release/doc/en_US.ISO8859-1/errata/article.sgml

   1 <!--
   2         FreeBSD errata document.  Unlike some of the other RELNOTESng
   3         files, this file should remain as a single SGML file, so that
   4         the dollar FreeBSD dollar header has a meaningful modification
   5         time.  This file is all but useless without a datestamp on it,
   6         so we'll take some extra care to make sure it has one.
   7
   8         (If we didn't do this, then the file with the datestamp might
   9         not be the one that received the last change in the document.)
  10
  11 -->
  12
  13 <!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook V4.1-Based Extension//EN" [
  14 <!ENTITY % articles.ent PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Articles Entity Set//EN">
  15 %articles.ent;
  16
  17 <!ENTITY % release PUBLIC "-//FreeBSD//ENTITIES Release Specification//EN">
  18 %release;
  19 ]>
  20
  21 <article>
  22   <articleinfo>
  23     <title>&os;
  24 <![ %release.type.current [
  25     &release.current;
  26 ]]>
  27 <![ %release.type.snapshot [
  28     &release.prev;
  29 ]]>
  30 <![ %release.type.release [
  31     &release.current;
  32 ]]>
  33     Errata</title>
  34
  35     <corpauthor>
  36     The &os; Project
  37     </corpauthor>
  38
  39     <pubdate>$FreeBSD$</pubdate>
  40
  41     <copyright>
  42       <year>2012</year>
  43       <holder role="mailto:doc@FreeBSD.org">The &os; Documentation Project</holder>
  44     </copyright>
  45
  46     <legalnotice id="trademarks" role="trademarks">
  47       &tm-attrib.freebsd;
  48       &tm-attrib.intel;
  49       &tm-attrib.sparc;
  50       &tm-attrib.general;
  51     </legalnotice>
  52   </articleinfo>
  53
  54   <abstract>
  55     <para>This document lists errata items for &os;
  56 <![ %release.type.current [
  57       &release.current;,
  58 ]]>
  59 <![ %release.type.snapshot [
  60       &release.prev;,
  61 ]]>
  62 <![ %release.type.release [
  63       &release.current;,
  64 ]]>
  65       containing significant information discovered after the release
  66       or too late in the release cycle to be otherwise included in the
  67       release documentation.
  68       This information includes security advisories, as well as news
  69       relating to the software or documentation that could affect its
  70       operation or usability.  An up-to-date version of this document
  71       should always be consulted before installing this version of
  72       &os;.</para>
  73
  74     <para>This errata document for &os;
  75 <![ %release.type.current [
  76       &release.current;
  77 ]]>
  78 <![ %release.type.snapshot [
  79       &release.prev;
  80 ]]>
  81 <![ %release.type.release [
  82       &release.current;
  83 ]]>
  84       will be maintained until the release of &os; &release.next;.</para>
  85   </abstract>
  86
  87   <sect1 id="intro">
  88     <title>Introduction</title>
  89
  90     <para>This errata document contains <quote>late-breaking news</quote>
  91       about &os;
  92 <![ %release.type.current [
  93       &release.current;.
  94 ]]>
  95 <![ %release.type.snapshot [
  96       &release.prev;.
  97 ]]>
  98 <![ %release.type.release [
  99       &release.current;.
