aboutsummaryrefslogtreecommitdiffstats
path: root/sys/conf/newvers.sh
diff options
context:
space:
mode:
authorXin LI <delphij@FreeBSD.org>2015-09-29 18:07:18 +0000
committerXin LI <delphij@FreeBSD.org>2015-09-29 18:07:18 +0000
commit375f80570f242f4453943d777f84a03e392574dd (patch)
tree15e1b93e77d7bc92f63618f8e0092fc2f01cf760 /sys/conf/newvers.sh
parent33d4d1ebed3f95f917857334efd7cb25241cefbe (diff)
downloadsrc-375f80570f242f4453943d777f84a03e392574dd.tar.gz
src-375f80570f242f4453943d777f84a03e392574dd.zip
The Sun RPC framework uses a netbuf structure to represent the
transport specific form of a universal transport address. The structure is expected to be opaque to consumers. In the current implementation, the structure contains a pointer to a buffer that holds the actual address. In rpcbind(8), netbuf structures are copied directly, which would result in two netbuf structures that reference to one shared address buffer. When one of the two netbuf structures is freed, access to the other netbuf structure would result in an undefined result that may crash the rpcbind(8) daemon. Fix this by making a copy of the buffer that is going to be freed instead of doing a shallow copy. Security: FreeBSD-SA-15:24.rpcbind Security: CVE-2015-7236 Approved by: so
Notes
Notes: svn path=/releng/9.3/; revision=288385
Diffstat (limited to 'sys/conf/newvers.sh')
-rw-r--r--sys/conf/newvers.sh2
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index c26861f12c2f..cdc17d6d2326 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="9.3"
-BRANCH="RELEASE-p26"
+BRANCH="RELEASE-p27"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi