ -272,13 +272,13 @@ Here are the full patch notes: * plugins: os-zabbix5-proxy 1.4 `[10] `__ * src: axgbe: check for IFCAP_VLAN_HWTAGGING when reading descriptor * src: axgbe: add 1000BASE-BX SFP support -* src: accept_filter: fix filter parameter handling `[11] `__ -* src: vm_fault: shoot down multiply mapped COW source page mappings `[12] `__ -* src: mount: disallow mounting over a jail root `[13] `__ +* src: accept_filter: fix filter parameter handling `[11] `__ +* src: vm_fault: shoot down multiply mapped COW source page mappings `[12] `__ +* src: mount: disallow mounting over a jail root `[13] `__ * src: em: add support for Intel I219 V10 device * src: em: fix a null de-reference in em_free_pci_resources * src: bsdinstall: switch to OPNsense branding -* src: race condition in aesni(4) encrypt-then-auth operations `[14] `__ +* src: race condition in aesni(4) encrypt-then-auth operations `[14] `__ * ports: curl 7.77.0 `[15] `__ * ports: dnsmasq 2.85 `[16] `__ * ports: expat 2.4.1 @@ -496,19 +496,19 @@ Here are the full patch notes: * src: netmap tun(4) support adds pseudo addresses to ethernet header emulation (contributed by Sunny Valley Networks) * src: add a manual page for axp(4) / AMD 10G Ethernet driver * src: fix traffic graph not showing bandwidth when IPS is enabled -* src: panic when destroying VNET and epair simultaneously `[16] `__ -* src: uninitialized file system kernel stack leaks `[17] `__ -* src: Xen guest-triggered out of memory `[18] `__ -* src: update timezone database information `[19] `__ -* src: jail: Handle a possible race between jail_remove(2) and fork(2) `[20] `__ -* src: jail: Change both root and working directories in jail_attach(2) `[21] `__ -* src: x86: free microcode memory later `[22] `__ -* src: xen-blkback: fix leak of grant maps on ring setup failure `[23] `__ +* src: panic when destroying VNET and epair simultaneously `[16] `__ +* src: uninitialized file system kernel stack leaks `[17] `__ +* src: Xen guest-triggered out of memory `[18] `__ +* src: update timezone database information `[19] `__ +* src: jail: Handle a possible race between jail_remove(2) and fork(2) `[20] `__ +* src: jail: Change both root and working directories in jail_attach(2) `[21] `__ +* src: x86: free microcode memory later `[22] `__ +* src: xen-blkback: fix leak of grant maps on ring setup failure `[23] `__ * src: rtsold: auto-probe point to point interfaces * src: growfs: update check-hash when doing large filesystem expansions * src: axgbe: change default parameters to prevent manual tunable settings * src: arp: avoid segfaulting due to out-of-bounds memory access -* src: fix multiple OpenSSL vulnerabilities `[24] `__ +* src: fix multiple OpenSSL vulnerabilities `[24] `__ * src: axgbe: enable receive all mode to bypass the MAC filter to avoid dropping CARP MAC addresses * ports: ca_root_nss / nss 3.63 `[25] `__ * ports: curl 7.75.0 `[26] `__ diff --git a/source/releases/BE_22.10.rst b/source/releases/BE_22.10.rst index 02c8ab9c..9039d8b8 100644 --- a/source/releases/BE_22.10.rst +++ b/source/releases/BE_22.10.rst @@ -30,11 +30,11 @@ Here are the full patch notes: * intrusion detection: properly reset metadata response when no metadata is found * unbound: missing global so that cache is never flushed when requested * mvc: cleanse $record input in searchRecordsetBase() before usage -* src: fix multiple OpenSSL vulnerabilities `[1] `__ -* src: geli: split the initalization of HMAC `[2] `__ -* src: fix ena driver crash after reset in 7th gen AWS instance types `[3] `__ -* src: fix sdhci broken write-protect settings `[4] `__ -* src: import tzdata 2022g `[5] `__ +* src: fix multiple OpenSSL vulnerabilities `[1] `__ +* src: geli: split the initalization of HMAC `[2] `__ +* src: fix ena driver crash after reset in 7th gen AWS instance types `[3] `__ +* src: fix sdhci broken write-protect settings `[4] `__ +* src: import tzdata 2022g `[5] `__ * src: x86: ignore stepping for APL30 errata * ports: openssl 1.1.1t `[6] `__ @@ -416,17 +416,17 @@ Here are the full patch notes: * src: pf: ensure that pfiio_name is always nul terminated * src: pf: make sure that pfi_update_status() always zeros counters * src: igc: change default duplex setting -* src: lib9p: remove potential buffer overwrite in l9p_puqids() `[22] `__ -* src: vm_fault: shoot down shared mappings in vm_fault_copy_entry() `[23] `__ -* src: elf_note_prpsinfo: handle more failures from proc_getargv() `[24] `__ -* src: