Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version.

Approved by: so
Approved by: re (implicit for releng/12.2)

Fix ftpd privilege escalation via ftpchroot.

Approved by: so
Approved by: re (implicit for releng/12.2)
Security: FreeBSD-SA-20:30.ftpd
Security: CVE-2020-7468

Fix bhyve SVM guest escape.

This actually has a patch to sys/amd64/vmm/amd/svm.c that was accidentally
committed as part of r365779.

Approved by: so
Approved by: re (implicit for releng/12.2)
Security: FreeBSD-SA-20:29.bhyve_svm
Security: CVE-2020-7467

Fix bhyve privilege escalation via VMCS access.

Approved by: so
Approved by: re (implicit for releng/12.2)
Security: FreeBSD-SA-20:28.bhyve_vmcs
Security: CVE-2020-24718

Fix ure device driver susceptible to packet-in-packet attack.

Approved by: so
Approved by: re (implicit for releng/12.2)
Security: FreeBSD-SA-20:27.ure
Security: CVE-2020-7464

Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version.

Approved by: so

Fix dhclient heap overflow.

Approved by: so
Security: FreeBSD-SA-20:26.dhclient
Security: CVE-2020-7461

Fix SCTP socket use-after-free.

Approved by: so
Security: FreeBSD-SA-20:25.sctp
Security: CVE-2020-7463

Fix IPv6 Hop-by-Hop options use-after-free.

Approved by: so
Security: FreeBSD-SA-20:24.ipv6
Security: CVE-2020-7462

Fix getfsstat compatibility system call panic.

Approved by: so
Security: FreeBSD-EN-20:18.getfsstat

Fix FreeBSD Linux ABI kernel panic.

Approved by: so
Security: FreeBSD-EN-20:17.linuxthread

Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version.

Approved by: so

Fix sendmsg(2) privilege escalation.

Approved by: so
Security: FreeBSD-SA-20:23.sendmsg
Security: CVE-2020-7460

Fix multiple vulnerabilities in sqlite3.

Approved by: so
Security: FreeBSD-SA-20:22.sqlite
Security: CVE-2020-11655
Security: CVE-2020-11656
Security: CVE-2020-13434
Security: CVE-2020-13435
Security: CVE-2020-13630
Security: CVE-2020-13631
Security: CVE-2020-13632

Fix memory corruption in USB network device drivers.

Approved by: so
Security: FreeBSD-SA-20:21.usb_net
Security: CVE-2020-7459

Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version.

Approved by: so

Fix multiple vulnerabilities in unbound.

Approved by: so
Security: FreeBSD-SA-20:19.unbound
Security: CVE-2020-12662
Security: CVE-2020-12663

Fix IPv6 socket option race condition and use after free.

Approved by: so
Security: FreeBSD-SA-20:20.ipv6
Security: CVE-2020-7457

Fix kernel panic in mps(4) driver.

Approved by: so
Security: FreeBSD-EN-20:15.mps

Fix kernel panic in LinuxKPI subsystem.

Approved by: so
Security: FreeBSD-EN-20:14.linuxpki

Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version.

Approved by: so
Approved by: re (implicit)

Fix USB HID descriptor parsing error.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-20:17.usb
Security: CVE-2020-7456

Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version.

Approved by: so
Approved by: re (implicit)

Fix use after free in cryptodev module.

Approved by: so
Security: FreeBSD-SA-20:15.cryptodev
Security: CVE-2019-15879

Fix improper checking in SCTP-AUTH shared key update.

Approved by: so
Security: FreeBSD-SA-20:14.sctp
Security: CVE-2019-15878

Fix memory disclosure vulnerability in libalias.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-20:13.libalias
Security: CVE-2020-7455

Fix insufficient packet length validation in libalias.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-20:12.libalias
Security: CVE-2020-7454

Update to tzdata 2020a.

Approved by: so
Security: EN-20:08.tzdata

Merge branch 'releng/11.3' into releng-CDN/11.3

MF11 r352638,r358076: correct Clang and lld version checks

r352638 (mhorne): Allow for compiler versions >= 10
r358076 (dim): Correctly recognize linker versions greater than 10.0.

