FreeBSD-SA-04:16.fetch:
MFC revision 1.75 of src/usr.bin/fetch/fetch.c
Bump newvers.sh and document in UPDATING.

Approved by:	so
FreeBSD-SA-04:17.procfs:
MFC revision 1.54 of src/sys/fs/procfs/procfs_status.c
MFC revision 1.86 of src/sys/compat/linprocfs/linprocfs.c

Approved by:	so (nectar)
MFC of src/sys/nfsserver/nfs_serv.c rev 1.147.2.3:
  Merge nfs_serv.c:1.151 from HEAD to RELENG_5:

    date: 2004/11/11 21:30:52;  author: rwatson;  state: Exp;  lines: +52 -38
    Correct a bug in nfsrv_create() where a call to nfsrv_access() might
    be made holding the NFS server mutex.  To clean this up, introduce a
    version of the function, nfsrv_access_withgiant(), that expects the
    NFS server mutex to already have been dropped and Giant acquired.
    Wrap nfsrv_access() around this.  This permits callers to more
    efficiently check access if they're in a code block performing VFS
    operations, and can be substitited for the nfsrv_access() call that
    triggered this bug.

    PR:             73807, 73208

Approved by:	so (nectar)
Work done by:	rwatson
Errata Notice:	FreeBSD-EN-05:01.nfs
Merge from RELENG_5 if_sk.c 1.83.2.3 1.83.2.4, if_skreg.h 1.20.2.3:
Correct bugs in the sk(4) network driver that could result in
data corruption and system crashes on SMP systems.

Approved by:	so, re
MFR5 for FreeBSD-EN-05:03.ipi

From commit to RELENG_5:
  MFC IPI panic fix done by Stephan Uphoff:
          sys/i386/i386/apic_vector.s     1.101 -> 1.102
          sys/i386/i386/mp_machdep.c      1.241 -> 1.243
          sys/i386/include/apicvar.h      1.8 -> 1.9
          sys/i386/include/smp.h          1.78 -> 1.79

  To quote the original commit message:
          Avoid more than two pending IPI interrupt vectors per local APIC
          as this may cause deadlocks.

          This should fix kern/72123.

          Discussed with: jhb
          Tested by: Nik Azim Azam, Andy Farkas, Flack Man, Aykut KARA
                     Izzet BESKARDES, Jens Binnewies, Karl Keusgen

  Discussed with: ups
  Reviewed by:    jhb

Versions being merged from RELENG_5:

  src/sys/i386/i386/apic_vector.s	1.101.2.1
  src/sys/i386/i386/mp_machdep.c	1.235.2.4
  src/sys/i386/include/apicvar.h	1.8.2.1
  src/sys/i386/include/smp.h		1.78.2.1

Approved by:	so (nectar)
MFC src/contrib/telnet/telnet.c 1.16: Correct buffer overflows in
telnet(1).
Security: CAN-2005-0468, CAN-2005-0469
Approved by:	security-officer
MFC revision 1.103.

Security:	FreeBSD-SA-05:02.sendfile
Approved by:	so (nectar)
Fully initialize the required TSS fields so that the io permission
bitmap is set correctly.

Patch from:	peter
Security:	FreeBSD-SA-05:03.amd64
Approved by:	so (cperciva)
Zero the ifr.ifr_name buffer in ifconf() in order to avoid
accidental disclosure of kernel memory to userland.

Security:	FreeBSD-SA-05:04.ifconf
Approved by:	so (cperciva)
MFC:

Correct multiple security related errors: a buffer overflow, NULL
pointer dereferences, possible use of uninitialized variables, and
memory leaks.

Security:	CAN-2005-0753
Security:	FreeBSD-SA-05:05.cvs
Approved by:	so (cperciva)
Correct improper permissions on /dev/iir.  The earlier permissions
of 0644 allowed for people to do Evil Things via ioctl(2).

Security: FreeBSD-SA-05:06.iir
Approved by: so (cperciva)
Correctly validate inputs to the i386_get_ldt syscall.

Security: FreeBSD-SA-05:07.ldt
Approved by: so (cperciva)
If we are going to
1. Copy a NULL-terminated string into a fixed-length buffer, and
2. copyout that buffer to userland,
we really ought to
0. Zero the entire buffer
first.

Security: FreeBSD-SA-05:08.kmem
Approved by: so (cperciva)
MFC: Fix two issues which were missed in FreeBSD-SA-05:08.kmem.

Reported by:	Uwe Doering
Approved by:	so (cperciva)
Add a knob for disabling/enabling HTT, "machdep.hyperthreading_allowed".
Default off due to information disclosure on multi-user systems.

Submitted by:	cperciva
Reviewed by:	jhb
Approved by:	security-officer
Correct several denial-of-service vulnerabilities in tcpdump.

Security:	FreeBSD-SA-05:10.tcpdump
Security:	CAN-2005-1267, CAN-2005-1278, CAN-2005-1279, CAN-2005-1280
Obtained from:	tcpdump.org

Correct directory traversal and race condition vulnerabilities in gzip.

Security:	FreeBSD-SA-05:11.gzip
Security:	CAN-2005-0988, CAN-2005-1228
Obtained from:	Steve Grubb via RedHat, Debian

Correct BIND 9 DNSSEC remote denial of service vulnerability.

Security:	FreeBSD-SA-05:12.bind9
Security:	CAN-2005-0034
Obtained from:	ISC
Submitted by:	trhodes

Approved by:	so (nectar, cperciva)
Correct bzip2 denial of service and permission race vulnerabilities.

Obtained from:	Redhat, Steve Grubb via RedHat
Security:	CAN-2005-0953, CAN-2005-1260
Security:	FreeBSD-SA-05:14.bzip2
Approved by:	obrien

Correct TCP connection stall denial-of-service vulnerabilities.

MFC: rev 1.270 of tcp_input.c, rev 1.25 of tcp_seq.h by ps: When a TCP
packets containing a timestamp is received, inadequate checking of
sequence numbers is performed, allowing an attacker to artificially
increase the internal "recent" timestamp for a connection.

A TCP packets with the SYN flag set is accepted for established
connections, allowing an attacker to overwrite certain TCP options.

Security:	CAN-2005-0356, CAN-2005-2068
Security:	FreeBSD-SA-05:15.tcp

Approved by:	so (cperciva)
MFC rev. 1.6 of src/lib/libz/inftrees.c:
  Correct a buffer overflow which occurred in the handling of some
  particularly corrupt deflated data streams.

Security:	FreeBSD-SA-05:16.zlib
Approved by:	so (cperciva)
MFC rev 1.116 of src/sys/fs/devfs/devfs_vnops.c:

  Correct devfs ruleset bypass.

Correct typo in p18 entry, zlib advisory was FreeBSD-SA-05:16.zlib.

Submitted by:	csjp
Reviewed by:	phk
Security:	FreeBSD-SA-05:17.devfs
Approved by:	so (cperciva)
Correct a buffer overflow which can occur when decompressing a
carefully crafted deflated data stream. [1]

Correct problems in the AES-XCBC-MAC IPsec authentication algorithm. [2]

Submitted by:   suz [2]
Security:       FreeBSD-SA-05:18.zlib [1], FreeBSD-SA-05:19.ipsec [2]
Approved by:	so (cperciva)