pam_exec: fix segfault when authtok is null `[25] `__ -* src: kevent: fix an off-by-one in filt_timerexpire_l() `[26] `__ -* src: cam: leep periph_links when restoring CCB in camperiphdone() `[27] `__ +* src: lib9p: remove potential buffer overwrite in l9p_puqids() `[22] `__ +* src: vm_fault: shoot down shared mappings in vm_fault_copy_entry() `[23] `__ +* src: elf_note_prpsinfo: handle more failures from proc_getargv() `[24] `__ +* src: pam_exec: fix segfault when authtok is null `[25] `__ +* src: kevent: fix an off-by-one in filt_timerexpire_l() `[26] `__ +* src: cam: leep periph_links when restoring CCB in camperiphdone() `[27] `__ * src: pfctl: fix FOM_ICMP/POM_STICKYADDRESS clash * src: restrict default /root permissions to 750 * src: rc: add ${name}_setup script support -* src: zlib: fix a bug when getting a gzip header extra field with inflate() `[28] `__ -* src: tzdata: import tzdata 2022b and 2022c `[29] `__ +* src: zlib: fix a bug when getting a gzip header extra field with inflate() `[28] `__ +* src: tzdata: import tzdata 2022b and 2022c `[29] `__ * src: FreeBSD 13.1-RELEASE `[30] `__ * src: ifconfig: print interface name on SIOCIFCREATE2 error * src: igc: do not start in promiscuous mode by default @@ -459,19 +459,19 @@ Here are the full patch notes: The following operating system hotfix was issued: * src: vxlan: check the size of data available in mbuf before using them -* src: vm_page: fix a logic error in the handling of PQ_ACTIVE operations `[51] `__ -* src: cam: provide compatibility for CAMGETPASSTHRU for periph drivers `[52] `__ -* src: loader: fix elf lookup_symbol type filtering `[53] `__ -* src: zfs: fix a pair of bugs in zfs_fhtovp() `[54] `__ -* src: zfs: fix use-after-free in btree code `[55] `__ -* src: tcp: finish SACK loss recovery on sudden lack of SACK blocks `[56] `__ +* src: vm_page: fix a logic error in the handling of PQ_ACTIVE operations `[51] `__ +* src: cam: provide compatibility for CAMGETPASSTHRU for periph drivers `[52] `__ +* src: loader: fix elf lookup_symbol type filtering `[53] `__ +* src: zfs: fix a pair of bugs in zfs_fhtovp() `[54] `__ +* src: zfs: fix use-after-free in btree code `[55] `__ +* src: tcp: finish SACK loss recovery on sudden lack of SACK blocks `[56] `__ * src: igc: remove unnecessary PHY ID checks * src: ixl: add support for I710 devices and remove non-inclusive language * src: ixl: fix SR-IOV panics * src: u3g: add more USB IDs * src: ixgbe: workaround errata about UDP frames with zero checksum * src: hpet: Allow a MMIO window smaller than 1K -* src: ping: fix handling of IP packet sizes `[57] `__ +* src: ping: fix handling of IP packet sizes `[57] `__ Known issues and limitations: diff --git a/source/releases/BE_22.4.rst b/source/releases/BE_22.4.rst index 441c6d9a..59b30bc9 100644 --- a/source/releases/BE_22.4.rst +++ b/source/releases/BE_22.4.rst @@ -474,15 +474,15 @@ Here are the full patch notes: * src: hn: disable Hyper-V vSwitch RSC support * src: stand: add EFI support for MMIO serial consoles * src: apei: make sure event data fit into the buffer -* src: openssl: fix a bug in BN_mod_sqrt() that can cause it to loop forever `[14] `__ -* src: zfs: fix handling of errors from dmu_write_uio_dbuf() `[15] `__ +* src: openssl: fix a bug in BN_mod_sqrt() that can cause it to loop forever `[14] `__ +* src: zfs: fix handling of errors from dmu_write_uio_dbuf() `[15] `__ * src: debugnet: remove spurious message on boot -* src: pf(4) tables may fail to load `[16] `__ -* src: potential jail escape vulnerabilities in netmap `[17] `__ -* src: bhyve e82545 device emulation out-of-bounds write `[18] `__ -* src: mpr/mps/mpt driver ioctl heap out-of-bounds write `[19] `__ -* src: 802.11 heap buffer overflow `[20] `__ -* src: zlib compression out-of-bounds write `[21] `__ +* src: pf(4) tables may fail to load `[16] `__ +* src: potential jail escape vulnerabilities in netmap `[17] `__ +* src: bhyve e82545 device emulation out-of-bounds write `[18] `__ +* src: mpr/mps/mpt driver ioctl heap out-of-bounds write `[19] `__ +* src: 802.11 heap buffer overflow `[20] `__ +* src: zlib compression out-of-bounds write `[21] `__ * ports: ca_root_nss fix for faulty upstream file linking * ports: curl 7.81.0 `[22] `__ * ports: dnspython 2.2.1 `[23] `__ diff --git a/source/releases/BE_23.10.rst b/source/releases/BE_23.10.rst index fcee853e..5b56811c 100644 --- a/source/releases/BE_23.10.rst +++ b/source/releases/BE_23.10.rst @@ -252,9 +252,9 @@ Here