From 629b934929433e4c86003c9980b7ecfd28001e53 Mon Sep 17 00:00:00 2001 From: Glen Barber Date: Tue, 21 Jan 2014 07:02:44 +0000 Subject: [PATCH] Regen after mention of capsicum enabled by default. Sponsored by: The FreeBSD Foundation --- en_US.ISO8859-1/htdocs/releases/10.0R/relnotes.html | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/en_US.ISO8859-1/htdocs/releases/10.0R/relnotes.html b/en_US.ISO8859-1/htdocs/releases/10.0R/relnotes.html index 19dc044a4f..09197322ca 100644 --- a/en_US.ISO8859-1/htdocs/releases/10.0R/relnotes.html +++ b/en_US.ISO8859-1/htdocs/releases/10.0R/relnotes.html @@ -1,5 +1,5 @@ -FreeBSD 10.0-RELEASE Release Notes

FreeBSD 10.0-RELEASE Release Notes

The FreeBSD Project

FreeBSD 10.0-RELEASE Release Notes

The FreeBSD Project

FreeBSD is a registered trademark of the FreeBSD Foundation.

IBM, AIX, OS/2, PowerPC, PS/2, S/390, and ThinkPad are @@ -52,7 +52,9 @@ advisories available from FreeBSD Security Information.

AdvisoryDateTopic
SA-13:14.openssh19 November 2013

OpenSSH AES-GCM memory corruption - vulnerability

SA-14:01.bsnmpd14 January 2014

bsnmpd remote denial of service vulnerability

SA-14:02.ntpd14 January 2014

ntpd distributed reflection Denial of Service vulnerability

SA-14:03.openssl14 January 2014

OpenSSL multiple vulnerabilities

SA-14:04.bind14 January 2014

BIND remote denial of service vulnerability

2.2. Kernel Changes

The use of unmapped VMIO buffers + vulnerability

SA-14:01.bsnmpd14 January 2014

bsnmpd remote denial of service vulnerability

SA-14:02.ntpd14 January 2014

ntpd distributed reflection Denial of Service vulnerability

SA-14:03.openssl14 January 2014

OpenSSL multiple vulnerabilities

SA-14:04.bind14 January 2014

BIND remote denial of service vulnerability

2.2. Kernel Changes

Capsicum has been enabled in the kernel by default, allowing + sandboxing of several programs that work within the + capabilities mode.

The use of unmapped VMIO buffers eliminates the need to perform TLB shootdown for mapping on buffer creation and reuse, greatly reducing the amount of IPIs for shootdown on big-SMP machines and eliminating up to 25-30%