Add today's advisories.

Approved by: so Sponsored by: The FreeBSD Foundation
svn path=/head/; revision=51632
2018-05-08 17:24:52 +00:00 · 2018-05-08 17:24:52 +00:00 · 73d16f03cd · 2020-12-08 03:00:23 +00:00
commit 73d16f03cd
parent 1a92f8ff7f
15 changed files with 2297 additions and 0 deletions
--- a/share/security/advisories/FreeBSD-EN-18:05.mem.asc
+++ b/share/security/advisories/FreeBSD-EN-18:05.mem.asc
@ -0,0 +1,152 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 =============================================================================
 FreeBSD-EN-18:05.mem                                            Errata Notice
                                                          The FreeBSD Project
 Topic:          Multiple small kernel memory disclosures
 Category:       core
 Module:         kernel
 Announced:      2018-05-08
 Credits:        Ilja van Sprundel, IOActive
                Vlad Tsyrklevich
 Affects:        All supported versions of FreeBSD.
 Corrected:      2018-04-08 20:50:16 UTC (stable/11, 11.1-STABLE)
                2018-05-08 17:14:54 UTC (releng/11.1, 11.1-RELEASE-p10)
                2018-04-09 12:55:09 UTC (stable/10, 10.4-STABLE)
                2018-05-08 17:14:54 UTC (releng/10.4, 10.4-RELEASE-p9)
 CVE Name:       CVE-2018-6920, CVE-2018-6921
 For general information regarding FreeBSD Errata Notices and Security
 Advisories, including descriptions of the fields above, security
 branches, and the following sections, please visit
 <URL:https://security.FreeBSD.org/>.
 I.   Background
 FreeBSD includes drivers for Atheros wireless interfaces, a TCP network
 stack, and the ability to execute Linux binaries.
 II.  Problem Description
 Due to insufficient initialization of memory copied to userland in the
 components described above small amounts of kernel memory may be disclosed
 to userland processes.
 The disclosure in the Atheros wireless driver and Linux subsystem applies to
 both FreeBSD 10.x and 11.x (CVE-2018-6920).
 The disclosure in the TCP network stack was introduced in 11.0.  As such,
 only FreeBSD 11.x is affected by this issue (CVE-2018-6921).
 III. Impact
 A user who can access these drivers, use TCP sockets, or execute Linux
 binaries may be able to read the contents of small portions of kernel memory.
 Such memory might contain sensitive information, such as portions of the file
 cache or terminal buffers.  This information might be directly useful, or it
 might be leveraged to obtain elevated privileges in some way; for example,
 a terminal buffer might include a user-entered password.
 IV.  Workaround
 No workaround is available.
 V.   Solution
 Perform one of the following:
 1) Upgrade your system to a supported FreeBSD stable or release / security
 branch (releng) dated after the correction date.
 Afterward, reboot the system.
 2) To update your system via a binary patch:
 Systems running a RELEASE version of FreeBSD on the i386 or amd64
 platforms can be updated via the freebsd-update(8) utility:
 # freebsd-update fetch
 # freebsd-update install
 Afterward, reboot the system.
 3) To update your system via a source code patch:
 The following patches have been verified to apply to the applicable
 FreeBSD release branches.
 a) Download the relevant patch from the location below, and verify the
 detached PGP signature using your PGP utility.
 [FreeBSD 11.1]
 # fetch https://security.FreeBSD.org/patches/EN-18:05/mem.11.1.patch
 # fetch https://security.FreeBSD.org/patches/EN-18:05/mem.11.1.patch.asc
 # gpg --verify mem.11.1.patch.asc
 [FreeBSD 10.4]
 # fetch https://security.FreeBSD.org/patches/EN-18:05/mem.10.4.patch
 # fetch https://security.FreeBSD.org/patches/EN-18:05/mem.10.4.patch.asc
 # gpg --verify mem.10.4.patch.asc
 b) Apply the patch.  Execute the following commands as root:
 # cd /usr/src
 # patch < /path/to/patch
 c) Recompile your kernel as described in
 <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
 system.
 VI.  Correction details
 The following list contains the correction revision numbers for each
 affected branch.
 Branch/path                                                      Revision
 - -------------------------------------------------------------------------
 stable/10/                                                        r332321
 releng/10.4/                                                      r333372
 stable/11/                                                        r332303
 releng/11.1/                                                      r333372
 - -------------------------------------------------------------------------
 To see which files were modified by a particular revision, run the
 following command, replacing NNNNNN with the revision number, on a
 machine with Subversion installed:
 # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
 Or visit the following URL, replacing NNNNNN with the revision number:
 <URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
 VII. References
 <URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6920>
 <URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6921>
 The latest revision of this advisory is available at
 <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-18:05.mem.asc>
 -----BEGIN PGP SIGNATURE-----
 iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrx3F5fFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
 MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
 5cLEJw/+O78dItjByrV33QHG6FG99Sk2tMvYJaD5jmM7qUiV2TiumFz4n8a3IjDe
 kEmH68jkHxkSvWHvpOKMYx/CzzGG1UkMQvrFseGO6d/azZMqY4V3WqXeKcD6lwLI
 qggFdIBDr2ltGQ19jLuD8ucfuyC8DurdhiEzn1s7e2YjpPaCgNSc9kHf/+Ez/MBu
 v9ozlq/uS9+tLWHCoY6r4WFXWBrT96LFs9O+5TMVXZ+1ZuIvj4/2y+7HtgJalt85
 5+bce0+qFdmk/gpcw7SQOZ1ngeXPWi9fDOv7LR+YkDaHcpJP9sXp9Ej2Tro97CMK
 oQ0QGiJ+h1iGuYIw76chchZ5mK+UEVSbdxK70fpPC1zi+g8l0smVSpOs8oNFGX0m
 F0pHhIz3LwMMDyZgJsEMUIkBF7nbKS8Mc+noq9DOaOjZjb0yyBFbc8s82LIdbOhO
 IIJftNF1NSlH4tKJtFdet/TrxHX/UZ0xp52SHev+U3c3gXaoP4EUHQ71R/lnlyJc
 R+H6G/xZjcsNrklKgJJMV+5znKbjDaqavaaAxo17eRqLG/M4ZIac3xzqJUyeuUPY
 RnErPTRQzGL4C9CldxjIfI+iY3f2uTsNclzonV98kcLxbRdMsNIybUV6mNBYVmlx
 4A6IN3zP1+bsbjOdZMhpAUIjsflj/KzdF/f4/BjoCgBv3O030ec=
 =jxlW
 -----END PGP SIGNATURE-----
--- a/share/security/advisories/FreeBSD-EN-18:06.tzdata.asc
+++ b/share/security/advisories/FreeBSD-EN-18:06.tzdata.asc
@ -0,0 +1,147 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 =============================================================================
 FreeBSD-EN-18:06.tzdata                                         Errata Notice
                                                          The FreeBSD Project
 Topic:          Timezone database information update
 Category:       contrib
 Module:         zoneinfo
 Announced:      2018-05-08
 Credits:        Philip Paeps
 Affects:        All supported versions of FreeBSD.
 Corrected:      2018-05-07 06:58:19 UTC (stable/11, 11.2-PRERELEASE)
                2018-05-08 17:18:24 UTC (releng/11.1, 11.1-RELEASE-p10)
                2018-05-07 07:02:26 UTC (stable/10, 10.4-STABLE)
                2018-05-08 17:18:24 UTC (releng/10.4, 10.4-RELEASE-p9)
 For general information regarding FreeBSD Errata Notices and Security
 Advisories, including descriptions of the fields above, security
 branches, and the following sections, please visit
 <URL:https://security.FreeBSD.org/>.
 I.   Background
 The tzsetup(8) program allows the user to specify the default local timezone.
 Based on the selected timezone, tzsetup(8) copies one of the files from
 /usr/share/zoneinfo to /etc/localtime.  This file actually controls the
 conversion.
 II.  Problem Description
 Several changes in Daylight Savings Time happened after previous FreeBSD
 releases were released that would affect many people who live in different
 countries.  Because of these changes, the data in the zoneinfo files need to
 be updated, and if the local timezone on the running system is affected,
 tzsetup(8) needs to be run so the /etc/localtime is updated.
 III. Impact
 An incorrect time will be displayed on a system configured to use one of the
 affected timezones if the /usr/share/zoneinfo and /etc/localtime files are
 not updated, and all applications on the system that rely on the system time,
 such as cron(8) and syslog(8), will be affected.
 IV.  Workaround
 The system administrator can install an updated timezone database from the
 misc/zoneinfo port and run tzsetup(8) to get the timezone database corrected.
 Applications that store and display times in Coordinated Universal Time (UTC)
 are not affected.
 V.   Solution
 Please note that some third party software, for instance PHP, Ruby, Java and
 Perl, may be using different zoneinfo data source, in such cases this
 software must be updated separately.  For software packages that is installed
 via binary packages, they can be upgraded by executing `pkg upgrade'.
 Following the instructions in this Errata Notice will update all of the
 zoneinfo files to be the same as what was released with FreeBSD release.
 Perform one of the following:
 1) Upgrade your system to a supported FreeBSD stable or release / security
 branch (releng) dated after the correction date.  Restart all the affected
 applications and daemons, or reboot the system.
 2) To update your system via a binary patch:
 Systems running a RELEASE version of FreeBSD on the i386 or amd64
 platforms can be updated via the freebsd-update(8) utility:
 # freebsd-update fetch
 # freebsd-update install
 Restart all the affected applications and daemons, or reboot the system.
 3) To update your system via a source code patch:
 The following patches have been verified to apply to the applicable
 FreeBSD release branches.
 a) Download the relevant patch from the location below, and verify the
 detached PGP signature using your PGP utility.
 # fetch https://security.FreeBSD.org/patches/EN-18:06/tzdata-2018e.patch
 # fetch https://security.FreeBSD.org/patches/EN-18:06/tzdata-2018e.patch.asc
 # gpg --verify tzdata-2018e.patch.asc
 b) Apply the patch.  Execute the following commands as root:
 # cd /usr/src
 # patch < /path/to/patch
 c) Recompile the operating system using buildworld and installworld as
 described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
 Restart all the affected applications and daemons, or reboot the system.
 VI.  Correction details
 The following list contains the correction revision numbers for each
 affected branch.
 Branch/path                                                      Revision
 - -------------------------------------------------------------------------
 stable/10/                                                        r333313
 releng/10.4/                                                      r333375
 stable/11/                                                        r333312
 releng/11.1/                                                      r333375
 - -------------------------------------------------------------------------
 To see which files were modified by a particular revision, run the
 following command, replacing NNNNNN with the revision number, on a
 machine with Subversion installed:
 # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
 Or visit the following URL, replacing NNNNNN with the revision number:
 <URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
 VII. References
 The latest revision of this advisory is available at
 <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-18:06.tzdata.asc>
 -----BEGIN PGP SIGNATURE-----
 iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrx3G1fFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
 MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
 5cIzdg//a6Vn9B/eW4na7jAcX4rUCUJGBFE1A4MhX4NGULx+L4v6qkcdj4O6CWYR
 rbqNRzEtb5oF0We9K0XyekigmOVmb5TwDXHbjiaw13DrLWM4WhEAerRP04DrDV7k
 31SGAq92L3oP4u8FrxwdtKZ2TY5naH/3GdGEL0JJmUaqUSrtLeiOvqVwCKZIy7i9
 Q4DqQh7cEtBK5J8V+VqqbKNKOTPKS0uH27UAjzPhTc+GbZ4YRnD4YKVfNZMEDmiy
 5TgXJrVOX+eJZlB1jgZXJY38wZtQELbs+2I2haNvzKz3Ypt7Rtan9MxAWkBkC+g6
 /tbiJFYaJ5GC0CTBymBa8gm5oqvpWzb3h3kNpld4SDyO1iDcIcD7/+VqnNoFynVa
 Fgf/icLc3Ck48n0ZZQlkGk22kTmBwe69p6QLnL5cuDbm3ZpRM/+1GjguG2Ow5eYD
 Y6p6eMozALZh2JdHdxAtKEuSfc03UOMcEu2kBtVE/XtoJqPb+2SmaSRvXmMiio2E
 TPjjdAzUUITDcESmyJLmHoqwHR40i2+ZSwH6BbD/1qeoH7PSXS+/Nh/wv2KEsC0S
 tbAYiwuj4uDlgPIPm0tr2xDB+2BaSVe/0AituXyzFQVnrNJHisLrk0tZ7Y3WmN0B
 Fn/5LIRGjT51Sw/0D0XpedwcdWoUQ9vz/FpoC6xQDcaXhW/ViDo=
 =0QUF
 -----END PGP SIGNATURE-----
--- a/share/security/advisories/FreeBSD-SA-18:06.debugreg.asc
+++ b/share/security/advisories/FreeBSD-SA-18:06.debugreg.asc
@ -0,0 +1,141 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 =============================================================================
 FreeBSD-SA-18:06.debugreg                                   Security Advisory
                                                          The FreeBSD Project
 Topic:          Mishandling of x86 debug exceptions
 Category:       core
 Module:         kernel
 Announced:      2018-05-08
 Credits:        Nick Peterson, Everdox Tech LLC
                    https://www.linkedin.com/in/everdox
                Andy Lutomirski
 Affects:        All supported versions of FreeBSD.
 Corrected:      2018-05-08 17:03:33 UTC (stable/11, 11.2-PRERELEASE)
                2018-05-08 17:12:10 UTC (releng/11.1, 11.1-RELEASE-p10)
                2018-05-08 17:05:39 UTC (stable/10, 10.4-STABLE)
                2018-05-08 17:12:10 UTC (releng/10.4, 10.4-RELEASE-p9)
 CVE Name:       CVE-2018-8897
 For general information regarding FreeBSD Security Advisories,
 including descriptions of the fields above, security branches, and the
 following sections, please visit <URL:https://security.FreeBSD.org/>.
 I.   Background
 On x86 architecture systems, the stack is represented by the combination of
 a stack segment and a stack pointer, which must remain in sync for proper
 operation.  Instructions related to manipulating the stack segment have
 special handling to facilitate consistency with changes to the stack pointer.