 100 ]]>
 101       Before installing this version, it is important to consult this
 102       document to learn about any post-release discoveries or problems
 103       that may already have been found and fixed.</para>
 104
 105     <para>Any version of this errata document actually distributed
 106       with the release (for example, on a CDROM distribution) will be
 107       out of date by definition, but other copies are kept updated on
 108       the Internet and should be consulted as the <quote>current
 109       errata</quote> for this release.  These other copies of the
 110       errata are located at <ulink
 111       url="http://www.FreeBSD.org/releases/"></ulink>, plus any sites
 112       which keep up-to-date mirrors of this location.</para>
 113
 114     <para>Source and binary snapshots of &os; &release.branch; also
 115       contain up-to-date copies of this document (as of the time of
 116       the snapshot).</para>
 117
 118     <para>For a list of all &os; CERT security advisories, see <ulink
 119       url="http://www.FreeBSD.org/security/"></ulink> or <ulink
 120       url="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/"></ulink>.</para>
 121
 122   </sect1>
 123
 124   <sect1 id="security">
 125     <title>Security Advisories</title>
 126
 127     <para>Problems described in the following security advisories have
 128       been fixed in &release.current;.  For more information, consult
 129       the individual advisories available from <ulink
 130         url="http://security.FreeBSD.org/"></ulink>.</para>
 131
 132     <informaltable frame="none" pgwide="1">
 133       <tgroup cols="3">
 134       <colspec colwidth="1*">
 135       <colspec colwidth="1*">
 136       <colspec colwidth="3*">
 137
 138       <thead>
 139           <row>
 140             <entry>Advisory</entry>
 141             <entry>Date</entry>
 142             <entry>Topic</entry>
 143           </row>
 144         </thead>
 145
 146         <tbody>
 147           <row>
 148             <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:01.mountd.asc"
 149                 >SA-11:01.mountd</ulink></entry>
 150             <entry>20&nbsp;April&nbsp;2011</entry>
 151             <entry><para>Network ACL mishandling in &man.mountd.8;</para></entry>
 152           </row>
 153
 154           <row>
 155             <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:02.bind.asc"
 156                 >SA-11:02.bind</ulink></entry>
 157             <entry>28&nbsp;May&nbsp;2011</entry>
 158             <entry><para>BIND remote DoS with large RRSIG RRsets and negative
 159                 caching</para></entry>
 160           </row>
 161
 162           <row>
 163             <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:04.compress.asc"
 164                 >SA-11:04.compress</ulink></entry>
 165             <entry>28&nbsp;September&nbsp;2011</entry>
 166             <entry><para>Errors handling corrupt compress file in
 167                 &man.compress.1; and &man.gzip.1;</para></entry>
 168           </row>
 169
 170           <row>
 171             <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:05.unix.asc"
 172                 >SA-11:05.unix</ulink></entry>
 173             <entry>28&nbsp;September&nbsp;2011</entry>
 174             <entry><para>Buffer overflow in handling of UNIX socket
 175                 addresses</para></entry>
 176           </row>
 177
 178           <row>
 179             <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:06.bind.asc"
 180                 >SA-11:06.bind</ulink></entry>
 181             <entry>23&nbsp;December&nbsp;2011</entry>
 182             <entry><para>Remote packet Denial of Service against &man.named.8;
 183                 servers</para></entry>
 184           </row>
 185
 186           <row>
 187             <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:07.chroot.asc"
 188                 >SA-11:07.chroot</ulink></entry>
 189             <entry>23&nbsp;December&nbsp;2011</entry>
 190             <entry><para>Code execution via chrooted ftpd</para></entry>
 191           </row>
 192
 193           <row>
 194             <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc"
 195                 >SA-11:08.telnetd</ulink></entry>
 196             <entry>23&nbsp;December&nbsp;2011</entry>
 197             <entry><para>telnetd code execution vulnerability</para></entry>
 198           </row>
 199
 200           <row>
 201             <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:09.pam_ssh.asc"
 202                 >SA-11:09.pam_ssh</ulink></entry>
 203             <entry>23&nbsp;December&nbsp;2011</entry>
 204             <entry><para>pam_ssh improperly grants access when user account has
 205                 unencrypted SSH private keys</para></entry>
 206           </row>
 207
 208           <row>
 209             <entry><ulink url="http://security.freebsd.org/advisories/FreeBSD-SA-11:10.pam.asc"
 210                 >SA-11:10.pam</ulink></entry>
 211             <entry>23&nbsp;December&nbsp;2011</entry>
 212             <entry><para><function>pam_start()</function> does not validate
 213                 service names</para></entry>
 214           </row>
 215         </tbody>