are the full patch notes: * src: axgbe: enable RSF to prevent zero-length packets while in Netmap mode * src: axgbe: gracefully handle i2c bus failures * src: axgbe: only set CSUM_DONE when IFCAP_RXCSUM enabled -* src: bhyve: fully reset the fwctl state machine if the guest requests a reset `[13] `__ +* src: bhyve: fully reset the fwctl state machine if the guest requests a reset `[13] `__ * src: bnxt: do not restart on VLAN changes -* src: frag6: avoid a possible integer overflow in fragment handling `[14] `__ +* src: frag6: avoid a possible integer overflow in fragment handling `[14] `__ * src: gif: revert in{,6}_gif_output() misalignment handling * src: ice: do not restart on VLAN changes * src: if_vlan: always default to 802.1 @@ -270,10 +270,10 @@ Here are the full patch notes: * src: ixl: add link state polling * src: ixl: port ice's atomic API to ixl * src: libpfctl: ensure the initial allocation is large enough -* src: net80211: fail for unicast traffic without unicast key `[15] `__ +* src: net80211: fail for unicast traffic without unicast key `[15] `__ * src: net: do not overwrite VLAN PCP * src: net: remove VLAN metadata on PCP / VLAN encapsulation -* src: pcib: allocate the memory BAR with the MSI-X table `[16] `__ +* src: pcib: allocate the memory BAR with the MSI-X table `[16] `__ * src: pf: handle multiple IPv6 fragment headers * src: rss: set pin_default_swi to 0 by default * src: rtsol: introduce an 'always' script diff --git a/source/releases/BE_23.4.rst b/source/releases/BE_23.4.rst index 3aab3e17..fa843b6f 100644 --- a/source/releases/BE_23.4.rst +++ b/source/releases/BE_23.4.rst @@ -88,10 +88,10 @@ Here are the full patch notes: * plugins: os-zabbix-proxy plugin variant for Zabbix 6.4 * src: axgbe: account for 4 SFP ports during GPIO expander check * src: ipsec: make algorithm tables read-only -* src: mpr: fix copying of event_mask `[3] `__ -* src: pam_krb5: fix spoofing vulnerability `[4] `__ -* src: loader: comconsole: do not unconditionally wipe out hw.uart.console `[5] `__ -* src: contrib/tzdata: import tzdata 2023c `[6] `__ +* src: mpr: fix copying of event_mask `[3] `__ +* src: pam_krb5: fix spoofing vulnerability `[4] `__ +* src: loader: comconsole: do not unconditionally wipe out hw.uart.console `[5] `__ +* src: contrib/tzdata: import tzdata 2023c `[6] `__ * src: ixgbe: change if condition for RSS and rxcsum * src: pf: fix pf_nv##_array() size check * src: e1000: fix VLAN 0 diff --git a/source/releases/CE_20.1.rst b/source/releases/CE_20.1.rst index f3f660ce..9b3ad262 100644 --- a/source/releases/CE_20.1.rst +++ b/source/releases/CE_20.1.rst @@ -153,11 +153,11 @@ Here are the full patch notes: * src: added Novatel Wireless MiFi 8800/8000 support (contributed by rootless4real) * src: fix pf shared forwarding on non-existing interfaces * src: patch in tty 3wire autologin support -* src: fix insufficient packet length validation in libalias `[1] `__ -* src: fix memory disclosure vulnerability in libalias `[2] `__ -* src: fix improper checking in SCTP-AUTH shared key update `[3] `__ -* src: fix use after free in cryptodev module `[4] `__ -* src: update to tzdata 2020a `[5] `__ +* src: fix insufficient packet length validation in libalias `[1] `__ +* src: fix memory disclosure vulnerability in libalias `[2] `__ +* src: fix improper checking in SCTP-AUTH shared key update `[3] `__ +* src: fix use after free in cryptodev module `[4] `__ +* src: update to tzdata 2020a `[5] `__ * ports: ca_root_nss 3.52 * ports: curl 7.70.0 `[6] `__ * ports: dhcp6c v20200512 diff --git a/source/releases/CE_20.7.rst b/source/releases/CE_20.7.rst index 68fe678f..f388d158 100644 --- a/source/releases/CE_20.7.rst +++ b/source/releases/CE_20.7.rst @@ -81,7 +81,7 @@ Here are the full patch notes: * plugins: os-maltrail fixes sensor start without server (contributed by Julio Camargo) * plugins: os-nginx 1.20 `[2] `__ * plugins: os-tinc fixes for latest version (contributed by vnxme) -* src: fix OpenSSL NULL pointer de-reference `[3] `__ +* src: fix OpenSSL NULL pointer de-reference `[3] `__ * src: fix partial scrub of multicast packages * src: free full mbuf chains in iflib when draining transmit queues * src: initialize oifp to avoid bogus results/panics in edge cases @@ -173,12 +173,12 @@ Here are the full patch notes: * src: improve netmap(4) and vale(4) man pages * src: IPV6_PKTINFO support for v4-mapped IPv6 sockets * src: zero-initialize variables in HBSD PaX SEGVGUARD -* src: fix