 II.  Problem Description
 The MOV SS and POP SS instructions inhibit debug exceptions until the
 instruction boundary following the next instruction.  If that instruction is
 a system call or similar instruction that transfers control to the operating
 system, the debug exception will be handled in the kernel context instead of
 the user context.
 III. Impact
 An authenticated local attacker may be able to read sensitive data in kernel
 memory, control low-level operating system functions, or may panic the
 system.
 IV.  Workaround
 No workaround is available.
 V.   Solution
 Upgrade your vulnerable system to a supported FreeBSD stable or
 release / security branch (releng) dated after the correction date,
 using either a binary or source code patch, and then reboot.
 1) To update your vulnerable system via a binary patch:
 Systems running a RELEASE version of FreeBSD on the i386 or amd64
 platforms can be updated via the freebsd-update(8) utility:
 # freebsd-update fetch
 # freebsd-update install
 And reboot.
 2) To update your vulnerable system via a source code patch:
 The following patches have been verified to apply to the applicable
 FreeBSD release branches.
 a) Download the relevant patch from the location below, and verify the
 detached PGP signature using your PGP utility.
 [FreeBSD 11.1]
 # fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.11.1.patch
 # fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.11.1.patch.asc
 # gpg --verify debugreg.11.1.patch.asc
 [FreeBSD 10.4]
 # fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.10.4.patch
 # fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.10.4.patch.asc
 # gpg --verify debugreg.10.4.patch.asc
 b) Apply the patch.  Execute the following commands as root:
 # cd /usr/src
 # patch < /path/to/patch
 c) Recompile and install your kernel as described in
 <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
 system.
 VI.  Correction details
 The following list contains the correction revision numbers for each
 affected branch.
 Branch/path                                                      Revision
 - -------------------------------------------------------------------------
 stable/10/                                                        r333370
 releng/10.4/                                                      r333371
 stable/11/                                                        r333369
 releng/11.1/                                                      r333371
 - -------------------------------------------------------------------------
 To see which files were modified by a particular revision, run the
 following command, replacing NNNNNN with the revision number, on a
 machine with Subversion installed:
 # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
 Or visit the following URL, replacing NNNNNN with the revision number:
 <URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
 VII. References
 <URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8897>
 The latest revision of this advisory is available at
 <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-18:06.debugreg.asc>
 -----BEGIN PGP SIGNATURE-----
 iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrx3HhfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
 MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
 5cK/jhAAmPPCFZRMvbyG0VBCBqo5COFZ/32IMOWFDGMlsSi+CEgcGM51SzYZi97c
 zsT/2RgMsvBdggk41wvXqp1gKxgIbJe22af7l+D18e6rDEesueJqSiizcHmfGQul
 X+ZRUkFxTkCNz0Ajp4clqbavuHNiCmiKmH/0X8LMk31SXIVE3oH0Pphf0W8qJqxz
 4k2nvc6NoPWEMVA0rsj3n6sB0NhvV1ddLLmGpoDgedSyz77PCDgWGMoh5ny5sY12
 tHNB1r+gL624Y0l8xoyVJP0Snk0emzeQQ5HOTa8DRIwD/a0Uxy+xKcvDMorW9U6M
 zsxrMs9EwSJYpwLxsQ/YVTgFvyQbkHXFXg56hxqUvnnEEahGfF47d/9x2lyzDr8r
 H+ncl9a+PfOCJ5OcwkjzorQv+Pq65JFlc15bxLS+zyU4g6yJDnHdk7Azbc60Uwq/
 chauKmosm1I1CVH60JG00rmvoiX7b5ZRdEGEzAFt4XIX+EuXPnI84C5DxiD1YG+3
 n7IygNZNGtGfIrNhWEn2VK+VGzFEm2p4RkreWbGwrWQIxfd5gOJxvjAPSwjgy5rl
 dwRW7bMzowIGnrlzCF18Qc2xnFD31JPYDdsI+Fa8d1YkCVWRZ79VX57Locw50/de
 c5nZRJGk4AQ1lXxkNTkxWnstfb/q8fBVPkIEQKVHpVnGiI/pQpQ=
 =Oyxs
 -----END PGP SIGNATURE-----
--- a/share/security/patches/EN-18:05/mem.10.4.patch
+++ b/share/security/patches/EN-18:05/mem.10.4.patch
@ -0,0 +1,115 @@
 --- sys/compat/linux/linux_ioctl.c.orig
 +++ sys/compat/linux/linux_ioctl.c
@@ -246,6 +246,7 @@
 		} else if ((args->cmd & 0xffff) == LINUX_HDIO_GET_GEO_BIG) {
 			struct linux_hd_big_geometry hdbg;
 +			memset(&hdbg, 0, sizeof(hdbg));
 			hdbg.cylinders = fwcylinders;
 			hdbg.heads = fwheads;
 			hdbg.sectors = fwsectors;
@@ -2426,6 +2427,7 @@
 		printf("%s(): ioctl %d on %.*s\n", __func__,
 		    args->cmd & 0xffff, LINUX_IFNAMSIZ, lifname);
 #endif
 +		memset(ifname, 0, sizeof(ifname));
 		ifp = ifname_linux_to_bsd(td, lifname, ifname);
 		if (ifp == NULL)
 			return (EINVAL);
 --- sys/compat/linux/linux_ipc.c.orig
 +++ sys/compat/linux/linux_ipc.c
@@ -516,6 +516,9 @@
 	register_t rval;
 	int cmd, error;
 +	memset(&linux_seminfo, 0, sizeof(linux_seminfo));
 +	memset(&linux_semid, 0, sizeof(linux_semid));
 +
 	switch (args->cmd & ~LINUX_IPC_64) {
 	case LINUX_IPC_RMID:
 		cmd = IPC_RMID;
@@ -661,6 +664,8 @@
 	struct l_msqid_ds linux_msqid;
 	struct msqid_ds bsd_msqid;
 +	memset(&linux_msqid, 0, sizeof(linux_msqid));
 +
 	bsd_cmd = args->cmd & ~LINUX_IPC_64;
 	switch (bsd_cmd) {
 	case LINUX_IPC_INFO:
@@ -667,6 +672,7 @@
 	case LINUX_MSG_INFO: {
 		struct l_msginfo linux_msginfo;
 +		memset(&linux_msginfo, 0, sizeof(linux_msginfo));
 		/*
 		 * XXX MSG_INFO uses the same data structure but returns different
 		 * dynamic counters in msgpool, msgmap, and msgtql fields.
@@ -789,6 +795,10 @@
 	struct shmid_ds bsd_shmid;
 	int error;
 +	memset(&linux_shm_info, 0, sizeof(linux_shm_info));
 +	memset(&linux_shmid, 0, sizeof(linux_shmid));
 +	memset(&linux_shminfo, 0, sizeof(linux_shminfo));
 +
 	switch (args->cmd & ~LINUX_IPC_64) {
 	case LINUX_IPC_INFO: {
 --- sys/dev/ath/if_ath_btcoex.c.orig
 +++ sys/dev/ath/if_ath_btcoex.c
@@ -321,7 +321,7 @@
 		 * pointer for us to use below in reclaiming the buffer;
 		 * may want to be more defensive.
 		 */
 -		outdata = malloc(outsize, M_TEMP, M_NOWAIT);
 +		outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
 		if (outdata == NULL) {
 			error = ENOMEM;
 			goto bad;
@@ -330,6 +330,7 @@
 	switch (id) {
 		default:
 			error = EINVAL;
 +			goto bad;
 	}
 	if (outsize < ad->ad_out_size)
 		ad->ad_out_size = outsize;
 --- sys/dev/ath/if_ath_lna_div.c.orig
 +++ sys/dev/ath/if_ath_lna_div.c
@@ -185,7 +185,7 @@
 		 * pointer for us to use below in reclaiming the buffer;
 		 * may want to be more defensive.
 		 */
 -		outdata = malloc(outsize, M_TEMP, M_NOWAIT);
 +		outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
 		if (outdata == NULL) {
 			error = ENOMEM;
 			goto bad;
@@ -194,6 +194,7 @@
 	switch (id) {
 		default:
 			error = EINVAL;
 +			goto bad;
 	}
 	if (outsize < ad->ad_out_size)
 		ad->ad_out_size = outsize;
 --- sys/dev/ath/if_ath_spectral.c.orig
 +++ sys/dev/ath/if_ath_spectral.c
@@ -210,7 +210,7 @@
 		 * pointer for us to use below in reclaiming the buffer;
 		 * may want to be more defensive.
 		 */
 -		outdata = malloc(outsize, M_TEMP, M_NOWAIT);
 +		outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
 		if (outdata == NULL) {
 			error = ENOMEM;
 			goto bad;
@@ -273,6 +273,7 @@
 		break;
 		default:
 			error = EINVAL;
 +			goto bad;
 	}
 	if (outsize < ad->ad_out_size)
 		ad->ad_out_size = outsize;
--- a/share/security/patches/EN-18:05/mem.10.4.patch.asc
+++ b/share/security/patches/EN-18:05/mem.10.4.patch.asc
@ -0,0 +1,18 @@
 -----BEGIN PGP SIGNATURE-----
 iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxvPRfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
 MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
 5cL+ag/9G31jTLcccP2zEVMkQImlpbok+NQ6S/68DSgLfyht72mBR+Auhr+uN6i4
 9Rd3+UDwA5ZLOYt7QcZpV5xAJKAp9JtV8gNA0TFpWsRY2OYzDXL2EbyVonhutib5
 X5a0ClXjMOP99OZTWKMxQvLMZOa4p6DLOxZZfHyqbKdiDVOQCvLX2PSpHEQWCAZg
 d6ciw3Hs/H6AwT7ILwBlrWlax/O3RcMApRroeOIfKp1tVgoujvPlfHXGGIgXnEjr
 OfzLO6VBdaBYmKXQL3+zSweJtQXqby75JvLeS4+8SNwSyW4SOX+wgA63Q1imD6az
 Max+FPo459kGf1bp5sgmtn1r4AsWuCFEBE93tYnAWA5RXXyZwdjN0UBbKmoENZwb
 0eUuwymanPpJZ+LBRjlXS7fjpE3r9Dal9khxQnZ4L4mICYYyDqdTmCmXt/Dh+fTB
 7SwCb+ptVmZqvZfg7Xmp4Kk9lIDaPXxjlUTfmQK26iiV/sR53RP3hgDMT9HXfxdQ
 BuF5eRkOgT5oGTljqOpsZuxpSRTvVGpnTzRQ3ORq9kxv2pk9+z37A2RkHWbw95H6
 JnmnrZrjUYjYXxnMn7TyFlEgrkWicQN1a3QOCq4hBOMgqfID8Q/doNTcvomchX1w
 R+z+l737NWCTOvFN7DBL7GQcmzidTI7LwdEIVxK7+c0csSrycp0=
 =nC9i
 -----END PGP SIGNATURE-----
--- a/share/security/patches/EN-18:05/mem.11.1.patch
+++ b/share/security/patches/EN-18:05/mem.11.1.patch
@ -0,0 +1,139 @@
 --- sys/compat/linux/linux_ioctl.c.orig
 +++ sys/compat/linux/linux_ioctl.c
@@ -253,6 +253,7 @@
 		} else if ((args->cmd & 0xffff) == LINUX_HDIO_GET_GEO_BIG) {
 			struct linux_hd_big_geometry hdbg;
 +			memset(&hdbg, 0, sizeof(hdbg));
 			hdbg.cylinders = fwcylinders;
 			hdbg.heads = fwheads;
 			hdbg.sectors = fwsectors;
@@ -2477,6 +2478,7 @@
 		printf("%s(): ioctl %d on %.*s\n", __func__,
 		    args->cmd & 0xffff, LINUX_IFNAMSIZ, lifname);
 #endif
 +		memset(ifname, 0, sizeof(ifname));
 		ifp = ifname_linux_to_bsd(td, lifname, ifname);
 		if (ifp == NULL)
 			return (EINVAL);
 --- sys/compat/linux/linux_ipc.c.orig
 +++ sys/compat/linux/linux_ipc.c
@@ -548,6 +548,9 @@
 	register_t rval;
 	int cmd, error;
 +	memset(&linux_seminfo, 0, sizeof(linux_seminfo));
 +	memset(&linux_semid64, 0, sizeof(linux_semid64));
 +
 	switch (args->cmd & ~LINUX_IPC_64) {
 	case LINUX_IPC_RMID:
 		cmd = IPC_RMID;
@@ -702,6 +705,8 @@
 	struct l_msqid64_ds linux_msqid64;
 	struct msqid_ds bsd_msqid;
 +	memset(&linux_msqid64, 0, sizeof(linux_msqid64));
 +
 	bsd_cmd = args->cmd & ~LINUX_IPC_64;
 	switch (bsd_cmd) {
 	case LINUX_IPC_INFO:
@@ -708,6 +713,7 @@
 	case LINUX_MSG_INFO: {
 		struct l_msginfo linux_msginfo;
 +		memset(&linux_msginfo, 0, sizeof(linux_msginfo));
 		/*
 		 * XXX MSG_INFO uses the same data structure but returns different
 		 * dynamic counters in msgpool, msgmap, and msgtql fields.
@@ -833,6 +839,10 @@
 	struct shmid_ds bsd_shmid;
 	int error;
 +	memset(&linux_shm_info, 0, sizeof(linux_shm_info));
 +	memset(&linux_shmid64, 0, sizeof(linux_shmid64));
 +	memset(&linux_shminfo64, 0, sizeof(linux_shminfo64));
 +
 	switch (args->cmd & ~LINUX_IPC_64) {
 	case LINUX_IPC_INFO: {
 --- sys/dev/ath/if_ath_btcoex.c.orig
 +++ sys/dev/ath/if_ath_btcoex.c
@@ -457,7 +457,7 @@
 		 * pointer for us to use below in reclaiming the buffer;
 		 * may want to be more defensive.
 		 */
 -		outdata = malloc(outsize, M_TEMP, M_NOWAIT);
 +		outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
 		if (outdata == NULL) {
 			error = ENOMEM;
 			goto bad;
@@ -466,6 +466,7 @@
 	switch (id) {
 		default:
 			error = EINVAL;
 +			goto bad;
 	}
 	if (outsize < ad->ad_out_size)
 		ad->ad_out_size = outsize;
 --- sys/dev/ath/if_ath_ioctl.c.orig
 +++ sys/dev/ath/if_ath_ioctl.c
@@ -197,7 +197,7 @@
 		 * pointer for us to use below in reclaiming the buffer;
 		 * may want to be more defensive.
