For errata on a certain release, click below:
2.0,
2.1,
2.2,
2.3,
2.4,
2.5,
2.6,
2.7,
2.8,
2.9,
3.0,
3.1,
3.2,
3.3,
3.4,
3.5,
3.6,
3.7,
3.8,
3.9,
4.0,
4.1,
4.2,
4.3,
4.4,
4.5,
4.6,
4.7,
4.8,
4.9,
5.0,
5.1,
5.2,
5.3,
5.4,
5.5,
5.6,
5.7,
5.8,
5.9,
6.0,
6.1,
6.2,
6.3,
6.4,
6.5,
6.6,
6.7,
6.8,
6.9,
7.1,
7.2,
7.3,
7.4,
7.5,
7.6.
Patches for the OpenBSD base system are distributed as unified diffs.
Each patch is cryptographically signed with the
signify(1) tool and contains
usage instructions.
All the following patches are also available in one
tar.gz file
for convenience.
Alternatively, the syspatch(8)
utility can be used to apply binary updates on the following architectures:
amd64, i386, arm64.
Patches for supported releases are also incorporated into the
-stable branch.
-
001: RELIABILITY FIX: October 31, 2021
All architectures
In certain configurations, nsd(8) can be crashed by a remote attacker.
A source code patch exists which remedies this problem.
-
002: RELIABILITY FIX: October 31, 2021
All architectures
Opening /dev/bpf too often could lead to resource exhaustion.
A source code patch exists which remedies this problem.
-
003: SECURITY FIX: October 31, 2021
All architectures
The kernel could leak memory when closing unix sockets.
A source code patch exists which remedies this problem.
-
004: SECURITY FIX: November 9, 2021
All architectures
rpki-client(8) should handle CA misbehaviours as soft-errors.
A source code patch exists which remedies this problem.
-
005: RELIABILITY FIX: November 26, 2021
All architectures
An unprivileged user could crash the kernel by using UNIX-domain
sockets in multiple threads.
A source code patch exists which remedies this problem.
-
006: SECURITY FIX: November 26, 2021
All architectures
In some situations the X.509 verifier would discard an error on
an unverified certificate chain, resulting in an authentication bypass.
A source code patch exists which remedies this problem.
-
007: SECURITY FIX: December 14, 2021
All architectures
Multiple input validation failures in the X server request parsing
code can lead to out of bounds memory accesses for authorized
clients.
A source code patch exists which remedies this problem.
-
008: SECURITY FIX: December 16, 2021
All architectures
If multicast routing is used, kernel memory is leaked to userland.
A source code patch exists which remedies this problem.
-
009: SECURITY FIX: January 19, 2022
All architectures
Fix 8 security issues in libexpat, all related to fixed-size integer
math (integer overflow and invalid shifts) near memory allocation.
A source code patch exists which remedies this problem.
-
010: RELIABILITY FIX: January 19, 2022
amd64
Intel-based vmm(4) hosts may have vm processes die due to host-side
state corruption.
A source code patch exists which remedies this problem.
-
011: SECURITY FIX: January 24, 2022
macppc
On PowerPC kernel memory is leaked to userland.
A source code patch exists which remedies this problem.
-
012: RELIABILITY FIX: February 2, 2022
amd64 i386
Userspace controlled code on GPU can access kernel memory on Intel
gen 8 and later GPUs.
A source code patch exists which remedies this problem.
-
013: SECURITY FIX: February 2, 2022
All architectures
Fix two security issues in libexpat related to integer overflow.
A source code patch exists which remedies this problem.
-
014: SECURITY FIX: February 21, 2022
All architectures
More than 7 nameservers in an IPv6 router advertisement could crash slaacd.
A source code patch exists which remedies this problem.
-
015: SECURITY FIX: February 24, 2022
All architectures
Fix five security issues in libexpat related to encoding, stack
exhaustion, and integer overflow.
A source code patch exists which remedies this problem.
-
016: SECURITY FIX: March 15, 2022
All architectures
A malicious certificate can cause an infinite loop.
A source code patch exists which remedies this problem.
-
017: SECURITY FIX: March 22, 2022
All architectures
A malicious router advertisement could overflow heap memory in
unprivileged slaacd process.
A source code patch exists which remedies this problem.
-
018: SECURITY FIX: April 1, 2022
All architectures
Memory corruption in zlib can lead to a crash.
A source code patch exists which remedies this problem.
-
019: SECURITY FIX: April 5, 2022
All architectures
Fix zlib vulnerability in PPP and IPComp compression.
A source code patch exists which remedies this problem.
-
020: RELIABILITY FIX: April 11, 2022
All architectures
rpki-client(8) handled time zones incorrectly.
A source code patch exists which remedies this problem.
-
021: SECURITY FIX: May 16, 2022
All architectures
Malicious PPPoE packets could corrupt kernel memory.
A source code patch exists which remedies this problem.
-
022: SECURITY FIX: July 24, 2022
All architectures
Input validation failures in the X server request parsing code can
lead to out of bounds memory accesses for authorized clients.
A source code patch exists which remedies this problem.
-
023: RELIABILITY FIX: July 24, 2022
All architectures
cron(8) aborted due to strange poll timevals.
A source code patch exists which remedies this problem.
-
024: SECURITY FIX: August 12, 2022
All architectures
A missing length check in zlib could lead to a heap buffer overflow.
A source code patch exists which remedies this problem.
-
025: SECURITY FIX: September 23, 2022
All architectures
In libexpat fix heap use-after-free vulnerability CVE-2022-40674.
A source code patch exists which remedies this problem.
-
026: SECURITY FIX: September 26, 2022
All architectures
In smtpd(8), possible use-after-free if TLS handshake fails for
outbound connections.
A source code patch exists which remedies this problem.