These routines determine the host compiler and linker version, and caused
attempts to build 12.1-RELEASE on 13-CURRENT to fail after the latter was
updated to Clang 10.  The host compiler version was also misdetected on
11.3 although it seems not to have caused the same build failure there.

We don't guarantee such a build config to work, but it is used by FreeBSD
ports build processes.  As a result the fixes from stable/11 will be
included with the next set of advisories, and are being committed to the
releng branch now to unblock ports builds.

PR: 245973
Reported by: sbruno, antoine
Approved by: so
Errata: EN-20:10.build
Sponsored by: The FreeBSD Foundation

Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version.

Approved by: so

Fix ipfw invalid mbuf handling.

Approved by: so
Security: FreeBSD-SA-20:10.ipfw
Security: CVE-2019-5614
Security: CVE-2019-15874

Fix regression in rpc.rquotad with certain NFS servers.

Approved by: so
Security: FreeBSD-EN-20:07.quotad

Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version.

Approved by: so

Fix multiple denial of service in ntpd.

Approved by: so
Security: FreeBSD-SA-20:09.ntp

Fix kernel memory disclosure with nested jails.

Approved by: so
Security: FreeBSD-SA-20:08.jail
Security: CVE-2020-7453

Fix incorrect user-controlled pointer use in epair.

Approved by: so
Security: FreeBSD-SA-20:07.epair
Security: CVE-2020-7452

Fix insufficient oce(4) ioctl(2) privilege checking.

Approved by: so
Security: FreeBSD-SA-20:05.if_oce_ioctl
Security: CVE-2019-15876

Fix TCP IPv6 SYN cache kernel information disclosure.

Approved by: so
Security: FreeBSD-SA-20:04.tcp
Security: CVE-2020-7451

Fix incorrect checksum calculations with IPv6 extension headers.

Approved by: so
Security: FreeBSD-EN-20:06.ipv6

Fix missing pfctl(8) tunable.

Approved by: so
Security: FreeBSD-EN-20:04.pfctl

Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version.

Approved by: so

Fix kernel stack data disclosure

Reported by: Ilja Van Sprundel
Approved by: so
Security: FreeBSD-SA-20:03.thrmisc
Security: CVE-2019-15875

Fix libfetch buffer overflow

Reported by: Duncan Overbruck
Approved by: so
Security: FreeBSD-SA-20:01.libfetch
Security: CVE-2020-7450

Fix nmount invalid pointer dereference

Submitted by: Andrew Turner
Approved by: so
Security: FreeBSD-EN-20:02.nmount

Fix imprecise ordering of SSP canary initialization

Submitted by: Kyle Evans
Approved by: so
Security: FreeBSD-EN-20:01.ssp

cdn-patch: offer option to mount /etc/keys before attaching geli devices

Merge branch 'releng/11.3' into releng-CDN/11.3

Add UPDATING entries and bump version numbers.

Approved by: so

Fix Machine Check Exception on Page Size Change.

Approved by: so
Security: FreeBSD-SA-19:25.mcepsc
Security: CVE-2018-12207

Merge branch 'releng/11.3' into releng-CDN/11.3

Import tzdata 2019c.

Approved by: so
Security: FreeBSD-EN-19:18.tzdata

Merge branch 'releng/11.3' into releng-CDN/11.3

That's EN-19:17.ipfw. It's not an SA.

Reported by: kevans@
Approved by: so

Bump version information and add UPDATING entries.

Approved by: so

Fix reference count overflow in mqueuefs.

Approved by: so
Security: FreeBSD-SA-19:24.mqueuefs
Security: CVE-2019-5603

Fix kernel memory disclosure from /dev/midistat.

Approved by: so
Security: FreeBSD-SA-19:23.midi
Security: CVE-2019-5612

Fix IPv6 remote denial of service.

Approved by: so
Security: FreeBSD-SA-19:22.mbuf
Security: CVE-2019-5611

Fix ipfw(8) jail keyword prior to jail startup.