 		 */
 -		outdata = malloc(outsize, M_TEMP, M_NOWAIT);
 +		outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
 		if (outdata == NULL) {
 			error = ENOMEM;
 			goto bad;
 --- sys/dev/ath/if_ath_lna_div.c.orig
 +++ sys/dev/ath/if_ath_lna_div.c
@@ -187,7 +187,7 @@
 		 * pointer for us to use below in reclaiming the buffer;
 		 * may want to be more defensive.
 		 */
 -		outdata = malloc(outsize, M_TEMP, M_NOWAIT);
 +		outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
 		if (outdata == NULL) {
 			error = ENOMEM;
 			goto bad;
@@ -196,6 +196,7 @@
 	switch (id) {
 		default:
 			error = EINVAL;
 +			goto bad;
 	}
 	if (outsize < ad->ad_out_size)
 		ad->ad_out_size = outsize;
 --- sys/dev/ath/if_ath_spectral.c.orig
 +++ sys/dev/ath/if_ath_spectral.c
@@ -212,7 +212,7 @@
 		 * pointer for us to use below in reclaiming the buffer;
 		 * may want to be more defensive.
 		 */
 -		outdata = malloc(outsize, M_TEMP, M_NOWAIT);
 +		outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
 		if (outdata == NULL) {
 			error = ENOMEM;
 			goto bad;
@@ -275,6 +275,7 @@
 		break;
 		default:
 			error = EINVAL;
 +			goto bad;
 	}
 	if (outsize < ad->ad_out_size)
 		ad->ad_out_size = outsize;
 --- sys/netinet/tcp_usrreq.c.orig
 +++ sys/netinet/tcp_usrreq.c
@@ -1495,7 +1495,9 @@
 		return (error);
 	} else if ((sopt->sopt_dir == SOPT_GET) && 
 	    (sopt->sopt_name == TCP_FUNCTION_BLK)) {
 -		strcpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name);
 +		strncpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name,
 +		    TCP_FUNCTION_NAME_LEN_MAX);
 +		fsn.function_set_name[TCP_FUNCTION_NAME_LEN_MAX - 1] = '\0';
 		fsn.pcbcnt = tp->t_fb->tfb_refcnt;
 		INP_WUNLOCK(inp);
 		error = sooptcopyout(sopt, &fsn, sizeof fsn);
--- a/share/security/patches/EN-18:05/mem.11.1.patch.asc
+++ b/share/security/patches/EN-18:05/mem.11.1.patch.asc
@ -0,0 +1,18 @@
 -----BEGIN PGP SIGNATURE-----
 iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxvQJfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
 MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
 5cIwxQ//bgsLVPJ63nz0rDnWhF3qOLtJbE0ZTE2F5XRraNRaUVBx7ZpCyirSHnsU
 CZvNVDtPxRGzxxgzPXj4gjtRuFK7VK5uKMG+tAL1i2A7S9ukbIOsD6y5R1VO3Vnj
 uYPqGZgo437tnzgSCo/z7WAW98tDPzcbHJIO3gNNAG7Tu9+xfinLFP2GhFkYlsij
 K/tplIX8OiT4X4Qcn4x3LNUIS9bXxMcX7ogkPqLEYlCOVT4h7IXXBJa6Z+IkSwSv
 Y8xOmdDwp33t+JbEZt2NGMNG3evT1aYR/v0/GHPEjruPmK+fMSI5EmJOPPGn0zMn
 7/vPiDacXDnyGIORFaerC0kZkQjaSwunzzO4npqBmj+jD7ALTtpyCY8fpHqPlERH
 LkA+3xZDZqcgRVyVEWYq7exyyXNe2BkkENP8BZaZGUCPA9+uJ8dsDcw5D8DghMBG
 KvbBcr+7zIiWRYM9rWwLS1t4y7GpC9DJxqvgAy2S7w8MGZsS6zGPsgt91cG71m+T
 S+uEcuu1x3xowI6ODOTc3ISxD+V20yE464UdBYyN21zE67yuWRJXdMzIqQUbgSuU
 W8w4z3sNFUlh1phVi9pCteX0Vgvt+YHEkd2NG0zoHp7//1a5vtSoSMgAN746eanP
 MVdI7kaTjrjzJaaKPtb5zKdznLUH06mHspeI2qXrtb7XoRpSt2o=
 =Q1kJ
 -----END PGP SIGNATURE-----
--- a/share/security/patches/EN-18:06/tzdata-2018e.patch
+++ b/share/security/patches/EN-18:06/tzdata-2018e.patch
@ -0,0 +1,837 @@
 --- contrib/tzdata/Makefile.orig
 +++ contrib/tzdata/Makefile
@@ -21,7 +21,7 @@
 # Change the line below for your time zone (after finding the zone you want in
 # the time zone files, or adding it to a time zone file).
 -# Alternately, if you discover you've got the wrong time zone, you can just
 +# Alternatively, if you discover you've got the wrong time zone, you can just
 #	zic -l rightzone
 # to correct things.
 # Use the command
@@ -38,7 +38,7 @@
 # template file are used to determine "spring forward" and "fall back" days and
 # times; the environment variable itself specifies UT offsets of standard and
 # daylight saving time.
 -# Alternately, if you discover you've got the wrong time zone, you can just
 +# Alternatively, if you discover you've got the wrong time zone, you can just
 #	zic -p rightzone
 # to correct things.
 # Use the command
@@ -236,14 +236,16 @@
   $(GCC_INSTRUMENT) \
   -Wall -Wextra \
   -Walloc-size-larger-than=100000 -Warray-bounds=2 \
 -  -Wbad-function-cast -Wcast-align -Wdate-time \
 +  -Wbad-function-cast -Wcast-align=strict -Wdate-time \
   -Wdeclaration-after-statement -Wdouble-promotion \
   -Wformat=2 -Wformat-overflow=2 -Wformat-signedness -Wformat-truncation \
   -Winit-self -Wjump-misses-init -Wlogical-op \
   -Wmissing-declarations -Wmissing-prototypes -Wnested-externs \
   -Wold-style-definition -Woverlength-strings -Wpointer-arith \
 -  -Wshadow -Wshift-overflow=2 -Wstrict-prototypes -Wstringop-overflow=5 \
 +  -Wshadow -Wshift-overflow=2 -Wstrict-prototypes -Wstringop-overflow=4 \
 +  -Wstringop-truncation -Wsuggest-attribute=cold \
   -Wsuggest-attribute=const -Wsuggest-attribute=format \
 +  -Wsuggest-attribute=malloc \
   -Wsuggest-attribute=noreturn -Wsuggest-attribute=pure \
   -Wtrampolines -Wundef -Wuninitialized -Wunused \
   -Wvariadic-macros -Wvla -Wwrite-strings \
@@ -514,6 +516,7 @@
 		tzfile.5 tzfile.h tzselect.8 tzselect.ksh \
 		workman.sh yearistype.sh \
 		zdump.8 zdump.c zic.8 zic.c \
 +		ziguard.awk zishrink.awk \
 		zone.tab zone1970.tab zoneinfo2tdf.pl
 # And for the benefit of csh users on systems that assume the user
@@ -559,8 +562,8 @@
 # These files can be tailored by setting BACKWARD, PACKRATDATA, etc.
 vanguard.zi main.zi rearguard.zi: $(DSTDATA_ZI_DEPS)
 -		$(AWK) -v outfile='$@' -f ziguard.awk $(TDATA) $(PACKRATDATA) \
 -		  >$@.out
 +		$(AWK) -v DATAFORM=`expr $@ : '\(.*\).zi'` -f ziguard.awk \
 +		  $(TDATA) $(PACKRATDATA) >$@.out
 		mv $@.out $@
 tzdata.zi:	$(DATAFORM).zi version
 		version=`sed 1q version` && \
@@ -900,6 +903,13 @@
 		done
 		rm -fr time_t.dir
 +TRADITIONAL_ASC = \
 +  tzcode$(VERSION).tar.gz.asc \
 +  tzdata$(VERSION).tar.gz.asc
 +ALL_ASC = $(TRADITIONAL_ASC) \
 +  tzdata$(VERSION)-rearguard.tar.gz.asc \
 +  tzdb-$(VERSION).tar.lz.asc
 +
 tarballs traditional_tarballs signatures traditional_signatures: version
 		VERSION=`cat version` && \
 		$(MAKE) VERSION="$$VERSION" $@_version
@@ -907,12 +917,13 @@
 # These *_version rules are intended for use if VERSION is set by some
 # other means.  Ordinarily these rules are used only by the above
 # non-_version rules, which set VERSION on the 'make' command line.
 -tarballs_version: traditional_tarballs_version tzdb-$(VERSION).tar.lz
 +tarballs_version: traditional_tarballs_version \
 +  tzdata$(VERSION)-rearguard.tar.gz \
 +  tzdb-$(VERSION).tar.lz
 traditional_tarballs_version: \
   tzcode$(VERSION).tar.gz tzdata$(VERSION).tar.gz
 -signatures_version: traditional_signatures_version tzdb-$(VERSION).tar.lz.asc
 -traditional_signatures_version: \
 -  tzcode$(VERSION).tar.gz.asc tzdata$(VERSION).tar.gz.asc \
 +signatures_version: $(ALL_ASC)
 +traditional_signatures_version: $(TRADITIONAL_ASC)
 tzcode$(VERSION).tar.gz: set-timestamps.out
 		LC_ALL=C && export LC_ALL && \
@@ -927,6 +938,26 @@
 		  gzip $(GZIPFLAGS) >$@.out
 		mv $@.out $@
 +tzdata$(VERSION)-rearguard.tar.gz: rearguard.zi set-timestamps.out
 +		rm -fr tzdata$(VERSION)-rearguard.dir
 +		mkdir tzdata$(VERSION)-rearguard.dir
 +		ln $(COMMON) $(DATA) $(MISC) tzdata$(VERSION)-rearguard.dir
 +		cd tzdata$(VERSION)-rearguard.dir && \
 +		  rm -f $(TDATA) $(PACKRATDATA) version
 +		for f in $(TDATA) $(PACKRATDATA); do \
 +		  rearf=tzdata$(VERSION)-rearguard.dir/$$f; \
 +		  $(AWK) -v DATAFORM=rearguard -f ziguard.awk $$f >$$rearf && \
 +		  touch -cmr `ls -t ziguard.awk $$f` $$rearf || exit; \
 +		done
 +		sed '1s/$$/-rearguard/' \
 +		  <version >tzdata$(VERSION)-rearguard.dir/version
 +		touch -cmr version tzdata$(VERSION)-rearguard.dir/version
 +		LC_ALL=C && export LC_ALL && \
 +		  (cd tzdata$(VERSION)-rearguard.dir && \
 +		   tar $(TARFLAGS) -cf - $(COMMON) $(DATA) $(MISC) | \
 +		     gzip $(GZIPFLAGS)) >$@.out
 +		mv $@.out $@
 +
 tzdb-$(VERSION).tar.lz: set-timestamps.out
 		rm -fr tzdb-$(VERSION)
 		mkdir tzdb-$(VERSION)
@@ -937,12 +968,10 @@
 		mv $@.out $@
 tzcode$(VERSION).tar.gz.asc: tzcode$(VERSION).tar.gz
 -		gpg --armor --detach-sign $?
 -
 tzdata$(VERSION).tar.gz.asc: tzdata$(VERSION).tar.gz
 -		gpg --armor --detach-sign $?
 -
 +tzdata$(VERSION)-rearguard.tar.gz.asc: tzdata$(VERSION)-rearguard.tar.gz
 tzdb-$(VERSION).tar.lz.asc: tzdb-$(VERSION).tar.lz
 +$(ALL_ASC):
 		gpg --armor --detach-sign $?
 typecheck:
 --- contrib/tzdata/NEWS.orig
 +++ contrib/tzdata/NEWS
@@ -1,5 +1,69 @@
 News for the tz database
 +Release 2018e - 2018-05-01 23:42:51 -0700
 +
 +  Briefly:
 +
 +    North Korea switches back to +09 on 2018-05-05.
 +    The main format uses negative DST again, for Ireland etc.
 +    'make tarballs' now also builds a rearguard tarball.
 +    New 's' and 'd' suffixes in SAVE columns of Rule and Zone lines.
 +
 +  Changes to past and future time stamps
 +
 +    North Korea switches back from +0830 to +09 on 2018-05-05.
 +    (Thanks to Kang Seonghoon, Arthur David Olson, Seo Sanghyeon,
 +    and Tim Parenti.)
 +
 +    Bring back the negative-DST changes of 2018a, except be more
 +    compatible with data parsers that do not support negative DST.
 +    Also, this now affects historical time stamps in Namibia and the
 +    former Czechoslovakia, not just Ireland.  The main format now uses
 +    negative DST to model time stamps in Europe/Dublin (from 1971 on),
 +    Europe/Prague (1946/7), and Africa/Windhoek (1994/2017).  This
 +    does not affect UT offsets, only time zone abbreviations and the
 +    tm_isdst flag.  Also, this does not affect rearguard or vanguard
 +    formats; effectively the main format now uses vanguard instead of
 +    rearguard format.  Data parsers that do not support negative DST
 +    can still use data from the rearguard tarball described below.
 +
 +  Changes to build procedure
 +
 +    The command 'make tarballs' now also builds the tarball
 +    tzdataVERSION-rearguard.tar.gz, which is like tzdataVERSION.tar.gz
 +    except that it uses rearguard format intended for trailing-edge
 +    data parsers.
 +
 +  Changes to data format and to code
 +
 +    The SAVE column of Rule and Zone lines can now have an 's' or 'd'
 +    suffix, which specifies whether the adjusted time is standard time
 +    or daylight saving time.  If no suffix is given, daylight saving
 +    time is used if and only if the SAVE column is nonzero; this is
 +    the longstanding behavior.  Although this new feature is not used
 +    in tzdata, it could be used to specify the legal time in Namibia
 +    1994-2017, as opposed to the popular time (see below).
