From nobody Wed Dec 17 01:02:07 2025 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dWFrH6nP9z6LVZc for ; Wed, 17 Dec 2025 01:02:07 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2610:1c1:1:6074::16:84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dWFrH41Sxz3St0; Wed, 17 Dec 2025 01:02:07 +0000 (UTC) (envelope-from security-advisories@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765933327; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=07F9w17vJT0ezMz/KUHJ/RgVPkyTdIWnmmrNKbVvaiY=; b=EibCFco4kRlfnBnBgAAG0X9xuTyn8IOYYmamiaMDM0mMOT1P5CnUf5Xrl2akp6ANkJIu6M CXd/zfR+Pmpt40/YCr3YagZrN1G0hk/FiSrw9e+COETTGNHpiL9YoOFXtt2o2G5Tu1pYW8 sFxS/OG7pAuwO7ASn9kV+ksBxqnQ2gS9ExsUn1w3gGO9X1mzZDN09MfHFMxip2HZBn6ja5 1sJGx0wKNtCk7NJnb7jJUqEpBu0UCMrCoPw2miOA4Tl5NhRJPKKpoYFhOQA8kL+TubHrSw CRue7N8liVReVeWxXiuGEhBDBo2IfWvmWs5g6CRKRxfT6XtKeuJsqTxDqIH6+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765933327; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=07F9w17vJT0ezMz/KUHJ/RgVPkyTdIWnmmrNKbVvaiY=; b=e+Hh5Q5BGfg2ske1wBg6iL+bhRtszLpn6H+spyiaX2Q91UL2/RNJrK329fp/WjfP+zpQH4 lpgwubVplmC9MKW3FKQBQlWr08Cj39R28rV2Ax7EPld13n01Y00yzw1oq0PorwJNdk39Vf +Z8kz7CyL4vteE2QQPH1o354fi0Gao/uMztX5zQglj42LxQbtFFtZMvsRcVrrUO40rmtDK 83EU9kilB3b4pwRvPdpodhgz2Foybr0t+ad/704flY2wimlBjEKSb2kJI/vLgdokLzqVaX 4SD/Ll7uvEhOpMjFjMha/mXgcFR1Vn5a8UWWtcb9WpB/hMy6Kn42qHhX6LQodA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765933327; a=rsa-sha256; cv=none; b=SSLwRkAZ0m7crCfB/90SWt4IYDZjbSG5f9l3jcgYW72MVUy2lutEhKuLpRZ1wGrD4U7sQr QvCoaFnhuFrHK7vtERS4NbkvvntSlLcRZJkJXY8QtxQGAaPSVL0CZeTCL7yRibYeNsTpeH pJpjDd0umT1SA9mY/yKxOCH8lnzHT6GRZ6fbZv/NqJ++i8mmHE8bHLe5wyJPJ8a18VsU3k X87f5KcSvpUqJX8yQIfgTrtigUAdOB3rP1ACU1tdyR6WmRsYvJsaHkRAAY7VVKJIhsDr91 KkPqfhpIRRhBECFKxkN248IafPcExjBoc3/dV11cwKs3l4H0HRqfcqOpJBasLw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: by freefall.freebsd.org (Postfix, from userid 945) id 3635EE0F7; Wed, 17 Dec 2025 01:02:07 +0000 (-00) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-25:11.ipfw Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20251217010207.3635EE0F7@freefall.freebsd.org> Date: Wed, 17 Dec 2025 01:02:07 +0000 (-00) List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-25:11.ipfw Security Advisory The FreeBSD Project Topic: ipfw denial of service Category: core Module: ipfw Announced: 2025-12-16 Affects: FreeBSD 13 and 14 Corrected: 2025-11-04 00:52:54 UTC (stable/14, 14.3-STABLE) 2025-12-16 23:43:24 UTC (releng/14.3, 14.3-RELEASE-p7) 2025-11-04 00:52:12 UTC (stable/13, 13.5-STABLE) 2025-12-16 23:43:32 UTC (releng/13.5, 13.5-RELEASE-p8) CVE Name: CVE-2025-14769 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background ipfw(4) is one of the firewalls provided in the FreeBSD base system. Its `tcp-setmss` configuration directive allows the system administrator to lower the Maximum Segment Size of a packet. II. Problem Description In