https://blog.pfsense.org/?p=1925
-- via my feedly.com reader
pfSense® software version 2.2.5 is now available. This release includes a number of bug fixes and some security updates.
Today is also the 11 year birthday of the project. While work started in late summer 2004, the domains were registered and the project made public on November 5, 2004. Thanks to everyone that has helped make the project a great success for 11 years. Things just keep getting better, and the best is yet to come.
Security Fixes and Errata
- pfSense-SA-15_08.webgui: Multiple Stored XSS Vulnerabilities in the pfSense WebGUI
- The complete list of affected pages and fields is listed in the linked SA.
- Updated to FreeBSD 10.1-RELEASE-p24
- FreeBSD-SA-15:25.ntp Multiple vulnerabilities in NTP [REVISED]
- FreeBSD-SA-15:14.bsdpatch: Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch(1) to run commands in addition to the desired SCCS or RCS commands.
- FreeBSD-SA-15:16.openssh: OpenSSH client does not correctly verify DNS SSHFP records when a server offers a certificate. CVE-2014-2653 OpenSSH servers which are configured to allow password authentication using PAM (default) would allow many password attempts.
- FreeBSD-SA-15:18.bsdpatch: Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch(1) to pass certain ed(1) scripts to the ed(1) editor, which would run commands.
- FreeBSD-SA-15:20.expat: Multiple integer overflows have been discovered in the XML_GetBuffer() function in the expat library.
- FreeBSD-SA-15:21.amd64: If the kernel-mode IRET instruction generates an #SS or #NP exception, but the exception handler does not properly ensure that the right GS register base for kernel is reloaded, the userland GS segment may be used in the context of the kernel exception handler.
- FreeBSD-SA-15:22.openssh: A programming error in the privileged monitor process of the sshd(8) service may allow the username of an already-authenticated user to be overwritten by the unprivileged child process. A use-after-free error in the privileged monitor process of the sshd(8) service may be deterministically triggered by the actions of a compromised unprivileged child process. A use-after-free error in the session multiplexing code in the sshd(8) service may result in unintended termination of the connection.
Bug Fixes and Change List
The bug fixes and changes in this release are detailed here.
Upgrade Guidance
As always, you can upgrade from any previous version straight to 2.2.5. For those already running any 2.2.x version, this is a low risk upgrade. For those on 2.1.x or earlier versions, there are a number of significant changes which may impact you. Pay close attention to the 2.2 Upgrade Notes for the details.
Download
Downloads are available on the mirrors.
Downloads to Upgrade Existing Systems – note it's usually easier to just use the auto-update functionality, in which case you don't need to download anything from here. Check the Firmware Updates page for details.
Supporting the Project
Our efforts are made possible by the support of the community. We encourage you to contribute to the cause via one or more of the following.
- Gold subscription – Immediate access to past hang out recordings as well as the latest version of the official book in PDF, mobi and epub formats after logging in to the members area. Newly added this week with updates, it's now also available in Sphinx HTML format which provides a nicer browsing experience.
- Commercial Support – Purchasing support from us provides you with direct access to the pfSense team.
- Professional Services – For more involved and complex projects outside the scope of support, our most senior engineers are available under professional services.
- pfSense Store – stickers, apparel, pre-loaded USB sticks, and hardware direct from the source. Our pre-installed appliances are the fast, easy way to get up and running with a fully-optimized system. All are now shipping with 2.2.5 release installed.
No comments:
Post a Comment