 +
 +  Changes to past time stamps
 +
 +    From 1994 through 2017 Namibia observed DST in winter, not summer.
 +    That is, it used negative DST, as Ireland still does.  This change
 +    does not affect UTC offsets; it affects only the tm_isdst flag and
 +    the abbreviation used during summer, which is now CAT, not WAST.
 +    Although (as noted by Michael Deckers) summer and winter time were
 +    both simply called "standard time" in Namibian law, in common
 +    practice winter time was considered to be DST (as noted by Stephen
 +    Colebourne).  The full effect of this change is only in vanguard
 +    format; in rearguard and main format, the tm_isdst flag is still
 +    zero in winter and nonzero in summer.
 +
 +    In 1946/7 Czechoslovakia also observed negative DST in winter.
 +    The full effect of this change is only in vanguard format; in
 +    rearguard and main formats, it is modeled as plain GMT without
 +    daylight saving.  Also, the dates of some 1944/5 DST transitions
 +    in Czechoslovakia have been changed.
 +
 +
 Release 2018d - 2018-03-22 07:05:46 -0700
   Briefly:
@@ -39,7 +103,7 @@
     Enderbury and Kiritimati skipped New Year's Eve 1994, not
     New Year's Day 1995.  (Thanks to Kerry Shetline.)
 -    Fix the 1912-01-01 transition for Portugual and its colonies.
 +    Fix the 1912-01-01 transition for Portugal and its colonies.
     This transition was at 00:00 according to the new UT offset, not
     according to the old one.  Also assume that Cape Verde switched on
     the same date as the rest, not in 1907.  This affects
 --- contrib/tzdata/africa.orig
 +++ contrib/tzdata/africa
@@ -6,7 +6,7 @@
 # tz@iana.org for general use in the future).  For more, please see
 # the file CONTRIBUTING in the tz distribution.
 -# From Paul Eggert (2017-02-20):
 +# From Paul Eggert (2017-04-09):
 #
 # Unless otherwise specified, the source for data through 1990 is:
 # Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),
@@ -52,7 +52,7 @@
 # cannot now come up with solid citations.
 #
 # I invented the following abbreviations; corrections are welcome!
 -#	 +02	WAST	West Africa Summer Time
 +#	 +02	WAST	West Africa Summer Time (no longer used)
 #	 +03	CAST	Central Africa Summer Time (no longer used)
 #	 +03	SAST	South Africa Summer Time (no longer used)
 #	 +03	EAT	East Africa Time
@@ -967,6 +967,10 @@
 # commence at OOhOO on Monday 21 March 1994 and shall end at 02h00 on
 # Sunday 4 September 1994.
 +# From Michael Deckers (2017-04-06):
 +# ... both summer and winter time are called "standard"
 +# (which differs from the use in Ireland) ...
 +
 # From Petronella Sibeene (2007-03-30):
 # http://allafrica.com/stories/200703300178.html
 # While the entire country changes its time, Katima Mulilo and other
@@ -992,10 +996,26 @@
 # the same time they would normally start DST, the first Sunday in September:
 # https://www.timeanddate.com/news/time/namibia-new-time-zone.html
 +# From Paul Eggert (2017-04-09):
 +# Before the change, summer and winter time were both standard time legally.
 +# However in common parlance, winter time was considered to be DST.  See, e.g.:
 +# http://www.nbc.na/news/namibias-winter-time-could-be-scrapped.2706
 +# https://zone.my.na/news/times-are-changing-in-namibia
 +# https://www.newera.com.na/2017/02/23/namibias-winter-time-might-be-repealed/
 +# Use plain "WAT" and "CAT" for the time zone abbreviations, to be compatible
 +# with Namibia's neighbors.
 +
 # RULE	NAME	FROM	TO	TYPE	IN	ON	AT	SAVE	LETTER/S
 -Rule	Namibia	1994	only	-	Mar	21	0:00	0	-
 -Rule	Namibia	1994	2016	-	Sep	Sun>=1	2:00	1:00	S
 -Rule	Namibia	1995	2017	-	Apr	Sun>=1	2:00	0	-
 +# Vanguard section, for zic and other parsers that support negative DST.
 +Rule	Namibia	1994	only	-	Mar	21	0:00	-1:00	WAT
 +Rule	Namibia	1994	2017	-	Sep	Sun>=1	2:00	0	CAT
 +Rule	Namibia	1995	2017	-	Apr	Sun>=1	2:00	-1:00	WAT
 +# Rearguard section, for parsers that do not support negative DST.
 +#Rule	Namibia	1994	only	-	Mar	21	0:00	0	WAT
 +#Rule	Namibia	1994	2017	-	Sep	Sun>=1	2:00	1:00	CAT
 +#Rule	Namibia	1995	2017	-	Apr	Sun>=1	2:00	0	WAT
 +# End of rearguard section.
 +
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
 Zone	Africa/Windhoek	1:08:24 -	LMT	1892 Feb 8
 			1:30	-	+0130	1903 Mar
@@ -1002,9 +1022,16 @@
 			2:00	-	SAST	1942 Sep 20  2:00
 			2:00	1:00	SAST	1943 Mar 21  2:00
 			2:00	-	SAST	1990 Mar 21 # independence
 -			2:00	-	CAT	1994 Mar 21  0:00
 -			1:00	Namibia	WA%sT	2017 Sep  3  2:00
 -			2:00	-	CAT
 +# Vanguard section, for zic and other parsers that support negative DST.
 +			2:00	Namibia	%s
 +# Rearguard section, for parsers that do not support negative DST.
 +#			2:00	-	CAT	1994 Mar 21  0:00
 +# From Paul Eggert (2017-04-07):
 +# The official date of the 2017 rule change was 2017-10-24.  See:
 +# http://www.lac.org.na/laws/annoSTAT/Namibian%20Time%20Act%209%20of%202017.pdf
 +#			1:00	Namibia	%s	2017 Oct 24
 +#			2:00	-	CAT
 +# End of rearguard section.
 # Niger
 # See Africa/Lagos.
 --- contrib/tzdata/asia.orig
 +++ contrib/tzdata/asia
@@ -1983,6 +1983,19 @@
 # There is no common English-language abbreviation for this time zone.
 # Use KST, as that's what we already use for 1954-1961 in ROK.
 +# From Kang Seonghoon (2018-04-29):
 +# North Korea will revert its time zone from UTC+8:30 (PYT; Pyongyang
 +# Time) back to UTC+9 (KST; Korea Standard Time).
 +#
 +# From Seo Sanghyeon (2018-04-30):
 +# Rodong Sinmun 2018-04-30 announced Pyongyang Time transition plan.
 +# https://www.nknews.org/kcna/wp-content/uploads/sites/5/2018/04/rodong-2018-04-30.pdf
 +# ... the transition date is 2018-05-05 ...  Citation should be Decree
 +# No. 2232 of April 30, 2018, of the Presidium of the Supreme People's
 +# Assembly, as published in Rodong Sinmun.
 +# From Tim Parenti (2018-04-29):
 +# It appears to be the front page story at the top in the right-most column.
 +
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
 Zone	Asia/Seoul	8:27:52	-	LMT	1908 Apr  1
 			8:30	-	KST	1912 Jan  1
@@ -1994,7 +2007,8 @@
 			8:30	-	KST	1912 Jan  1
 			9:00	-	JST	1945 Aug 24
 			9:00	-	KST	2015 Aug 15 00:00
 -			8:30	-	KST
 +			8:30	-	KST	2018 May  5
 +			9:00	-	KST
 ###############################################################################
@@ -2658,7 +2672,7 @@
 # From Sharef Mustafa (2018-03-16):
 # Palestine summer time will start on Mar 24th 2018 by advancing the
 # clock by 60 minutes as per Palestinian cabinet decision published on
 -# the offical website, though the decree did not specify the exact
 +# the official website, though the decree did not specify the exact
 # time of the time shift.
 # http://www.palestinecabinet.gov.ps/Website/AR/NDecrees/ViewFile.ashx?ID=e7a42ab7-ee23-435a-b9c8-a4f7e81f3817
 #
 --- contrib/tzdata/australasia.orig
 +++ contrib/tzdata/australasia
@@ -1085,6 +1085,15 @@
 # (1999-09-27) writes that Giles Meteorological Station uses
 # South Australian time even though it's located in Western Australia.
 +# From Paul Eggert (2018-04-01):
 +# The Guardian Express of Perth, Australia reported today that the
 +# government decided to advance the clocks permanently on January 1,
 +# 2019, from UT +08 to UT +09.  The article noted that an exemption
 +# would be made for people aged 61 and over, who "can apply in writing
 +# to have the extra hour of sunshine removed from their area."  See:
 +# Daylight saving coming to WA in 2019. Guardian Express. 2018-04-01.
 +# https://www.communitynews.com.au/guardian-express/news/exclusive-daylight-savings-coming-wa-summer-2018/
 +
 # Queensland
 # From Paul Eggert (2018-02-26):
 --- contrib/tzdata/europe.orig
 +++ contrib/tzdata/europe
@@ -528,13 +528,13 @@
 # summer and negative daylight saving time in winter.  It is for when
 # negative SAVE values are used.
 # Rule	NAME	FROM	TO	TYPE	IN	ON	AT	SAVE	LETTER/S
 -#Rule	Eire	1971	only	-	Oct	31	 2:00u	-1:00	GMT
 -#Rule	Eire	1972	1980	-	Mar	Sun>=16	 2:00u	0	IST
 -#Rule	Eire	1972	1980	-	Oct	Sun>=23	 2:00u	-1:00	GMT
 -#Rule	Eire	1981	max	-	Mar	lastSun	 1:00u	0	IST
 -#Rule	Eire	1981	1989	-	Oct	Sun>=23	 1:00u	-1:00	GMT
 -#Rule	Eire	1990	1995	-	Oct	Sun>=22	 1:00u	-1:00	GMT
 -#Rule	Eire	1996	max	-	Oct	lastSun	 1:00u	-1:00	GMT
 +Rule	Eire	1971	only	-	Oct	31	 2:00u	-1:00	-
 +Rule	Eire	1972	1980	-	Mar	Sun>=16	 2:00u	0	-
 +Rule	Eire	1972	1980	-	Oct	Sun>=23	 2:00u	-1:00	-
 +Rule	Eire	1981	max	-	Mar	lastSun	 1:00u	0	-
 +Rule	Eire	1981	1989	-	Oct	Sun>=23	 1:00u	-1:00	-
 +Rule	Eire	1990	1995	-	Oct	Sun>=22	 1:00u	-1:00	-
 +Rule	Eire	1996	max	-	Oct	lastSun	 1:00u	-1:00	-
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
 Zone	Europe/Dublin	-0:25:00 -	LMT	1880 Aug  2
@@ -548,11 +548,11 @@
 			 0:00	-	GMT	1948 Apr 18  2:00s
 			 0:00	GB-Eire	GMT/IST	1968 Oct 27
 # The next line is for when negative SAVE values are used.
 -#			 1:00	Eire	IST/GMT
 +			 1:00	Eire	IST/GMT
 # These three lines are for when SAVE values are always nonnegative.
 -			 1:00	-	IST	1971 Oct 31  2:00u
 -			 0:00	GB-Eire	GMT/IST	1996
 -			 0:00	EU	GMT/IST
 +#			 1:00	-	IST	1971 Oct 31  2:00u
 +#			 0:00	GB-Eire	GMT/IST	1996
 +#			 0:00	EU	GMT/IST
 ###############################################################################
@@ -970,18 +970,30 @@
 # Please see the 'asia' file for Asia/Nicosia.
 # Czech Republic / Czechia
 +#
 +# From Paul Eggert (2018-04-15):
 +# The source for Czech data is: Kdy začíná a končí letní čas. 2018-04-15.
 +# https://kalendar.beda.cz/kdy-zacina-a-konci-letni-cas
 +# We know of no English-language name for historical Czech winter time;
 +# abbreviate it as "GMT", as it happened to be GMT.
 +#
 # Rule	NAME	FROM	TO	TYPE	IN	ON	AT	SAVE	LETTER/S
 -Rule	Czech	1945	only	-	Apr	 8	2:00s	1:00	S
 -Rule	Czech	1945	only	-	Nov	18	2:00s	0	-
 +Rule	Czech	1945	only	-	Apr	Mon>=1	2:00s	1:00	S
 +Rule	Czech	1945	only	-	Oct	 1	2:00s	0	-
 Rule	Czech	1946	only	-	May	 6	2:00s	1:00	S
 Rule	Czech	1946	1949	-	Oct	Sun>=1	2:00s	0	-
 -Rule	Czech	1947	only	-	Apr	20	2:00s	1:00	S
 -Rule	Czech	1948	only	-	Apr	18	2:00s	1:00	S
 +Rule	Czech	1947	1948	-	Apr	Sun>=15	2:00s	1:00	S
 Rule	Czech	1949	only	-	Apr	 9	2:00s	1:00	S
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
 Zone	Europe/Prague	0:57:44 -	LMT	1850
 			0:57:44	-	PMT	1891 Oct    # Prague Mean Time
 -			1:00	C-Eur	CE%sT	1944 Sep 17  2:00s
 +			1:00	C-Eur	CE%sT	1945 May  9
 +			1:00	Czech	CE%sT	1946 Dec  1  3:00
 +# Vanguard section, for zic and other parsers that support negative DST.
 +			1:00	-1:00	GMT	1947 Feb 23  2:00
 +# Rearguard section, for parsers that do not support negative DST.
 +#			0:00	-	GMT	1947 Feb 23  2:00
 +# End of rearguard section.
