MFC src/contrib/telnet/telnet.c 1.16: Correct buffer overflows in
telnet(1).
Security: CAN-2005-0468, CAN-2005-0469
Approved by:	security-officer
MFC revision 1.103.

Security:	FreeBSD-SA-05:02.sendfile
Approved by:	so (nectar)
Zero the ifr.ifr_name buffer in ifconf() in order to avoid
accidental disclosure of kernel memory to userland.

Security:	FreeBSD-SA-05:04.ifconf
Approved by:	so (cperciva)
MFC:

Correct multiple security related errors: a buffer overflow, NULL
pointer dereferences, possible use of uninitialized variables, and
memory leaks.

Security:	CAN-2005-0753
Security:	FreeBSD-SA-05:05.cvs
Approved by:	so (cperciva)
Correct improper permissions on /dev/iir.  The earlier permissions
of 0644 allowed for people to do Evil Things via ioctl(2).

Security: FreeBSD-SA-05:06.iir
Approved by: so (cperciva)
Correctly validate inputs to the i386_get_ldt syscall.

Security: FreeBSD-SA-05:07.ldt
Approved by: so (cperciva)
If we are going to
1. Copy a NULL-terminated string into a fixed-length buffer, and
2. copyout that buffer to userland,
we really ought to
0. Zero the entire buffer
first.

Security: FreeBSD-SA-05:08.kmem
Approved by: so (cperciva)
MFC: Fix two issues which were missed in FreeBSD-SA-05:08.kmem

Reported by:	Uwe Doering
Approved by:	so (cperciva)
Add a knob for disabling/enabling HTT, "machdep.hyperthreading_allowed".
Default off due to information disclosure on multi-user systems.

Submitted by:	cperciva
Reviewed by:	jhb
Approved by:	security-officer
Correct directory traversal and race condition vulnerabilities in gzip.

Security:	FreeBSD-SA-05:11.gzip
Security:	CAN-2005-0988, CAN-2005-1228
Obtained from:	Steve Grubb via RedHat, Debian

Approved by:	so (nectar)
Correct bzip2 denial of service and permission race vulnerabilities.

Obtained from:	Redhat, Steve Grubb via RedHat
Security:	CAN-2005-0953, CAN-2005-1260
Security:	FreeBSD-SA-05:14.bzip2
Approved by:	obrien

Correct TCP connection stall denial-of-service vulnerabilities.

MFC: rev 1.270 of tcp_input.c, rev 1.25 of tcp_seq.h by ps: When a TCP
packets containing a timestamp is received, inadequate checking of
sequence numbers is performed, allowing an attacker to artificially
increase the internal "recent" timestamp for a connection.

A TCP packets with the SYN flag set is accepted for established
connections, allowing an attacker to overwrite certain TCP options.

Security:	CAN-2005-0356, CAN-2005-2068
Security:	FreeBSD-SA-05:15.tcp

Approved by:	so (cperciva)
MFC: Correct insecure temporary file usage.

Security:	FreeBSD-SA-05:20.cvsbug
Approved by:	so (cperciva)
Correct a man-in-the-middle SSL version rollback vulnerability.

Security:       FreeBSD-SA-05:21.openssl
Approved by:	so@ (cperciva)
Correct insecure temporary file usage in texindex. [06:01]
Correct insecure temporary file usage in ee. [06:02]
Correct a race condition when setting file permissions, sanitize file
names by default, and fix a buffer overflow when handling files
larger than 4GB in cpio. [06:03]

Security:	FreeBSD-SA-06:01.texindex
Security:	FreeBSD-SA-06:02.ee
Security:	FreeBSD-SA-06:03.cpio
Approved by:	so (cperciva)
Correct a remote kernel panic when processing zero-length RPC records
via TCP.

Security:	FreeBSD-SA-06:10.nfs
Approved by:	so (cperciva)
Add missing code needed for the detection of IPSec packet replays. [1]

Correctly identify the user running opiepasswd(1) when the login name
differs from the account name. [2]

Modify timeout handling logic in sendmail(8) to correct a reported
signal handling race condition. [3]

Approved by:	so (cperciva)
Security:	FreeBSD-SA-06:11.ipsec [1]
Security:	FreeBSD-SA-06:12.opie [2]
Security:	FreeBSD-SA-06:13.sendmail [3]
MFC: Correct a local information leakage bug affecting AMD FPUs.

Security:	FreeBSD-SA-06:14.fpu
Approved by:	so (cperciva)
Correct a bug in the handling of backslash characters in smbfs which can
allow an attacker to escape from a chroot(2).

Approved by:	so (cperciva)
Security:	FreeBSD-SA-06:16.smbfs
Correct a bug in the handling of multipart messages by sendmail(8)
which can allow a malformed message to crash a sendmail queue
processing process.

Security:	FreeBSD-SA-06:17.sendmail
Approved by:	so (cperciva)
Correct buffer overflow in the handling of LCP options in ppp(4)

Security:	FreeBSD-SA-06:18.ppp
Approved by:	so (cperciva)