Approved by: so
Security: FreeBSD-EN-19:17.ipfw

Add bhyve instruction emulation improvements (opcode 03H and F7H).

Approved by: so
Security: FreeBSD-EN-19:16.bhyve

Merge branch 'releng/11.3' into releng-CDN/11.3

Bump version information and add UPDATING entries.

Approved by: so

Fix insufficient validation of guest-supplied data (e1000 device).

Approved by: so
Security: FreeBSD-SA-19:21.bhyve
Security: CVE-2019-5609

Fix insufficient message length validation in bsnmp library.

Approved by: so
Security: FreeBSD-SA-19:20.bsnmp
Security: CVE-2019-5610

Fix ICMPv6 / MLDv2 out-of-bounds memory access.

Approved by: so
Security: FreeBSD-SA-19:19.mldv2
Security: CVE-2019-5608

Fix multiple vulnerabilities in bzip2.

Approved by: so
Security: FreeBSD-SA-19:18.bzip2
Security: CVE-2016-3189
Security: CVE-2019-12900

Merge branch 'releng/11.3' into releng-CDN/11.3

Bump version information and update UPDATING.

Approved by: so

Fix file descriptor reference count leak.

Approved by: so
Security: FreeBSD-SA-19:17.fd
Security: CVE-2019-5607

Fix byhve out-of-bounds read in XHCI device.

Approved by: so
Security: FreeBSD-SA-19:16.bhyve
Security: CVE-2019-5604

Fix reference count overflow in mqueuefs.

Approved by: so
Security: FreeBSD-SA-19:15.mqueuefs
Security: CVE-2019-5603

Fix kernel memory disclosure in freebsd32_ioctl.

Approved by: so
Security: FreeBSD-SA-19:14.freebsd32
Security: CVE-2019-5605

Fix pts write-after-free.

Approved by: so
Security: FreeBSD-SA-19:13.pts
Security: CVE-2019-5606

Fix multiple telnet client vulnerabilities.

Approved by: so
Security: FreeBSD-SA-19:12.telnet
Security: CVE-2019-0053

Fix panic from Intel CPU vulnerability mitigation.

Approved by: so
Security: FreeBSD-EN-19:13.mds

Merge branch 'releng/11.3' into releng-CDN/11.3

- Switch releng/11.3 to -RELEASE.
- Add the anticipated 11.3-RELEASE date to UPDATING.
- Set a static __FreeBSD_version.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Document three open issues affecting 11.3-RELEASE.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Document SA-19:09, SA-19:11.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Document r349620, tzdata 2019b.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Update UPDATING and bump newvers.sh

Approved by: so
Approved by: re (implicit)

Fix privilege escalation in cd(4) driver.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-19:11.cd_ioctl
Security: CVE-2019-5602

Fix iconv buffer overflow.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-19:09.iconv

Import tzdata 2019b.

Approved by: so
Approved by: re (implicit)
Security: FreeBSD-EN-19:12.tzdata

Update releng/11.3 to RC3 as part of the 11.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

cdn-patch: mark unionfs as jail-safe

MFC r349376: Fix strsep_quote() on strings without quotes.

For strings without quotes and escapes dstptr and srcptr are equal, so
zeroing *dstptr before checking *srcptr is not a good idea.  In practice
it means that in -maproot=65534:65533 everything after the colon is lost.

The problem was there since r293305, but before r346976 it was covered by
improper strsep_quote() usage.

PR: 238725

Approved by: re (gjb)

Merge from stable/11:
  Fix the uninitialized use of source IPv6 address in NAT64LSN.

  This code is already refactored in head/, but due to the missing
  epoch(9) support it is impossible to merge. So, it is direct commit to
  stable/11.

  Reported by: Patrick M. Hausen <hausen punkt de>
  Tested by: Patrick M. Hausen <hausen punkt de>
Approved by: re (kib, gjb)

Bump the release.manpath.freebsd macro version, although I do not
see any place this is actually used.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Connect the installation page to the build.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)

Release notes documentation:
- Update version numbers in the installation page.

Approved by: re (implicit)
Sponsored by: Rubicon Communications, LLC (Netgate)