 216       </tgroup>
 217     </informaltable>
 218   </sect1>
 219
 220   <sect1 id="open-issues">
 221     <title>Open Issues</title>
 222
 223     <itemizedlist>
 224       <listitem>
 225         <para>In some releases prior to &release.current;, upgrading
 226           by using &man.freebsd-update.8; can fail.  This issue has
 227           been fixed by a change in Errata Notice EN-12:01.  For more
 228           information, see <ulink
 229             url="http://security.freebsd.org/advisories/FreeBSD-EN-12:01.freebsd-update.asc"></ulink></para>
 230       </listitem>
 231
 232       <listitem>
 233         <para arch="amd64,i386">&os; &release.current; includes
 234           several changes to improve resource management of PCI
 235           devices.  Some x86 machines may not boot or may have devices
 236           that no longer attach when using ACPI as a result of these
 237           changes.  This can be worked around by setting a
 238           &man.loader.8; tunable
 239           <varname>debug.acpi.disabled</varname> to
 240           <literal>hostres</literal>.  To do this, enter the following
 241           lines at the loader prompt:</para>
 242
 243         <screen>set debug.acpi.disabled="hostres"
 244 boot</screen>
 245
 246         <para>Or, put the following line into
 247           <filename>/boot/loader.conf</filename>:</para>
 248
 249         <programlisting>debug.acpi.disabled="hostres"</programlisting>
 250       </listitem>
 251
 252       <listitem>
 253         <para>A &man.devctl.4; event upon arrival of a &man.ugen.4;
 254           device has been changed.  The event now includes
 255           <literal>ugen</literal> and <literal>cdev</literal>
 256           variables instead of <literal>device-name</literal>.  This
 257           change can prevent the following &man.devd.8; rule which
 258           worked in a previous releases from working:</para>
 259
 260         <programlisting>attach 0 {
 261         match "device-name" "ugen[0-9]+.[0-9]+";
 262         action "/path/to/script /dev/$device-name";
 263 }</programlisting>
 264
 265         <para>This should be updated to the following:</para>
 266
 267         <programlisting>attach 0 {
 268         match "subsystem" "DEVICE";
 269         match "type" "ATTACH";
 270         match "cdev" "ugen[0-9]+.[0-9]+";
 271         action "/path/to/script /dev/$cdev";
 272 }</programlisting>
 273       </listitem>
 274
 275       <listitem>
 276         <para>The &os; &release.current; Release Notes should have
 277           mentioned that SSM (Source-Specific Multicast) MLDv2 now
 278           uses <literal>ALLOW_NEW_SOURCES</literal> and
 279           <literal>BLOCK_OLD_SOURCES</literal> record types to signal
 280           a join or a leave by default.  This conforms RFC 4604,
 281           <quote>Using Internet Group Management Protocol Version 3
 282           (IGMPv3) and Multicast Listener Discovery Protocol Version 2
 283           (MLDv2) for Source-Specific Multicast</quote>.  A new
 284           &man.sysctl.8; variable
 285           <varname>net.inet6.mld.use_allow</varname> which controls
 286           the behavior has been added.  The default value is
 287           <literal>1</literal> (use
 288           <literal>ALLOW_NEW_SOURCES</literal> and
 289           <literal>BLOCK_OLD_SOURCES</literal>).</para>
 290       </listitem>
 291
 292       <listitem>
 293         <para>&release.current; fails to configure an interface
 294           specified in the &man.rc.conf.5; variable
 295           <varname>ipv6_prefix_<replaceable>IF</replaceable></varname>
 296           when the interface does not have a corresponding
 297           <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname>
 298           variable.  This problem will be fixed in the future
 299           releases.  To work around this problem on &release.current;,
 300           add an
 301           <varname>ifconfig_<replaceable>IF</replaceable>_ipv6</varname>
 302           line for each interface specified in
 303           <varname>ipv6_prefix_<replaceable>IF</replaceable></varname>
 304           as the following:</para>
 305
 306         <programlisting>ipv6_prefix_em0="2001:db8:1:0 2001:db8:2:0"
 307 ifconfig_em0_ipv6="inet6 auto_linklocal"</programlisting>
 308       </listitem>
 309
 310       <listitem>
 311         <para>In &release.current; the &os; USB subsystem supports USB
 312           3.0 by the &man.xhci.4; driver.  However, a bug that could
 313           prevent it from working with a USB 3.0 hub has been found
 314           and fixed after the release date.  This means
 315           &release.current; and prior do not work with a USB 3.0 hub.
 316           This problem has been fixed in HEAD and will be merged into
 317           the 9-STABLE branch.</para>
 318       </listitem>
 319     </itemizedlist>
 320   </sect1>
 321
 322   <sect1 id="late-news">
 323     <title>Late-Breaking News</title>
 324
 325 <![ %release.type.current [
 326     <para>No news.</para>
 327 ]]>
 328
 329 <![ %release.type.release [
 330     <para>No news.</para>
 331 ]]>
 332
 333 <![ %release.type.snapshot [
 334     <para>No news.</para>
 335 ]]>
 336   </sect1>
 337
 338 </article>