A number of programs have had output formatting strings corrected so as to reduce the risk of vulnerabilities. A number of programs that use temporary files now do so more securely. It creates an rsa or dsa key if needed and copies the public half to the server. Once the process is done, you'll be able to log in with the passphrase and key instead of a password. It also includes procmail filtering mechanisms.
All services are self-contained modules which can be prioritized easily in the ipchains stack.
No patches issued. In addition, the fragment cache is checked before any rules are checked. Even if all fragments are blocked with a rule, fragment cache entries can be created by packets that match currently held state information. Because of these discrepancies, certain packets may bypass filtering rules. The base system that will ship with FreeBSD 4.3 does not contain this problem since it was corrected during the beta cycle before the release.