 			1:00	Czech	CE%sT	1979
 			1:00	EU	CE%sT
 # Use Europe/Prague also for Slovakia.
@@ -2016,7 +2028,7 @@
 Rule	Neth	1945	only	-	Apr	 2	2:00s	1:00	S
 Rule	Neth	1945	only	-	Sep	16	2:00s	0	-
 #
 -# Amsterdam Mean Time was +00:19:32.13 exactly, but the .13 is omitted
 +# Amsterdam Mean Time was +00:19:32.13, but the .13 is omitted
 # below because the current format requires GMTOFF to be an integer.
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
 Zone Europe/Amsterdam	0:19:32 -	LMT	1835
 --- contrib/tzdata/theory.html.orig
 +++ contrib/tzdata/theory.html
@@ -32,7 +32,7 @@
 It organizes <a href="tz-link.html">time zone and daylight saving time
 data</a> by partitioning the world into <a
 href="https://en.wikipedia.org/wiki/List_of_tz_database_time_zones">regions</a>
 -whose clocks all agree about timestamps that occur after the of the <a
 +whose clocks all agree about timestamps that occur after the <a
 href="https://en.wikipedia.org/wiki/Unix_time">POSIX Epoch</a>
 (1970-01-01 00:00:00 <a
 href="https://en.wikipedia.org/wiki/Coordinated_Universal_Time"><abbr
@@ -53,7 +53,7 @@
 applications requiring accurate handling of all past times everywhere,
 as it would take far too much effort and guesswork to record all
 details of pre-1970 civil timekeeping.
 -Athough some information outside the scope of the database is
 +Although some information outside the scope of the database is
 collected in a file <code>backzone</code> that is distributed along
 with the database proper, this file is less reliable and does not
 necessarily follow database guidelines.
@@ -68,7 +68,7 @@
 href="https://en.wikipedia.org/wiki/Unix">UNIX</a>-like systems.
 As of this writing, the current edition of POSIX is: <a
 href="http://pubs.opengroup.org/onlinepubs/9699919799/"> The Open
 -Group Base Specifications Issue 7</a>, IEEE Std 1003.1-2008, 2016
 +Group Base Specifications Issue 7</a>, IEEE Std 1003.1-2017, 2018
 Edition.
 Because the database's scope encompasses real-world changes to civil
 timekeeping, its model for describing time is more complex than the
@@ -79,7 +79,7 @@
 can change at times.
 Whether and when a <code><abbr>tz</abbr></code> region changes its
 clock, and even the region's notional base offset from UTC, are variable.
 -It doesn't even really make sense to talk about a region's
 +It does not always make sense to talk about a region's
 "base offset", since it is not necessarily a single number.
 </p>
@@ -92,8 +92,8 @@
 corresponds to a set of time zone rules.
 Inexperienced users are not expected to select these names unaided.
 Distributors should provide documentation and/or a simple selection
 -interface that explains the names; for one example, see the 'tzselect'
 -program in the <code><abbr>tz</abbr></code> code.
 +interface that explains the names; for one example, see the
 +<code>tzselect</code> program in the <code><abbr>tz</abbr></code> code.
 The <a href="http://cldr.unicode.org/">Unicode Common Locale Data
 Repository</a> contains data that may be useful for other selection
 interfaces.
@@ -137,6 +137,9 @@
 North and South America share the same area, '<code>America</code>'.
 Typical names are '<code>Africa/Cairo</code>',
 '<code>America/New_York</code>', and '<code>Pacific/Honolulu</code>'.
 +Some names are further qualified to help avoid confusion; for example,
 +'<code>America/Indiana/Petersburg</code>' distinguishes Petersburg,
 +Indiana from other Petersburgs in America.
 </p>
 <p>
@@ -159,7 +162,8 @@
     <code>TZ</code> strings</a>.
     A file name component must not exceed 14 characters or start with
     '<code>-</code>'.
 -    E.g., prefer '<code>Brunei</code>' to '<code>Bandar_Seri_Begawan</code>'.
 +    E.g., prefer <code>Asia/Brunei</code> to
 +    <code>Asia/Bandar_Seri_Begawan</code>.
     Exceptions: see the discussion of legacy names below.
   </li>
   <li>
@@ -177,8 +181,8 @@
     name <var>AB</var> (ignoring case), then <var>B</var> must not
     start with '<code>/</code>', as a regular file cannot have the
     same name as a directory in POSIX.
 -    For example, '<code>America/New_York</code>' precludes
 -    '<code>America/New_York/Bronx</code>'.
 +    For example, <code>America/New_York</code> precludes
 +    <code>America/New_York/Bronx</code>.
   </li>
   <li>
     Uninhabited regions like the North Pole and Bouvet Island
@@ -193,7 +197,7 @@
   </li>
   <li>
     If all the clocks in a region have agreed since 1970,
 -    don't bother to include more than one location
 +    do not bother to include more than one location
     even if subregions' clocks disagreed before 1970.
     Otherwise these tables would become annoyingly large.
   </li>
@@ -200,8 +204,9 @@
   <li>
     If a name is ambiguous, use a less ambiguous alternative;
     e.g., many cities are named San José and Georgetown, so
 -    prefer '<code>Costa_Rica</code>' to '<code>San_Jose</code>' and
 -    '<code>Guyana</code>' to '<code>Georgetown</code>'.
 +    prefer <code>America/Costa_Rica</code> to
 +    <code>America/San_Jose</code> and <code>America/Guyana</code>
 +    to <code>America/Georgetown</code>.
   </li>
   <li>
     Keep locations compact.
@@ -208,35 +213,40 @@
     Use cities or small islands, not countries or regions, so that any
     future changes do not split individual locations into different
     <code><abbr>tz</abbr></code> regions.
 -    E.g., prefer '<code>Paris</code>' to '<code>France</code>', since
 +    E.g., prefer <code>Europe/Paris</code> to <code>Europe/France</code>,
 +    since
     <a href="https://en.wikipedia.org/wiki/Time_in_France#History">France
     has had multiple time zones</a>.
   </li>
   <li>
 -    Use mainstream English spelling, e.g., prefer '<code>Rome</code>'
 -    to '<code>Roma</code>', and prefer '<code>Athens</code>' to the
 -    Greek '<code>Αθήνα</code>' or the Romanized '<code>Athína</code>'.
 +    Use mainstream English spelling, e.g., prefer
 +    <code>Europe/Rome</code> to <code>Europe/Roma</code>, and
 +    prefer <code>Europe/Athens</code> to the Greek
 +    <code>Europe/Αθήνα</code> or the Romanized
 +    <code>Europe/Athína</code>.
     The POSIX file name restrictions encourage this guideline.
   </li>
   <li>
     Use the most populous among locations in a region,
 -    e.g., prefer '<code>Shanghai</code>' to
 -    '<code>Beijing</code>'.
 +    e.g., prefer <code>Asia/Shanghai</code> to
 +    <code>Asia/Beijing</code>.
     Among locations with similar populations, pick the best-known
 -    location, e.g., prefer '<code>Rome</code>' to
 -    '<code>Milan</code>'.
 +    location, e.g., prefer <code>Europe/Rome</code> to
 +    <code>Europe/Milan</code>.
   </li>
   <li>
 -    Use the singular form, e.g., prefer '<code>Canary</code>' to
 -    '<code>Canaries</code>'.
 +    Use the singular form, e.g., prefer <code>Atlantic/Canary</code> to
 +    <code>Atlantic/Canaries</code>.
   </li>
   <li>
     Omit common suffixes like '<code>_Islands</code>' and
     '<code>_City</code>', unless that would lead to ambiguity.
 -    E.g., prefer '<code>Cayman</code>' to
 -    '<code>Cayman_Islands</code>' and '<code>Guatemala</code>' to
 -    '<code>Guatemala_City</code>', but prefer
 -    '<code>Mexico_City</code>' to '<code>Mexico</code>'
 +    E.g., prefer <code>America/Cayman</code> to
 +    <code>America/Cayman_Islands</code> and
 +    <code>America/Guatemala</code> to
 +    <code>America/Guatemala_City</code>, but prefer
 +    <code>America/Mexico_City</code> to
 +    <code>America/Mexico</code>
     because <a href="https://en.wikipedia.org/wiki/Time_in_Mexico">the
     country of Mexico has several time zones</a>.
   </li>
@@ -245,13 +255,14 @@
   </li>
   <li>
     Omit '<code>.</code>' from abbreviations in names.
 -    E.g., prefer '<code>St_Helena</code>' to '<code>St._Helena</code>'.
 +    E.g., prefer <code>Atlantic/St_Helena</code> to
 +    <code>Atlantic/St._Helena</code>.
   </li>
   <li>
     Do not change established names if they only marginally violate
     the above guidelines.
 -    For example, don't change the existing name '<code>Rome</code>' to
 -    '<code>Milan</code>' merely because Milan's population has grown
 +    For example, do not change the existing name <code>Europe/Rome</code> to
 +    <code>Europe/Milan</code> merely because Milan's population has grown
     to be somewhat greater than Rome's.
   </li>
   <li>
@@ -318,8 +329,10 @@
     Use three to six characters that are ASCII alphanumerics or
     '<code>+</code>' or '<code>-</code>'.
     Previous editions of this database also used characters like
 -    '<code> </code>' and '<code>?</code>', but these characters have a
 -    special meaning to the shell and cause commands like
 +    space and '<code>?</code>', but these characters have a
 +    special meaning to the
 +    <a href="https://en.wikipedia.org/wiki/Unix_shell">UNIX shell</a>
 +    and cause commands like
     '<code><a href="http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#set">set</a>
     `<a href="http://pubs.opengroup.org/onlinepubs/9699919799/utilities/date.html">date</a>`</code>'
     to have unexpected effects.
@@ -688,7 +701,7 @@
     subsecond accuracy is needed.
   </li>
   <li>
 -    Civil time was not based on atomic time before 1972, and we don't
 +    Civil time was not based on atomic time before 1972, and we do not
     know the history of
     <a href="https://en.wikipedia.org/wiki/Earth's_rotation">earth's
     rotation</a> accurately enough to map <a
@@ -720,7 +733,7 @@
     Ideally it would contain information about when data entries are
     incomplete or dicey.
     Partial temporal knowledge is a field of active research, though,
 -    and it's not clear how to apply it here.
 +    and it is not clear how to apply it here.
   </li>
 </ul>
@@ -764,7 +777,7 @@
     Unfortunately, the POSIX
     <code>TZ</code> string takes a form that is hard to describe and
     is error-prone in practice.
 -    Also, POSIX <code>TZ</code> strings can't deal with daylight
 +    Also, POSIX <code>TZ</code> strings cannot deal with daylight
     saving time rules not based on the Gregorian calendar (as in
     Iran), or with situations where more than two time zone
     abbreviations or <abbr>UT</abbr> offsets are used in an area.
@@ -874,7 +887,7 @@
     need access to multiple time zone rulesets.
   </li>
   <li>
 -    In POSIX, there's no tamper-proof way for a process to learn the
 +    In POSIX, there is no tamper-proof way for a process to learn the
     system's best idea of local wall clock.
     (This is important for applications that an administrator wants
     used only at certain times &ndash; without regard to whether the
@@ -973,14 +986,16 @@
     by subsequent calls to <code>localtime</code>.
     Source code for portable applications that "must" run on local wall
     clock time should call <code>tzsetwall</code>;
 -    if such code is moved to "old" systems that don't
 -    provide <code>tzsetwall</code>, you won't be able to generate an
 +    if such code is moved to "old" systems that do not
 +    provide <code>tzsetwall</code>, you will not be able to generate an
     executable program.
     (These functions also arrange for local wall clock time to
     be used if <code>tzset</code> is called &ndash; directly or
 -    indirectly &ndash; and there's no <code>TZ</code> environment
 +    indirectly &ndash; and there is no <code>TZ</code> environment
     variable; portable applications should not, however, rely on this
 -    behavior since it's not the way SVR2 systems behave.)
 +    behavior since it is not the way <a
 +    href="https://en.wikipedia.org/wiki/UNIX_System_V#SVR2"><abbr>SVR2</abbr></a>
 +    systems behave.)
   </li>
   <li>
     Negative <code>time_t</code> values are supported, on systems
@@ -1040,7 +1055,7 @@
   <li>
     The <a href="https://en.wikipedia.org/wiki/Version_7_Unix">7th Edition
     UNIX</a> <code>timezone</code> function is not present in this
 -    package; it's impossible to reliably map <code>timezone</code>'s
 +    package; it is impossible to reliably map <code>timezone</code>'s
     arguments (a "minutes west of <abbr>GMT</abbr>" value and a
     "daylight saving time in effect" flag) to a time zone
     abbreviation, and we refuse to guess.
@@ -1052,7 +1067,9 @@
     zone abbreviation to use.
   </li>
   <li>
 -    The <abbr>4.2BSD</abbr> <code>gettimeofday</code> function is not
 +    The <a
 +    href="https://en.wikipedia.org/wiki/History_of_the_Berkeley_Software_Distribution#4.2BSD"><abbr>4.2BSD</abbr></a>
 +    <code>gettimeofday</code> function is not
     used in this package.
     This formerly let users obtain the current <abbr>UTC</abbr> offset
     and <abbr>DST</abbr> flag, but this functionality was removed in
@@ -1061,7 +1078,7 @@
   <li>
     In <abbr>SVR2</abbr>, time conversion fails for near-minimum or
     near-maximum <code>time_t</code> values when doing conversions
 -    for places that don't use <abbr>UT</abbr>.
 +    for places that do not use <abbr>UT</abbr>.
     This package takes care to do these conversions correctly.
     A comment in the source code tells how to get compatibly wrong
     results.
@@ -1155,10 +1172,10 @@
 Calendrical issues are a bit out of scope for a time zone database,
 but they indicate the sort of problems that we would run into if we
 extended the time zone database further into the past.
 -An excellent resource in this area is Nachum Dershowitz and Edward M.
 -Reingold, <cite><a
 -href="https://www.cs.tau.ac.il/~nachum/calendar-book/third-edition/">Calendrical
 -Calculations: Third Edition</a></cite>, Cambridge University Press (2008).
 +An excellent resource in this area is Edward M. Reingold
 +and Nachum Dershowitz, <cite><a
 +href="https://www.cambridge.org/fr/academic/subjects/computer-science/computing-general-interest/calendrical-calculations-ultimate-edition-4th-edition">Calendrical
 +Calculations: The Ultimate Edition</a></cite>, Cambridge University Press (2018).
 Other information and sources are given in the file '<code>calendars</code>'
 in the <code><abbr>tz</abbr></code> distribution.
 They sometimes disagree.
@@ -1170,11 +1187,11 @@
 <p>
 Some people's work schedules
 use <a href="https://en.wikipedia.org/wiki/Timekeeping on Mars">Mars time</a>.