execve/fexecve system call auditing `[3] `__ -* src: fix uninitialized variable in ipfw `[4] `__ -* src: fix race condition in callout CPU migration `[5] `__ -* src: fix ICMPv6 use-after-free in error message handling `[6] `__ -* src: fix multiple vulnerabilities in rtsold `[7] `__ -* src: update timezone database information `[8] `__ +* src: fix execve/fexecve system call auditing `[3] `__ +* src: fix uninitialized variable in ipfw `[4] `__ +* src: fix race condition in callout CPU migration `[5] `__ +* src: fix ICMPv6 use-after-free in error message handling `[6] `__ +* src: fix multiple vulnerabilities in rtsold `[7] `__ +* src: update timezone database information `[8] `__ * ports: krb5 1.18.3 `[9] `__ * ports: nss 3.59 `[10] `__ * ports: openldap 2.4.56 `[11] `__ @@ -321,13 +321,13 @@ Here are the full patch notes: * plugins: os-theme-vicuna 1.1 (contributed by Team Rebellion) * plugins: os-wireguard 1.3 `[4] `__ * plugins: os-zabbix-agent 1.8 `[5] `__ -* src: fix FreeBSD Linux ABI kernel panic `[6] `__ -* src: fix SCTP socket use-after-free `[7] `__ -* src: fix dhclient heap overflow `[8] `__ -* src: fix ure device driver susceptible to packet-in-packet attack `[9] `__ -* src: fix bhyve privilege escalation via VMCS access `[10] `__ -* src: fix bhyve SVM guest escape `[11] `__ -* src: fix ftpd privilege escalation via ftpchroot `[12] `__ +* src: fix FreeBSD Linux ABI kernel panic `[6] `__ +* src: fix SCTP socket use-after-free `[7] `__ +* src: fix dhclient heap overflow `[8] `__ +* src: fix ure device driver susceptible to packet-in-packet attack `[9] `__ +* src: fix bhyve privilege escalation via VMCS access `[10] `__ +* src: fix bhyve SVM guest escape `[11] `__ +* src: fix ftpd privilege escalation via ftpchroot `[12] `__ * src: set PAX_HARDENING_NOSHLIBRANDOM in the RTLD by default * src: fix kernel panic while trying to read multicast stream * ports: mpd 5.9 `[13] `__ @@ -429,10 +429,10 @@ Here are the full patch notes: * plugins: os-udpbroadcastrelay 1.0 (contributed by Team Rebellion) * src: set the current VNET before calling netisr_dispatch() in ng_iface(4) * src: assorted multicast group join/leave corrections -* src: fix vmx driver packet loss and degraded performance `[4] `__ -* src: fix memory corruption in USB network device driver `[5] `__ -* src: fix multiple vulnerabilities in sqlite `[6] `__ -* src: fix sendmsg(2) privilege escalation `[7] `__ +* src: fix vmx driver packet loss and degraded performance `[4] `__ +* src: fix memory corruption in USB network device driver `[5] `__ +* src: fix multiple vulnerabilities in sqlite `[6] `__ +* src: fix sendmsg(2) privilege escalation `[7] `__ * ports: perl 5.32.0 `[8] `__ * ports: squid 4.12 `[9] `__ diff --git a/source/releases/CE_21.1.rst b/source/releases/CE_21.1.rst index f6169369..119f6751 100644 --- a/source/releases/CE_21.1.rst +++ b/source/releases/CE_21.1.rst @@ -122,8 +122,8 @@ Here are the full patch notes: * plugins: os-telegraf 1.11.0 `[4] `__ * plugins: os-tor Phalcon 4 fix * plugins: os-zabbix5-proxy is now a plugin variant -* src: libcasper: fix descriptors numbers `[5] `__ -* src: linux: prevent integer overflow in futex_requeue `[6] `__ +* src: libcasper: fix descriptors numbers `[5] `__ +* src: linux: prevent integer overflow in futex_requeue `[6] `__ * ports: clog 1.0.2 fixes garbage header write on init * ports: libxml 2.9.12 `[7] `__ * ports: nettle 3.7.3 @@ -186,9 +186,9 @@ Here are the full patch notes: * plugins: os-nginx 1.23 `[1] `__ * plugins: os-wireguard 1.7 `[2] `__ * plugins: os-zabbix4-proxy is now a plugin variant -* src: SMAP bypass `[3] `__ -* src: missing message validation in libradius `[4] `__ `[5] `__ -* src: pms data corruption `[6] `__ +* src: SMAP bypass `[3] `__ +* src: missing message validation in libradius `[4] `__ `[5] `__ +* src: pms data corruption `[6] `__ * ports: curl 7.77.0 `[7] `__ * ports: isc-dhcp 4.4.2-P1 `[8] `__ * ports: nss 3.66 `[9] `__ @@ -262,7 +262,7 @@ Here are the full patch notes: * plugins: os-zabbix5-proxy 1.5 `[9] `__ * src: axgbe: check for IFCAP_VLAN_HWTAGGING when reading descriptor * src: axgbe: add 1000BASE-BX SFP support -* src: race condition in aesni(4) encrypt-then-auth operations `[10] `__ +* src: race condition in aesni(4) encrypt-then-auth operations `[10] `__ * ports: curl 7.76.1 `[11] `__ * ports: expat 2.4.1 * ports: filterlog 0.4 adds label support to output if applicable @@ -342,9 +342,9 @@ Here are the full patch notes: * plugins: os-wireguard 1.6 `[9] `__ * plugins: os-zabbix5-proxy 1.4 `[10] `__ * src: axgbe: enable receive all mode to bypass the MAC filter to avoid dropping CARP MAC addresses -* src: accept_filter: fix filter parameter handling `[11] `__ -* src: vm_fault: shoot down multiply mapped COW source page mappings `[12] `__ -* src: mount: disallow mounting over a jail root `[13] `__ +* src: accept_filter: fix filter parameter handling `[11] `__ +* src: vm_fault: shoot down multiply mapped COW source page mappings `[12] `__ +* src: mount: disallow mounting over a jail root `[13] `__ * src: em: add support for Intel I219 V10 device * src: em: fix a null de-reference in em_free_pci_resources * src: bsdinstall: switch to OPNsense branding @@ -419,7 +419,7 @@ Here are the full patch notes: * plugins: os-theme-vicuna 1.4 (contributed by Team Rebellion) * plugins: os-wireguard 1.5 `[5] `__ * plugins: os-wol 2.4 fixes dashboard widget (contributed by kulikov-a) -* src: fix multiple OpenSSL vulnerabilities `[6] `__ +* src: fix multiple OpenSSL vulnerabilities `[6] `__ * ports: ca_root_nss / nss 3.63 `[7] `__ * ports: libressl 3.2.5 `[8] `__ * ports: openldap 2.4.58 `[9] `__ @@ -482,10 +482,10 @@ Here are the full patch notes: * plugins: os-haproxy 3.0 `[1] `__ * plugins: os-nginx 1.21 `[2] `__ * plugins: os-node_exporter 1.1 `[3] `__ -* src: jail: Handle a possible race between jail_remove(2) and fork(2) `[4] `__ -* src: jail: Change both root and working directories in jail_attach(2) `[5] `__ -* src: x86: free microcode memory later `[6] `__ -* src: xen-blkback: fix leak of grant maps on ring setup failure `[7] `__ +* src: jail: Handle a possible race between jail_remove(2) and fork(2) `[4] `__ +* src: jail: Change both root and working directories in jail_attach(2) `[5] `__ +* src: x86: free microcode memory later `[6] `__ +* src: xen-blkback: fix leak of grant maps on ring setup failure `[7] `__ * src: rtsold: auto-probe point to point interfaces * src: growfs: update check-hash when doing large filesystem expansions * src: axgbe: change default parameters to prevent manual tunable settings @@ -601,10 +601,10 @@ Here are the full patch notes: * plugins: os-nginx upstream TLS verification fix (contributed by kulikov-a) * plugins: os-theme-cicada 1.26 (contributed by Team Rebellion) * plugins: os-theme-vicuna 1.2 (contributed by Team Rebellion) -* src: panic when destroying VNET and epair simultaneously `[1] `__ -* src: uninitialized file system kernel stack leaks `[2] `__ -* src: Xen guest-triggered out of memory `[3] `__ -* src: update timezone database information `[4] `__ +* src: panic when destroying VNET and epair simultaneously `[1] `__ +* src: uninitialized file system kernel stack leaks `[2] `__ +* src: Xen guest-triggered out of memory `[3] `__ +* src: update timezone database information `[4] `__ * ports: dnsmasq 2.84 `[5] `__ * ports: lighttpd 1.4.59 `[6] `__ * ports: krb5 1.19 `[7] `__ @@ -853,7 +853,7 @@ Here are the full patch notes against 20.7.7_1: * ui: move sidebar stage from session to local storage * plugins: os-bind 1.15 `[2] `__ * plugins: os-frr 1.21 `[3] `__ -* src: fix OpenSSL NULL pointer de-reference `[4] `__ +* src: fix OpenSSL NULL pointer de-reference `[4] `__ * src: fix AES-CCM requests with an AAD size smaller than a single block * src: introduce HARDEN_KLD to ensure DTrace functionality * src: fix partial scrub of multicast packages diff --git a/source/releases/CE_21.7.rst b/source/releases/CE_21.7.rst index 05dd9228..8c229bd2 100644 --- a/source/releases/CE_21.7.rst +++ b/source/releases/CE_21.7.rst @@ -68,9 +68,9 @@ Here are the full patch notes: * plugins: os-telegraf 1.12.4 `[5] `__ * plugins: os-wireguard 1.10 `[6] `__ * src: axgbe: validate contents of gpio expander -* src: incorrect XSAVE state size `[7] `__ -* src: vPCI compatibility improvements with certain Hyper-V releases `[8] `__ -* src: vt console buffer overflow `[9] `__ +* src: incorrect XSAVE state size `[7] `__ +* src: vPCI compatibility improvements with certain Hyper-V releases `[8] `__ +* src: vt console buffer overflow `[9] `__ * ports: expat 2.4.2 `[10] `__ * ports: filterlog 0.6 `[11] `__ * ports: flock 2.37.2 @@ -254,8 +254,8 @@ Here are the full patch notes for version 21.7.5: * plugins: os-wireguard 1.8 `[12] `__ * src: axgbe: correctly enable RSS driver support by default * src: ixgbe: prevent subsequent I2C bus read timeouts -* src: fix kernel panic in vmci driver initialization `[13] `__ -* src: timezone database information update `[14] `__ +* src: fix kernel panic in vmci driver initialization `[13] `__ +* src: timezone database information update `[14] `__ * ports: lighttpd 1.4.61 `[15] `__ * ports: nss 3.72 `[16] `__ * ports: openssh 8.8p1 `[17] `__ @@ -471,10 +471,10 @@ Here are the full patch notes: * src: lib: add libnetmap and related patches * src: dhclient: skip_to_semi() consumes semicolon already * src: rtsold: slightly change address read -* src: fix missing error handling in bhyve(8) device models `[3] `__ -* src: fix remote code execution in ggatec(8) `[4] `__ -* src: fix libfetch out of bounds read `[5] `__ -* src: fix multiple OpenSSL vulnerabilities `[6] `__ `[7] `__ +* src: fix missing error handling in bhyve(8) device models `[3] `__ +* src: fix remote code execution in ggatec(8) `[4] `__ +* src: fix libfetch out of bounds read `[5] `__ +* src: fix multiple OpenSSL vulnerabilities `[6] `__ `[7] `__ * ports: ifinfo 13.0 * ports: libressl 3.3.4 `[8] `__ * ports: nss 3.69 `[9] `__ @@ -684,8 +684,8 @@ Here are the full patch notes: * src: FreeBSD updates for Intel e1000, ixgbe and ixl drivers * src: compatibility shim for upcoming rtsold "-M" command line option * src: separately log NAT and firewall rules in pf(4) -* src: libcasper: fix descriptors numbers `[12] `__ -* src: linux: prevent integer overflow in futex_requeue `[13] `__ +* src: libcasper: fix descriptors numbers `[12] `__ +* src: linux: prevent integer overflow in futex_requeue `[13] `__ * src: axgbe: make sure driver works on V1000 platform and remove unnecessary reset * ports: drop hardening options to ease migration to FreeBSD ports tree * ports: clog 1.0.2 fixes garbage header write on init @@ -778,8 +778,8 @@ Here are the full patch notes: * plugins: os-tor Phalcon 4 fix * plugins: os-zabbix-agent 1.9 `[4] `__ * src: separately log NAT and firewall rules in pf(4) -* src: libcasper: fix descriptors numbers `[5] `__ -* src: linux: prevent integer overflow in futex_requeue `[6] `__ +* src: libcasper: fix descriptors numbers `[5] `__ +* src: linux: prevent integer overflow in futex_requeue `[6] `__ * ports: clog 1.0.2 fixes garbage header write on init * ports: php 7.4.21 `[7] `__ * ports: suricata 5.0.7 `[8] `__ diff --git a/source/releases/CE_22.1.rst b/source/releases/CE_22.1.rst index 68ce4365..f819b50d 100644 --- a/source/releases/CE_22.1.rst +++ b/source/releases/CE_22.1.rst @@ -314,12 +314,12 @@ Here are the full patch notes: * plugins: os-acme-client 3.9 `[1] `__ * plugins: os-chrony 1.5 `[2] `__ * plugins: os-ddclient 1.5 `[3] `__ -* src: pf(4) tables may fail to load `[4] `__ -* src: potential jail escape vulnerabilities in netmap `[5] `__ -* src: bhyve e82545 device emulation out-of-bounds write `[6] `__ -* src: mpr/mps/mpt driver ioctl heap out-of-bounds write `[7] `__ -* src: 802.11 heap buffer overflow `[8] `__ -* src: zlib compression out-of-bounds write `[9] `__ +* src: pf(4) tables may fail to load `[4] `__ +* src: potential jail escape vulnerabilities in netmap `[5] `__ +* src: bhyve e82545 device emulation out-of-bounds write `[6] `__ +* src: mpr/mps/mpt driver ioctl heap out-of-bounds write `[7] `__ +* src: 802.11 heap buffer overflow `[8] `__ +* src: zlib compression out-of-bounds write `[9] `__ * ports: curl 7.82.0 `[10] `__ * ports: expat 2.4.8 `[11] `__ * ports: libxml 2.9.13 `[12] `__ @@ -366,8 +366,8 @@ Here are the full patch notes: * plugins: os-ddclient 1.4 `[1] `__ * plugins: os-theme-cicada 1.29 * plugins: os-theme-vicuna 1.41 -* src: openssl: fix a bug in BN_mod_sqrt() that can cause it to loop forever `[2] `__ -* src: zfs: fix handling of errors from dmu_write_uio_dbuf() `[3] `__ +* src: openssl: fix a bug in BN_mod_sqrt() that can cause it to loop forever `[2] `__ +* src: zfs: fix handling of errors from dmu_write_uio_dbuf() `[3] `__ * src: debugnet: remove spurious message on boot * ports: ca_root_nss fix for faulty upstream file linking * ports: libressl 3.3.6 `[4] `__ diff --git a/source/releases/CE_22.7.rst b/source/releases/CE_22.7.rst index b60d882e..58375578 100644 --- a/source/releases/CE_22.7.rst +++ b/source/releases/CE_22.7.rst @@ -146,7 +146,7 @@ Here are the full patch notes: * plugins: os-wireguard now attempts to start tunnels again when all DNS is configured * src: ixgbe: workaround errata about UDP frames with zero checksum * src: hpet: Allow a MMIO window smaller than 1K -* src: ping: fix handling of IP packet sizes `[3] `__ +* src: ping: fix handling of IP packet sizes `[3] `__ * ports: php 8.0.26 `[4] `__ * ports: sqlite 3.40.0 `[5] `__ * ports: suricata 6.0.9 `[6] `__ @@ -268,12 +268,12 @@ Here are the full patch notes: * plugins: os-wireguard 1.13 `[8] `__ * src: revert "e1000: try auto-negotiation for fixed 100 or 10 configuration" * src: vxlan: check the size of data available in mbuf before using them -* src: vm_page: fix a logic error in the handling of PQ_ACTIVE operations `[9] `__ -* src: cam: provide compatibility for CAMGETPASSTHRU for periph drivers `[10] `__ -* src: loader: fix elf lookup_symbol type filtering `[11] `__ -* src: zfs: fix a pair of bugs in zfs_fhtovp() `[12] `__ -* src: zfs: fix use-after-free in btree code `[13] `__ -* src: tcp: finish SACK loss recovery on sudden lack of SACK blocks `[14] `__ +* src: vm_page: fix a logic error in the handling of PQ_ACTIVE operations `[9] `__ +* src: cam: provide compatibility for CAMGETPASSTHRU for periph drivers `[10] `__ +* src: loader: fix elf lookup_symbol type filtering `[11] `__ +* src: zfs: fix a pair of bugs in zfs_fhtovp() `[12] `__ +* src: zfs: fix use-after-free in btree code `[13] `__ +* src: tcp: finish SACK loss recovery on sudden lack of SACK blocks `[14] `__ * src: igc: remove unnecessary PHY ID checks * src: ixl: add support for I710 devices and remove non-inclusive language * src: ixl: fix SR-IOV panics @@ -518,8 +518,8 @@ Here are the full patch notes: * plugins: os-zabbix-agent 1.13 `[3] `__ * plugins: os-zabbix-proxy 1.9 `[4] `__ * src: rc: improve NAME_setup integration -* src: zlib: fix a bug when getting a gzip header extra field with inflate() `[5] `__ -* src: tzdata: import tzdata 2022b and 2022c `[6] `__ +* src: zlib: fix a bug when getting a gzip header extra field with inflate() `[5] `__ +* src: tzdata: import tzdata 2022b and 2022c `[6] `__ * ports: ldns 1.8.3 `[7] `__ * ports: liblz4 1.9.4 * ports: libxml 2.10.1 `[8] `__ @@ -565,12 +565,12 @@ Here are the full patch notes: * plugins: os-haproxy 3.11 `[4] `__ * plugins: os-git-backup hides SSH keys by default * plugins: os-postfix disables GSSAPI for the time being `[5] `__ -* src: lib9p: remove potential buffer overwrite in l9p_puqids() `[6] `__ -* src: vm_fault: shoot down shared mappings in vm_fault_copy_entry() `[7] `__ -* src: elf_note_prpsinfo: handle more failures from proc_getargv() `[8] `__ -* src: pam_exec: fix segfault when authtok is null `[9] `__ -* src: kevent: fix an off-by-one in filt_timerexpire_l() `[10] `__ -* src: cam: leep periph_links when restoring CCB in camperiphdone() `[11] `__ +* src: lib9p: remove potential buffer overwrite in l9p_puqids() `[6] `__ +* src: vm_fault: shoot down shared mappings in vm_fault_copy_entry() `[7] `__ +* src: elf_note_prpsinfo: handle more failures from proc_getargv() `[8] `__ +* src: pam_exec: fix segfault when authtok is null `[9] `__ +* src: kevent: fix an off-by-one in filt_timerexpire_l() `[10] `__ +* src: cam: leep periph_links when restoring CCB in camperiphdone() `[11] `__ * src: pfctl: fix FOM_ICMP/POM_STICKYADDRESS clash * src: restrict default /root permissions to 750 * src: rc: add ${name}_setup script support diff --git a/source/releases/CE_23.1.rst b/source/releases/CE_23.1.rst index cd021345..ba6413ed 100644 --- a/source/releases/CE_23.1.rst +++ b/source/releases/CE_23.1.rst @@ -57,10 +57,10 @@ Here are the full patch notes: * plugins: os-zabbix-proxy plugin variant for Zabbix 6.4 * src: axgbe: account for 4 SFP ports during GPIO expander check * src: ipsec: make algorithm tables read-only -* src: mpr: fix copying of event_mask `[1] `__ -* src: pam_krb5: fix spoofing vulnerability `[2] `__ -* src: loader: comconsole: do not unconditionally wipe out hw.uart.console `[3] `__ -* src: contrib/tzdata: import tzdata 2023c `[4] `__ +* src: mpr: fix copying of event_mask `[1] `__ +* src: pam_krb5: fix spoofing vulnerability `[2] `__ +* src: loader: comconsole: do not unconditionally wipe out hw.uart.console `[3] `__ +* src: contrib/tzdata: import tzdata 2023c `[4] `__ * src: ixgbe: change if condition for RSS and rxcsum * src: pf: fix pf_nv##_array() size check * src: e1000: fix VLAN 0 @@ -556,7 +556,7 @@ Here are the full patch notes: * plugins: os-theme-cicada 1.33 (contributed by Team Rebellion) * plugins: os-theme-tukan 1.26 (contributed by Team Rebellion) * plugins: os-theme-vicuna 1.44 (contributed by Team Rebellion) -* src: fix multiple OpenSSL vulnerabilities `[4] `__ +* src: fix multiple OpenSSL vulnerabilities `[4] `__ * src: pfsync: support deferring IPv6 packets * src: pfsync: add missing bucket lock * src: pfsync: ensure 'error' is always initialised @@ -637,10 +637,10 @@ Here are the full patch notes: * plugins: os-qemu-guest-agent 1.2 `[3] `__ * plugins: os-tayga fixes MVC interface registration * plugins: os-wireguard fixes MVC interface registration -* src: geli: split the initalization of HMAC `[4] `__ -* src: fix ena driver crash after reset in 7th gen AWS instance types `[5] `__ -* src: fix sdhci broken write-protect settings `[6] `__ -* src: import tzdata 2022g `[7] `__ +* src: geli: split the initalization of HMAC `[4] `__ +* src: fix ena driver crash after reset in 7th gen AWS instance types `[5] `__ +* src: fix sdhci broken write-protect settings `[6] `__ +* src: import tzdata 2022g `[7] `__ * src: ipsec: clear pad bytes in PF_KEY messages * src: fib_algo: set vnet when destroying algo instance * src: if_ipsec: handle situations where there are no policy or SADB entry for if diff --git a/source/releases/CE_23.7.rst b/source/releases/CE_23.7.rst index 2d0ee838..6d8ea593 100644 --- a/source/releases/CE_23.7.rst +++ b/source/releases/CE_23.7.rst @@ -62,17 +62,17 @@ Here are the full patch notes: * plugins: os-upnp now reloads on newwanip event * plugins: os-wireguard fix for missing firewall reload * plugins: os-wireguard-go fix for device registration -* src: clang: sanitizer failure with ASLR enabled `[3] `__ +* src: clang: sanitizer failure with ASLR enabled `[3] `__ * src: dhclient: do not add 0.0.0.0 interface alias * src: ice: match irdma interface changes * src: ixv: separate VFTA table for each interface * src: libnetmap: better fix for port parsing failure * src: pf: expose more syncookie state information to userspace * src: pf: fix mem leaks upon vnet destroy -* src: pf: remove incorrect fragmentation check `[4] `__ +* src: pf: remove incorrect fragmentation check `[4] `__ * src: rc: fix restart _precmd issue with _setup * src: re: add support for 8168FP HW rev -* src: zfs: check dnode and its data for dirtiness in dnode_is_dirty() `[5] `__ +* src: zfs: check dnode and its data for dirtiness in dnode_is_dirty() `[5] `__ * ports: perl 5.36.3 `[6] `__ * ports: php 8.2.13 `[7] `__ * ports: phpseclib 3.0.34 `[8] `__ @@ -203,11 +203,11 @@ Here are the full patch notes: * plugins: os-wireguard 2.5 `[3] `__ * src: pfctl: fix incorrect mask on dynamic address * src: libpfctl: assorted improvements -* src: msdosfs: zero partially valid extended cluster `[4] `__ -* src: copy_file_range: require CAP_SEEK capability `[5] `__ -* src: fflush: correct buffer handling in __sflush `[6] `__ -* src: cap_net: correct capability name from addr2name to name2addr `[7] `__ -* src: regcomp: use unsigned char when testing for escapes `[8] `__ +* src: msdosfs: zero partially valid extended cluster `[4] `__ +* src: copy_file_range: require CAP_SEEK capability `[5] `__ +* src: fflush: correct buffer handling in __sflush `[6] `__ +* src: cap_net: correct capability name from addr2name to name2addr `[7] `__ +* src: regcomp: use unsigned char when testing for escapes `[8] `__ * ports: lighttpd 1.4.73 `[9] `__ * ports: php 8.2.12 `[10] `__ * ports: squid 6.5 `[11] `__ @@ -529,8 +529,8 @@ Here are the full patch notes: * src: iflib: fix white space and reduce some line lengths * src: ixgbe: define IXGBE_LE32_TO_CPUS * src: ixgbe: check for fw_recovery -* src: net80211: fail for unicast traffic without unicast key `[4] `__ -* src: pcib: allocate the memory BAR with the MSI-X table `[5] `__ +* src: net80211: fail for unicast traffic without unicast key `[4] `__ +* src: pcib: allocate the memory BAR with the MSI-X table `[5] `__ * ports: php 8.2.10 `[6] `__ * ports: python 3.9.18 `[7] `__ * ports: unbound 1.18.0 `[8] `__ @@ -677,8 +677,8 @@ Here are the full patch notes: * mvc: fix empty item selection issue in BaseListField * plugins: os-ddclient 1.14 `[1] `__ * plugins: os-acme-client 3.19 `[2] `__ -* src: bhyve: fully reset the fwctl state machine if the guest requests a reset `[3] `__ -* src: frag6: avoid a possible integer overflow in fragment handling `[4] `__ +* src: bhyve: fully reset the fwctl state machine if the guest requests a reset `[3] `__ +* src: frag6: avoid a possible integer overflow in fragment handling `[4] `__ * src: amdtemp: Fix missing 49 degree offset on current EPYC CPUs * src: libpfctl: ensure the initial allocation is large enough * src: pf: handle multiple IPv6 fragment headers