 -Jet Propulsion Laboratory (JPL) coordinators have kept Mars time on
 -and off at least since 1997 for the
 +Jet Propulsion Laboratory (JPL) coordinators kept Mars time on
 +and off during the
 <a href="https://en.wikipedia.org/wiki/Mars_Pathfinder#End_of_mission">Mars
 Pathfinder</a> mission.
 -Some of their family members have also adapted to Mars time.
 +Some of their family members also adapted to Mars time.
 Dozens of special Mars watches were built for JPL workers who kept
 Mars time during the Mars Exploration Rovers mission (2004).
 These timepieces look like normal Seikos and Citizens but use Mars
@@ -1262,7 +1279,7 @@
     Jia-Rui Chong,
     "<a href="http://articles.latimes.com/2004/jan/14/science/sci-marstime14">Workdays
     Fit for a Martian</a>", <cite>Los Angeles Times</cite>
 -    (2004-01-14), pp A1, A20-A21.
 +    (2004-01-14), pp A1, A20&ndash;A21.
   </li>
   <li>
     Tom Chmielewski,
 --- contrib/tzdata/version.orig
 +++ contrib/tzdata/version
@@ -1 +1 @@
 -2018d
 +2018e
 --- contrib/tzdata/ziguard.awk.orig
 +++ contrib/tzdata/ziguard.awk
@@ -13,20 +13,31 @@
 # rearguard format.
 BEGIN {
 -  dst_type["vanguard.zi"] = 1
 -  dst_type["main.zi"] = 1
 -  dst_type["rearguard.zi"] = 1
 +  dataform_type["vanguard"] = 1
 +  dataform_type["main"] = 1
 +  dataform_type["rearguard"] = 1
 -  # The command line should set OUTFILE to the name of the output file.
 -  if (!dst_type[outfile]) exit 1
 -  vanguard = outfile == "vanguard.zi"
 +  # The command line should set DATAFORM.
 +  if (!dataform_type[DATAFORM]) exit 1
 +  vanguard = DATAFORM == "vanguard"
 }
 /^Zone/ { zone = $2 }
 -outfile != "main.zi" {
 +DATAFORM != "main" {
   in_comment = /^#/
 +  uncomment = comment_out = 0
 +  # If the line should differ due to Czechoslovakia using negative SAVE values,
 +  # uncomment the desired version and comment out the undesired one.
 +  if (zone == "Europe/Prague" && /1947 Feb 23/) {
 +    if (($(in_comment + 2) != "-") == vanguard) {
 +      uncomment = in_comment
 +    } else {
 +      comment_out = !in_comment
 +    }
 +  }
 +
   # If this line should differ due to Ireland using negative SAVE values,
   # uncomment the desired version and comment out the undesired one.
   Rule_Eire = /^#?Rule[\t ]+Eire[\t ]/
@@ -37,11 +48,38 @@
     if ((Rule_Eire \
 	 || (Zone_Dublin_post_1968 && $(in_comment + 3) == "IST/GMT"))	\
 	== vanguard) {
 -      sub(/^#/, "")
 -    } else if (/^[^#]/) {
 -      sub(/^/, "#")
 +      uncomment = in_comment
 +    } else {
 +      comment_out = !in_comment
     }
   }
 +
 +  # If this line should differ due to Namibia using Rule SAVE suffixes,
 +  # uncomment the desired version and comment out the undesired one.
 +  Rule_Namibia = /^#?Rule[\t ]+Namibia[\t ]/
 +  Zone_using_Namibia_rule \
 +    = (zone == "Africa/Windhoek" \
 +       && ($(in_comment + 2) == "Namibia" \
 +	   || (1994 <= $(in_comment + 4) && $(in_comment + 4) <= 2017) \
 +	   || in_comment + 3 == NF))
 +  if (Rule_Namibia || Zone_using_Namibia_rule) {
 +      if ((Rule_Namibia \
 +	   ? ($(in_comment + 9) ~ /^-/ \
 +	      || ($(in_comment + 9) == 0 && $(in_comment + 10) == "CAT")) \
 +	   : $(in_comment + 1) == "2:00" && $(in_comment + 2) == "Namibia") \
 +	  == vanguard) {
 +      uncomment = in_comment
 +    } else {
 +      comment_out = !in_comment
 +    }
 +  }
 +
 +  if (uncomment) {
 +    sub(/^#/, "")
 +  }
 +  if (comment_out) {
 +    sub(/^/, "#")
 +  }
 }
 # If a Link line is followed by a Zone line for the same data, comment
--- a/share/security/patches/EN-18:06/tzdata-2018e.patch.asc
+++ b/share/security/patches/EN-18:06/tzdata-2018e.patch.asc
@ -0,0 +1,18 @@
 -----BEGIN PGP SIGNATURE-----
 iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxvQlfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
 MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
 5cIEgg//XFE1ecg9Ig1L76g4/e73j2ebLpT6bF1XIlyPnZJJZ2sMbH9jpyrdFb8D
 mkbmrY2N/NIEx6m5Mx/Go6SQ41tQosdlEZVezu4C1j4SKlcCIctKsRhdi8sdYXFm
 tuWjTjBeWQ9IvoPjMDYt7WmkrX5hR5vTiXFvFlB9w3Ao7TSIwuwLtlBFySEG1eKR
 +rJs7AqeSLR5tdppJA1q3N2WOGmSBAZu0kz23xJu3EKTcxIhV1LQ9rbi0HhxY00d
 yyvf/yWV7z0slPyuug5V5a+EaVm3FGflWes/Uv0ZBkNtCgy2KlcgeJjWpQoi3ziL
 5rqshQBGEkYxa+DKJiJz2hP4B+MnIgYQtUSmenOLMH4T7RMpNtBNdFbVOOJojokQ
 dnHWrrlSdjyNuLcyARqRgah2+T+p9pIyMKCcsE5AKI3d8q20flsUSThZa2cuBWZe
 p4XrdBPo+9bPr6v4rduJkE3ZnudHmDLTjhG9aCQ2CYyoqu2CRFeCxbW40rhHg7T1
 jre7xjDQ0rDnuOxzF7CfXFKChN6cJRtKox6wj9lcvg4v/fXh93Z85oJytzYXPQIg
 0n64N0fGerdswVYGwqHxz8T1lURESc11mtZ1rhHWDv12S/Cbszfvh0tqoaewOTpP
 Jzdmb+MVzKaCu0jNjmAm3K7QmZ8FtXTXCiq+hEhWlnGusNvFMrQ=
 =t6qO
 -----END PGP SIGNATURE-----
--- a/share/security/patches/SA-18:06/debugreg.10.4.patch
+++ b/share/security/patches/SA-18:06/debugreg.10.4.patch
@ -0,0 +1,295 @@
 --- sys/amd64/amd64/exception.S.orig
 +++ sys/amd64/amd64/exception.S
@@ -108,8 +108,6 @@
 	movq $0,TF_ADDR(%rsp) ; \
 	movq $0,TF_ERR(%rsp) ; \
 	jmp alltraps_noen
 -IDTVEC(dbg)
 -	TRAP_NOEN(T_TRCTRAP)
 IDTVEC(bpt)
 	TRAP_NOEN(T_BPTFLT)
 #ifdef KDTRACE_HOOKS
@@ -436,6 +434,101 @@
 	sysret
 /*
 + * DB# handler is very similar to NM#, because 'mov/pop %ss' delay
 + * generation of exception until the next instruction is executed,
 + * which might be a kernel entry.  So we must execute the handler
 + * on IST stack and be ready for non-kernel GSBASE.
 + */
 +IDTVEC(dbg)
 +	subq	$TF_RIP,%rsp
 +	movl	$(T_TRCTRAP),TF_TRAPNO(%rsp)
 +	movq	$0,TF_ADDR(%rsp)
 +	movq	$0,TF_ERR(%rsp)
 +	movq	%rdi,TF_RDI(%rsp)
 +	movq	%rsi,TF_RSI(%rsp)
 +	movq	%rdx,TF_RDX(%rsp)
 +	movq	%rcx,TF_RCX(%rsp)
 +	movq	%r8,TF_R8(%rsp)
 +	movq	%r9,TF_R9(%rsp)
 +	movq	%rax,TF_RAX(%rsp)
 +	movq	%rbx,TF_RBX(%rsp)
 +	movq	%rbp,TF_RBP(%rsp)
 +	movq	%r10,TF_R10(%rsp)
 +	movq	%r11,TF_R11(%rsp)
 +	movq	%r12,TF_R12(%rsp)
 +	movq	%r13,TF_R13(%rsp)
 +	movq	%r14,TF_R14(%rsp)
 +	movq	%r15,TF_R15(%rsp)
 +	movw	%fs,TF_FS(%rsp)
 +	movw	%gs,TF_GS(%rsp)
 +	movw	%es,TF_ES(%rsp)
 +	movw	%ds,TF_DS(%rsp)
 +	movl	$TF_HASSEGS,TF_FLAGS(%rsp)
 +	cld
 +	testb	$SEL_RPL_MASK,TF_CS(%rsp)
 +	jnz	dbg_fromuserspace
 +	/*
 +	 * We've interrupted the kernel.  Preserve GS.base in %r12.
 +	 */
 +	movl	$MSR_GSBASE,%ecx
 +	rdmsr
 +	movq	%rax,%r12
 +	shlq	$32,%rdx
 +	orq	%rdx,%r12
 +	/* Retrieve and load the canonical value for GS.base. */
 +	movq	TF_SIZE(%rsp),%rdx
 +	movl	%edx,%eax
 +	shrq	$32,%rdx
 +	wrmsr
 +	FAKE_MCOUNT(TF_RIP(%rsp))
 +	movq	%rsp,%rdi
 +	call	trap
 +	MEXITCOUNT
 +	/*
 +	 * Put back the preserved MSR_GSBASE value.
 +	 */
 +	movl	$MSR_GSBASE,%ecx
 +	movq	%r12,%rdx
 +	movl	%edx,%eax
 +	shrq	$32,%rdx
 +	wrmsr
 +	movq	TF_RDI(%rsp),%rdi
 +	movq	TF_RSI(%rsp),%rsi
 +	movq	TF_RDX(%rsp),%rdx
 +	movq	TF_RCX(%rsp),%rcx
 +	movq	TF_R8(%rsp),%r8
 +	movq	TF_R9(%rsp),%r9
 +	movq	TF_RAX(%rsp),%rax
 +	movq	TF_RBX(%rsp),%rbx
 +	movq	TF_RBP(%rsp),%rbp
 +	movq	TF_R10(%rsp),%r10
 +	movq	TF_R11(%rsp),%r11
 +	movq	TF_R12(%rsp),%r12
 +	movq	TF_R13(%rsp),%r13
 +	movq	TF_R14(%rsp),%r14
 +	movq	TF_R15(%rsp),%r15
 +	addq	$TF_RIP,%rsp
 +	jmp	doreti_iret
 +dbg_fromuserspace:
 +	/*
 +	 * Switch to kernel GSBASE and kernel page table, and copy frame
 +	 * from the IST stack to the normal kernel stack, since trap()
 +	 * re-enables interrupts, and since we might trap on DB# while
 +	 * in trap().
 +	 */
 +	swapgs
 +	movq	PCPU(RSP0),%rax
 +	movl	$TF_SIZE,%ecx
 +	subq	%rcx,%rax
 +	movq	%rax,%rdi
 +	movq	%rsp,%rsi
 +	rep;movsb
 +	movq	%rax,%rsp
 +	movq	PCPU(CURPCB),%rdi
 +	orl	$PCB_FULL_IRET,PCB_FLAGS(%rdi)
 +	jmp	calltrap
 +
 +/*
  * NMI handling is special.
  *
  * First, NMIs do not respect the state of the processor's RFLAGS.IF
 --- sys/amd64/amd64/machdep.c.orig
 +++ sys/amd64/amd64/machdep.c
@@ -1023,6 +1023,7 @@
 static char dblfault_stack[PAGE_SIZE] __aligned(16);
 static char nmi0_stack[PAGE_SIZE] __aligned(16);
 +static char dbg0_stack[PAGE_SIZE] __aligned(16);
 CTASSERT(sizeof(struct nmi_pcpu) == 16);
 struct amd64tss common_tss[MAXCPU];
@@ -1908,7 +1909,7 @@
 	for (x = 0; x < NIDT; x++)
 		setidt(x, &IDTVEC(rsvd), SDT_SYSIGT, SEL_KPL, 0);
 	setidt(IDT_DE, &IDTVEC(div),  SDT_SYSIGT, SEL_KPL, 0);
 -	setidt(IDT_DB, &IDTVEC(dbg),  SDT_SYSIGT, SEL_KPL, 0);
 +	setidt(IDT_DB, &IDTVEC(dbg),  SDT_SYSIGT, SEL_KPL, 4);
 	setidt(IDT_NMI, &IDTVEC(nmi),  SDT_SYSIGT, SEL_KPL, 2);
  	setidt(IDT_BP, &IDTVEC(bpt),  SDT_SYSIGT, SEL_UPL, 0);
 	setidt(IDT_OF, &IDTVEC(ofl),  SDT_SYSIGT, SEL_KPL, 0);
@@ -1966,6 +1967,13 @@
 	np->np_pcpu = (register_t) pc;
 	common_tss[0].tss_ist2 = (long) np;
 +	/*
 +	 * DB# stack, runs on ist4.
 +	 */
 +	np = ((struct nmi_pcpu *) &dbg0_stack[sizeof(dbg0_stack)]) - 1;
 +	np->np_pcpu = (register_t) pc;
 +	common_tss[0].tss_ist4 = (long) np;
 +
 	/* Set the IO permission bitmap (empty due to tss seg limit) */
 	common_tss[0].tss_iobase = sizeof(struct amd64tss) +
 	    IOPAGES * PAGE_SIZE;
 --- sys/amd64/amd64/mp_machdep.c.orig
 +++ sys/amd64/amd64/mp_machdep.c
@@ -98,6 +98,7 @@
 /* Temporary variables for init_secondary()  */
 char *doublefault_stack;
 char *nmi_stack;
 +char *dbg_stack;
 void *dpcpu;
 struct pcb stoppcbs[MAXCPU];
@@ -647,6 +648,10 @@
 	np = ((struct nmi_pcpu *) &nmi_stack[PAGE_SIZE]) - 1;
 	common_tss[cpu].tss_ist2 = (long) np;
 +	/* The DB# stack runs on IST4. */
 +	np = ((struct nmi_pcpu *) &dbg_stack[PAGE_SIZE]) - 1;
 +	common_tss[cpu].tss_ist4 = (long) np;
 +
 	/* Prepare private GDT */
 	gdt_segs[GPROC0_SEL].ssd_base = (long) &common_tss[cpu];
 	for (x = 0; x < NGDT; x++) {
@@ -682,6 +687,10 @@
 	/* Save the per-cpu pointer for use by the NMI handler. */
 	np->np_pcpu = (register_t) pc;
 +	/* Save the per-cpu pointer for use by the DB# handler. */
 +	np = ((struct nmi_pcpu *) &dbg_stack[PAGE_SIZE]) - 1;
 +	np->np_pcpu = (register_t) pc;
 +
 	wrmsr(MSR_FSBASE, 0);		/* User value */
 	wrmsr(MSR_GSBASE, (u_int64_t)pc);
 	wrmsr(MSR_KGSBASE, (u_int64_t)pc);	/* XXX User value while we're in the kernel */
@@ -970,6 +979,8 @@
 		    PAGE_SIZE, M_WAITOK | M_ZERO);
 		nmi_stack = (char *)kmem_malloc(kernel_arena, PAGE_SIZE,
 		    M_WAITOK | M_ZERO);
 +		dbg_stack = (char *)kmem_malloc(kernel_arena, PAGE_SIZE,
 +		    M_WAITOK | M_ZERO);
 		dpcpu = (void *)kmem_malloc(kernel_arena, DPCPU_SIZE,
 		    M_WAITOK | M_ZERO);
 --- sys/amd64/amd64/trap.c.orig
 +++ sys/amd64/amd64/trap.c
@@ -45,6 +45,7 @@
  */
 #include "opt_clock.h"
 +#include "opt_compat.h"
 #include "opt_cpu.h"
 #include "opt_hwpmc_hooks.h"
 #include "opt_isa.h"
@@ -98,6 +99,9 @@
 #include <sys/dtrace_bsd.h>
 #endif
 +extern inthand_t IDTVEC(bpt), IDTVEC(dbg), IDTVEC(fast_syscall),
 +    IDTVEC(fast_syscall32), IDTVEC(int0x80_syscall);
 +
 extern void trap(struct trapframe *frame);
 extern void syscall(struct trapframe *frame);
 void dblfault_handler(struct trapframe *frame);
@@ -549,7 +553,40 @@
 				load_dr6(rdr6() & 0xfffffff0);
 				goto out;
 			}
 +
 			/*
 +			 * Malicious user code can configure a debug
 +			 * register watchpoint to trap on data access
 +			 * to the top of stack and then execute 'pop
 +			 * %ss; int 3'.  Due to exception deferral for
 +			 * 'pop %ss', the CPU will not interrupt 'int
 +			 * 3' to raise the DB# exception for the debug
 +			 * register but will postpone the DB# until
 +			 * execution of the first instruction of the
 +			 * BP# handler (in kernel mode).  Normally the
 +			 * previous check would ignore DB# exceptions
 +			 * for watchpoints on user addresses raised in
 +			 * kernel mode.  However, some CPU errata
 +			 * include cases where DB# exceptions do not
 +			 * properly set bits in %dr6, e.g. Haswell
 +			 * HSD23 and Skylake-X SKZ24.
 +			 *
 +			 * A deferred DB# can also be raised on the
 +			 * first instructions of system call entry
 +			 * points or single-step traps via similar use
 +			 * of 'pop %ss' or 'mov xxx, %ss'.
 +			 */
 +			if (frame->tf_rip == (uintptr_t)IDTVEC(fast_syscall) ||
 +#ifdef COMPAT_FREEBSD32
 +			    frame->tf_rip ==
 +			    (uintptr_t)IDTVEC(int0x80_syscall) ||
 +#endif
 +			    frame->tf_rip == (uintptr_t)IDTVEC(bpt) ||
 +			    frame->tf_rip == (uintptr_t)IDTVEC(dbg) ||
 +			    /* Needed for AMD. */
 +			    frame->tf_rip == (uintptr_t)IDTVEC(fast_syscall32))
 +				return;
 +			/*
 			 * FALLTHROUGH (TRCTRAP kernel mode, kernel address)
 			 */
 		case T_BPTFLT:
 --- sys/i386/i386/trap.c.orig
 +++ sys/i386/i386/trap.c
@@ -116,6 +116,8 @@
 extern inthand_t IDTVEC(lcall_syscall);
 +extern inthand_t IDTVEC(bpt), IDTVEC(dbg), IDTVEC(int0x80_syscall);
 +
 #define MAX_TRAP_MSG		32
 static char *trap_msg[] = {
 	"",					/*  0 unused */
@@ -683,7 +685,35 @@
 				load_dr6(rdr6() & 0xfffffff0);
 				goto out;
 			}
 +
 			/*
 +			 * Malicious user code can configure a debug
 +			 * register watchpoint to trap on data access
 +			 * to the top of stack and then execute 'pop
 +			 * %ss; int 3'.  Due to exception deferral for
 +			 * 'pop %ss', the CPU will not interrupt 'int
 +			 * 3' to raise the DB# exception for the debug
 +			 * register but will postpone the DB# until
 +			 * execution of the first instruction of the
 +			 * BP# handler (in kernel mode).  Normally the
 +			 * previous check would ignore DB# exceptions
 +			 * for watchpoints on user addresses raised in
 +			 * kernel mode.  However, some CPU errata
 +			 * include cases where DB# exceptions do not
 +			 * properly set bits in %dr6, e.g. Haswell
 +			 * HSD23 and Skylake-X SKZ24.
 +			 *
 +			 * A deferred DB# can also be raised on the
 +			 * first instructions of system call entry
 +			 * points or single-step traps via similar use
 +			 * of 'pop %ss' or 'mov xxx, %ss'.
 +			 */
 +			if (frame->tf_eip ==
 +			    (uintptr_t)IDTVEC(int0x80_syscall) ||
 +			    frame->tf_eip == (uintptr_t)IDTVEC(bpt) ||
 +			    frame->tf_eip == (uintptr_t)IDTVEC(dbg))
 +				return;
 +			/*
 			 * FALLTHROUGH (TRCTRAP kernel mode, kernel address)
 			 */
 		case T_BPTFLT:
--- a/share/security/patches/SA-18:06/debugreg.10.4.patch.asc
+++ b/share/security/patches/SA-18:06/debugreg.10.4.patch.asc
@ -0,0 +1,18 @@
 -----BEGIN PGP SIGNATURE-----
 iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxw1dfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
 MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
 5cJZkw//eSdjhBGww2Q/GXezM9AkyNHgqYL3FuWpP2TPght7YbfoZYHrpzn3oPbC
 JfqtNrh0rBVKxBag3+aZ7VZ2ktGqjiNEVUtQGfYSWBhtaRz7o6H1jkpYWKNqjYWA
 /7cNi4+5FqSa1SmC+aPnM6jR+BI8k7lsW9CrCA3AgB/wfswzbd5X2SjUgeDWACnO
 1bEC4hEBd4I57Gk0S++3iHhM1LKANVoLDZsCU7sF+6aWxQNxjnswLvG0UjIdAwsQ
 T9g20sShkZBJrAD+IQEEqkxrW/0RVoO6RuS3bQXw8U4ZeIhOV0RzV7EsEtcGJIzg
 HZTiSm6jfxvjtvA52yG4TgnCknGI5quKlWTCj4CI+YnXxCu7NruDg1bOowyel1Of
 2FjX7c1oEDenVTDBMD9T/o2UpOc/L8xXZtoqLR4iHXSCS2yPo4ikJnJHNVXseEZg
 6HlRH+0p0OJ4ciGwN0xt4W5n+0J/8p2xlPPOGhjfDLFg+NiXbFyIWNCZlz6PO8Kc
 +sMQ1Oq14bIqXlrwAq5EaGJWxXILC2VC+qU9XnRNTskGhLVc3I/9qcaOE2QLjH9Z
 ufa6cRHw3KOn2Yd+b06/OzlRhVUn5dCSIXWiTt4RnPF9IFWK6WESjPkC89p4OcxN
 wFP5VGRbjyANbeD/IWksFlN+I6Ss0+eROhIBG6vgt+Lra1g62js=
 =4kXk
 -----END PGP SIGNATURE-----
--- a/share/security/patches/SA-18:06/debugreg.11.1.patch
+++ b/share/security/patches/SA-18:06/debugreg.11.1.patch
@ -0,0 +1,351 @@
 --- sys/amd64/amd64/exception.S.orig
 +++ sys/amd64/amd64/exception.S
@@ -116,7 +116,6 @@
 	jmp alltraps_noen
 	.endm
 -	TRAP_NOEN	dbg, T_TRCTRAP
 	TRAP_NOEN	bpt, T_BPTFLT
 #ifdef KDTRACE_HOOKS
 	TRAP_NOEN	dtrace_ret, T_DTRACE_RET
@@ -509,6 +508,121 @@
 	sysret
 /*
 + * DB# handler is very similar to NM#, because 'mov/pop %ss' delay
 + * generation of exception until the next instruction is executed,
 + * which might be a kernel entry.  So we must execute the handler
 + * on IST stack and be ready for non-kernel GSBASE.
 + */
 +IDTVEC(dbg)
 +	subq	$TF_RIP,%rsp
 +	movl	$(T_TRCTRAP),TF_TRAPNO(%rsp)
 +	movq	$0,TF_ADDR(%rsp)
 +	movq	$0,TF_ERR(%rsp)
 +	movq	%rdi,TF_RDI(%rsp)
 +	movq	%rsi,TF_RSI(%rsp)
 +	movq	%rdx,TF_RDX(%rsp)
 +	movq	%rcx,TF_RCX(%rsp)
 +	movq	%r8,TF_R8(%rsp)
 +	movq	%r9,TF_R9(%rsp)
 +	movq	%rax,TF_RAX(%rsp)
 +	movq	%rbx,TF_RBX(%rsp)
 +	movq	%rbp,TF_RBP(%rsp)
 +	movq	%r10,TF_R10(%rsp)
 +	movq	%r11,TF_R11(%rsp)
 +	movq	%r12,TF_R12(%rsp)
 +	movq	%r13,TF_R13(%rsp)
 +	movq	%r14,TF_R14(%rsp)
 +	movq	%r15,TF_R15(%rsp)
 +	SAVE_SEGS
 +	movl	$TF_HASSEGS,TF_FLAGS(%rsp)
 +	cld
 +	testb	$SEL_RPL_MASK,TF_CS(%rsp)
 +	jnz	dbg_fromuserspace
 +	/*
 +	 * We've interrupted the kernel.  Preserve GS.base in %r12,
 +	 * %cr3 in %r13, and possibly lower half of MSR_IA32_SPEC_CTL in %r14d.
 +	 */
 +	movl	$MSR_GSBASE,%ecx
 +	rdmsr
 +	movq	%rax,%r12
 +	shlq	$32,%rdx
 +	orq	%rdx,%r12
 +	/* Retrieve and load the canonical value for GS.base. */
 +	movq	TF_SIZE(%rsp),%rdx
 +	movl	%edx,%eax
 +	shrq	$32,%rdx
 +	wrmsr
 +	movq	%cr3,%r13
 +	movq	PCPU(KCR3),%rax
 +	cmpq	$~0,%rax
 +	je	1f
 +	movq	%rax,%cr3
 +1:	testl	$CPUID_STDEXT3_IBPB,cpu_stdext_feature3(%rip)
 +	je	2f
 +	movl	$MSR_IA32_SPEC_CTRL,%ecx
 +	rdmsr
 +	movl	%eax,%r14d
 +	call	handle_ibrs_entry
 +2:	FAKE_MCOUNT(TF_RIP(%rsp))
 +	movq	%rsp,%rdi
 +	call	trap
 +	MEXITCOUNT
 +	testl	$CPUID_STDEXT3_IBPB,cpu_stdext_feature3(%rip)
 +	je	3f
 +	movl	%r14d,%eax
 +	xorl	%edx,%edx
 +	movl	$MSR_IA32_SPEC_CTRL,%ecx
 +	wrmsr
 +	/*
 +	 * Put back the preserved MSR_GSBASE value.
 +	 */
 +3:	movl	$MSR_GSBASE,%ecx
 +	movq	%r12,%rdx
 +	movl	%edx,%eax
 +	shrq	$32,%rdx
 +	wrmsr
 +	movq	%r13,%cr3
 +	RESTORE_REGS
 +	addq	$TF_RIP,%rsp
 +	jmp	doreti_iret
 +dbg_fromuserspace:
 +	/*
 +	 * Switch to kernel GSBASE and kernel page table, and copy frame
 +	 * from the IST stack to the normal kernel stack, since trap()
 +	 * re-enables interrupts, and since we might trap on DB# while
 +	 * in trap().
 +	 */
 +	swapgs
 +	movq	PCPU(KCR3),%rax
 +	cmpq	$~0,%rax
 +	je	1f
 +	movq	%rax,%cr3
 +1:	movq	PCPU(RSP0),%rax
 +	movl	$TF_SIZE,%ecx
 +	subq	%rcx,%rax
 +	movq	%rax,%rdi
 +	movq	%rsp,%rsi
 +	rep;movsb
 +	movq	%rax,%rsp
 +	call	handle_ibrs_entry
 +	movq	PCPU(CURPCB),%rdi
 +	orl	$PCB_FULL_IRET,PCB_FLAGS(%rdi)
 +	testb	$CPUID_STDEXT_FSGSBASE,cpu_stdext_feature(%rip)
 +	jz	3f
 +	cmpw	$KUF32SEL,TF_FS(%rsp)
 +	jne	2f
 +	rdfsbase %rax
 +	movq	%rax,PCB_FSBASE(%rdi)
 +2:	cmpw	$KUG32SEL,TF_GS(%rsp)
 +	jne	3f
 +	movl	$MSR_KGSBASE,%ecx
 +	rdmsr
 +	shlq	$32,%rdx
 +	orq	%rdx,%rax
 +	movq	%rax,PCB_GSBASE(%rdi)
 +3:	jmp	calltrap
 +
 +/*
  * NMI handling is special.
  *
  * First, NMIs do not respect the state of the processor's RFLAGS.IF
 --- sys/amd64/amd64/machdep.c.orig
 +++ sys/amd64/amd64/machdep.c
@@ -675,6 +675,7 @@
 static char dblfault_stack[PAGE_SIZE] __aligned(16);
 static char mce0_stack[PAGE_SIZE] __aligned(16);
 static char nmi0_stack[PAGE_SIZE] __aligned(16);
 +static char dbg0_stack[PAGE_SIZE] __aligned(16);
 CTASSERT(sizeof(struct nmi_pcpu) == 16);
 struct amd64tss common_tss[MAXCPU];
@@ -827,7 +828,7 @@
 	IDTVEC(tss), IDTVEC(missing), IDTVEC(stk), IDTVEC(prot),
 	IDTVEC(page), IDTVEC(mchk), IDTVEC(rsvd), IDTVEC(fpu), IDTVEC(align),
 	IDTVEC(xmm), IDTVEC(dblfault),
 -	IDTVEC(div_pti), IDTVEC(dbg_pti), IDTVEC(bpt_pti),
 +	IDTVEC(div_pti), IDTVEC(bpt_pti),
 	IDTVEC(ofl_pti), IDTVEC(bnd_pti), IDTVEC(ill_pti), IDTVEC(dna_pti),
 	IDTVEC(fpusegm_pti), IDTVEC(tss_pti), IDTVEC(missing_pti),
 	IDTVEC(stk_pti), IDTVEC(prot_pti), IDTVEC(page_pti),
@@ -1637,8 +1638,7 @@
 		    SEL_KPL, 0);
 	setidt(IDT_DE, pti ? &IDTVEC(div_pti) : &IDTVEC(div), SDT_SYSIGT,
 	    SEL_KPL, 0);
 -	setidt(IDT_DB, pti ? &IDTVEC(dbg_pti) : &IDTVEC(dbg), SDT_SYSIGT,
 -	    SEL_KPL, 0);
 +	setidt(IDT_DB, &IDTVEC(dbg), SDT_SYSIGT, SEL_KPL, 4);
 	setidt(IDT_NMI, &IDTVEC(nmi),  SDT_SYSIGT, SEL_KPL, 2);
 	setidt(IDT_BP, pti ? &IDTVEC(bpt_pti) : &IDTVEC(bpt), SDT_SYSIGT,
 	    SEL_UPL, 0);
@@ -1720,6 +1720,13 @@
 	np = ((struct nmi_pcpu *) &mce0_stack[sizeof(mce0_stack)]) - 1;
 	np->np_pcpu = (register_t) pc;
 	common_tss[0].tss_ist3 = (long) np;
 +
 +	/*
 +	 * DB# stack, runs on ist4.
 +	 */
 +	np = ((struct nmi_pcpu *) &dbg0_stack[sizeof(dbg0_stack)]) - 1;
 +	np->np_pcpu = (register_t) pc;
 +	common_tss[0].tss_ist4 = (long) np;
 	/* Set the IO permission bitmap (empty due to tss seg limit) */
 	common_tss[0].tss_iobase = sizeof(struct amd64tss) + IOPERM_BITMAP_SIZE;
 --- sys/amd64/amd64/mp_machdep.c.orig
 +++ sys/amd64/amd64/mp_machdep.c
@@ -87,6 +87,7 @@
 char *doublefault_stack;
 char *mce_stack;
 char *nmi_stack;
 +char *dbg_stack;
 /*
  * Local data and functions.
@@ -225,6 +226,10 @@
 	np = ((struct nmi_pcpu *) &mce_stack[PAGE_SIZE]) - 1;
 	common_tss[cpu].tss_ist3 = (long) np;
 +	/* The DB# stack runs on IST4. */
 +	np = ((struct nmi_pcpu *) &dbg_stack[PAGE_SIZE]) - 1;
 +	common_tss[cpu].tss_ist4 = (long) np;
 +
 	/* Prepare private GDT */
 	gdt_segs[GPROC0_SEL].ssd_base = (long) &common_tss[cpu];
 	for (x = 0; x < NGDT; x++) {
@@ -270,6 +275,10 @@
 	np = ((struct nmi_pcpu *) &mce_stack[PAGE_SIZE]) - 1;
 	np->np_pcpu = (register_t) pc;
 +	/* Save the per-cpu pointer for use by the DB# handler. */
 +	np = ((struct nmi_pcpu *) &dbg_stack[PAGE_SIZE]) - 1;
 +	np->np_pcpu = (register_t) pc;
 +
 	wrmsr(MSR_FSBASE, 0);		/* User value */
 	wrmsr(MSR_GSBASE, (u_int64_t)pc);
 	wrmsr(MSR_KGSBASE, (u_int64_t)pc);	/* XXX User value while we're in the kernel */
@@ -368,6 +377,8 @@
 		    M_WAITOK | M_ZERO);
 		nmi_stack = (char *)kmem_malloc(kernel_arena, PAGE_SIZE,
 		    M_WAITOK | M_ZERO);
 +		dbg_stack = (char *)kmem_malloc(kernel_arena, PAGE_SIZE,
 +		    M_WAITOK | M_ZERO);
 		dpcpu = (void *)kmem_malloc(kernel_arena, DPCPU_SIZE,
 		    M_WAITOK | M_ZERO);
 --- sys/amd64/amd64/pmap.c.orig
 +++ sys/amd64/amd64/pmap.c
@@ -7565,6 +7565,9 @@
 		/* MC# stack IST 3 */
 		va = common_tss[i].tss_ist3 + sizeof(struct nmi_pcpu);
 		pmap_pti_add_kva_locked(va - PAGE_SIZE, va, false);
 +		/* DB# stack IST 4 */
 +		va = common_tss[i].tss_ist4 + sizeof(struct nmi_pcpu);
 +		pmap_pti_add_kva_locked(va - PAGE_SIZE, va, false);
 	}
 	pmap_pti_add_kva_locked((vm_offset_t)kernphys + KERNBASE,
 	    (vm_offset_t)etext, true);
 --- sys/amd64/amd64/trap.c.orig
 +++ sys/amd64/amd64/trap.c
@@ -45,6 +45,7 @@
  */
 #include "opt_clock.h"
 +#include "opt_compat.h"
 #include "opt_cpu.h"
 #include "opt_hwpmc_hooks.h"
 #include "opt_isa.h"
@@ -99,6 +100,11 @@
 #include <sys/dtrace_bsd.h>
 #endif
 +extern inthand_t IDTVEC(bpt), IDTVEC(bpt_pti), IDTVEC(dbg),
 +    IDTVEC(fast_syscall), IDTVEC(fast_syscall_pti), IDTVEC(fast_syscall32),
 +    IDTVEC(int0x80_syscall_pti), IDTVEC(int0x80_syscall);
 +
 +
 extern void __noinline trap(struct trapframe *frame);
 extern void trap_check(struct trapframe *frame);
 extern void syscall(struct trapframe *frame);
@@ -536,7 +542,53 @@
 				load_dr6(rdr6() & ~0xf);
 				goto out;
 			}
 +
 			/*
 +			 * Malicious user code can configure a debug
 +			 * register watchpoint to trap on data access
 +			 * to the top of stack and then execute 'pop
 +			 * %ss; int 3'.  Due to exception deferral for
 +			 * 'pop %ss', the CPU will not interrupt 'int
 +			 * 3' to raise the DB# exception for the debug
 +			 * register but will postpone the DB# until
 +			 * execution of the first instruction of the
 +			 * BP# handler (in kernel mode).  Normally the
 +			 * previous check would ignore DB# exceptions
 +			 * for watchpoints on user addresses raised in
 +			 * kernel mode.  However, some CPU errata
 +			 * include cases where DB# exceptions do not
 +			 * properly set bits in %dr6, e.g. Haswell
 +			 * HSD23 and Skylake-X SKZ24.
 +			 *
 +			 * A deferred DB# can also be raised on the
 +			 * first instructions of system call entry
 +			 * points or single-step traps via similar use
 +			 * of 'pop %ss' or 'mov xxx, %ss'.
 +			 */
 +			if (pti) {
 +				if (frame->tf_rip ==
 +				    (uintptr_t)IDTVEC(fast_syscall_pti) ||
 +#ifdef COMPAT_FREEBSD32
 +				    frame->tf_rip ==
 +				    (uintptr_t)IDTVEC(int0x80_syscall_pti) ||
 +#endif
 +				    frame->tf_rip == (uintptr_t)IDTVEC(bpt_pti))
 +					return;
 +			} else {
 +				if (frame->tf_rip ==
 +				    (uintptr_t)IDTVEC(fast_syscall) ||
 +#ifdef COMPAT_FREEBSD32
 +				    frame->tf_rip ==
 +				    (uintptr_t)IDTVEC(int0x80_syscall) ||
 +#endif
 +				    frame->tf_rip == (uintptr_t)IDTVEC(bpt))
 +					return;
 +			}
 +			if (frame->tf_rip == (uintptr_t)IDTVEC(dbg) ||
 +			    /* Needed for AMD. */
 +			    frame->tf_rip == (uintptr_t)IDTVEC(fast_syscall32))
 +				return;
 +			/*
 			 * FALLTHROUGH (TRCTRAP kernel mode, kernel address)
 			 */
 		case T_BPTFLT:
 --- sys/i386/i386/trap.c.orig
 +++ sys/i386/i386/trap.c
@@ -116,6 +116,8 @@
 extern inthand_t IDTVEC(lcall_syscall);
 +extern inthand_t IDTVEC(bpt), IDTVEC(dbg), IDTVEC(int0x80_syscall);
 +
 #define MAX_TRAP_MSG		32
 static char *trap_msg[] = {
 	"",					/*  0 unused */
@@ -668,7 +670,35 @@
 				load_dr6(rdr6() & ~0xf);
 				goto out;
 			}
 +
 			/*
 +			 * Malicious user code can configure a debug
 +			 * register watchpoint to trap on data access
 +			 * to the top of stack and then execute 'pop
 +			 * %ss; int 3'.  Due to exception deferral for
 +			 * 'pop %ss', the CPU will not interrupt 'int
 +			 * 3' to raise the DB# exception for the debug
 +			 * register but will postpone the DB# until
 +			 * execution of the first instruction of the
 +			 * BP# handler (in kernel mode).  Normally the
 +			 * previous check would ignore DB# exceptions
 +			 * for watchpoints on user addresses raised in
 +			 * kernel mode.  However, some CPU errata
 +			 * include cases where DB# exceptions do not
 +			 * properly set bits in %dr6, e.g. Haswell
 +			 * HSD23 and Skylake-X SKZ24.
 +			 *
 +			 * A deferred DB# can also be raised on the
 +			 * first instructions of system call entry
 +			 * points or single-step traps via similar use
 +			 * of 'pop %ss' or 'mov xxx, %ss'.
 +			 */
 +			if (frame->tf_eip ==
 +			    (uintptr_t)IDTVEC(int0x80_syscall) ||
 +			    frame->tf_eip == (uintptr_t)IDTVEC(bpt) ||
 +			    frame->tf_eip == (uintptr_t)IDTVEC(dbg))
 +				return;
 +			/*
 			 * FALLTHROUGH (TRCTRAP kernel mode, kernel address)
 			 */
 		case T_BPTFLT:
--- a/share/security/patches/SA-18:06/debugreg.11.1.patch.asc
+++ b/share/security/patches/SA-18:06/debugreg.11.1.patch.asc
@ -0,0 +1,18 @@
 -----BEGIN PGP SIGNATURE-----
 iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrxw2RfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
 MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
 5cJlSBAAkuyBE359un4LyuLYWmE+xqM0v766eFkagBW8MSu8zEgNNXAM4fvNdsYq
 teZ1UWK45Nx3fslOu3FLBam3T4YcKcMO3pgFirg/hLsSsMCQT7vo4l7U5WECgKg1
 Yp2gJOq+Dm8lkUqvSLYG4gvOCaPRTOY9aQFY8TW+WWjrl4L9O5orUcARGAuESBPc
 NhdMxfRcWHbIjpzluu+aps2qTDUdf3swJGe50qHH78Iz6pW7VEYEDOI+O6UAw2BD
 E+LAyo1HTW8pH0FvzZAFWxYy+bKXAQNdklF0bs40amFkZupYlGqa4cJljXz5ih9R
 E2CKdiFeaoXYnfkPDQnIEt78LOYzS3dLNsoKub7VyR2Q2uaW89MobU5BIocJ/mXD
 KcTwiUKVyQWtSpxEB3K/aTfCpse1lOiv7vmVKNhiZk8ZDvQx4UcCwLQLZUvOPFNT
 axJCyT5wSB3rTF4IRfuF3YsBGC71ymK9hDnsn+qlhJADkdrfYlPnF74je7yT3W11
 OdnK7vNflQU/fT7PUXJUIGEXAbsFYEbz2gCPgiRyb/weuTLfZbOrvrDn4cmFHSFx
 oFHqJtwkct5jPBBy4G0ydbeBJW+RUr2sOGXsMqyUBcEzcAzrTy1eA6/KAfH1jxIM
 2q/R8tLUyklAuC8Si5Vukg21WWLzOjk+2E260TtjtAkJY4xwIiA=
 =zp4W
 -----END PGP SIGNATURE-----
--- a/share/xml/advisories.xml
+++ b/share/xml/advisories.xml
@ -7,6 +7,19 @@
  <year>
    <name>2018</name>
    <month>
      <name>5</name>
      <day>
 	<name>8</name>
 	<advisory>
 	  <name>FreeBSD-SA-18:06.debugreg</name>
 	</advisory>
      </day>
    </month>
    <month>
      <name>4</name>
--- a/share/xml/notices.xml
+++ b/share/xml/notices.xml
@ -7,6 +7,23 @@
  <year>
    <name>2018</name>
    <month>
      <name>5</name>
      <day>
 	<name>8</name>
 	<notice>
 	  <name>FreeBSD-EN-18:06.tzdata</name>
 	</notice>
 	<notice>
 	  <name>FreeBSD-EN-18:05.mem</name>
 	</notice>
      </day>
    </month>
    <month>
      <name>4</name>