some cases, the `tcp-setmss` handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then allow the traffic after the packet data is gone, resulting in a NULL pointer dereference. III. Impact Maliciously crafted packets sent from a remote host may result in a Denial of Service (DoS) if the `tcp-setmss` directive is used and a subsequent rule would allow the traffic to pass. IV. Workaround No workaround is available, but systems that do not use ipfw(4) with the `tcp-setmss` directive are not affected. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update" 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 14.3] # fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-14.patch # fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-14.patch.asc # gpg --verify ipfw-14.patch.asc [FreeBSD 13.5] # fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-13.patch # fetch https://security.FreeBSD.org/patches/SA-25:11/ipfw-13.patch.asc # gpg --verify ipfw-13.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in and reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/14/ deb684f9d1d6 stable/14-n272799 releng/14.3/ c0cb68169beb releng/14.3-n271453 stable/13/ 94360584542a stable/13-n259534 releng/13.5/ 60026b06366f releng/13.5-n259185 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmlB+cAACgkQbljekB8A Gu9XFA//V2aCX1XCn6tCRPR51ixMJ/9rKfpWmYpGruZoB1GaKC0UvkQqDNIkXw8K r6OY1G2rK36y+AGCrxtXHnUKfDj/hzZkL4lEBr9AjcB6N4czk6q/fSuzcL0FCi9T CbWjxSEjV2M2IO4nObu8CKB/7cVY6UlIhe2d4iBH+otkzfyBsYHwCSvhDOWxeWFj f+I9ddOvCFv7lRh74RZk0CdSPe4HyptCSkwERwIn5Cm+fk7PJIFWDM4hF9atP+G8 VT3PUirG1na33vtfRw46c/Qj+L8gybq0pztkTnqsm52WME0n1go3aI7mbPmSWTwe xSC5totcYxbjQ/lMcXv00kgDzraFuPSzSzej6Z4BYXTHOgNTgHHexa3rqxs8y3i/ IoOWSDZdyd2d3B9r5xAFSzp+HVv+C9UBB/AQ0kQt0gPTX6j9d0WiMninNiedVSWf BOYCmgvI7+0ybeV54QFrVnEsImEoYu32NlLVVmswSnDOBuBcU2XtHtO7/x5BUcyU CdOiAZ78TS+007QllROCuidXiQc0FNFqgm+rRFv37Wmmm0LZVkVJ7OVB0vXuk4ps iNBFmXxHCiKL6zJGvx+OQmAXLE+xf71n9xt0jJIk/NfI1BkHYRrlYnH7JXhfBvAO SYtM+FXK1Kehj+ltLUO+9WYhkgfAUtlI/+7GKLMDzy76Q+ZMzhk= =0OhG -----END PGP SIGNATURE----- From nobody Wed Dec 17 01:02:14 2025 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dWFrR6g9Sz6LVbn for ; Wed, 17 Dec 2025 01:02:15 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2610:1c1:1:6074::16:84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dWFrQ6yQlz3Sgc; Wed, 17 Dec 2025 01:02:14 +0000 (UTC) (envelope-from security-advisories@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765933335; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=Og68yjtYezAtBkiLYJkj2LUtqVM7gVkCsQ5Dg3zGydo=; b=Y4bbeYD47oxRLTeNNd1VyqkNLNx7u6raCLQwfdSJKNb6VQaFGvjVQ/MWO3UabgmvWLH4Zw Wmd78s3KmQA1hrREFDDhwA23YYmJfJ2l+Rzf0OQRmOzC8sBx/4AmX+piL3im1bOxdeHU3r ukx9vGHf34F+c9rtS/y/YIDd/iXXuIztNhWsZFqD0gAVR+w6TjONDWM3os2KEkfx8jF2Ca Uod165JSsaDvHFWCL9YcLayCjJ11ru6A+p76WsT5I60COGKMPbrZBC0Wk77JA1EXxHg8OU GCUl1CcGzuBd4V8vvjD31gzX0YmrPHXOtpNfathVWPjP1l1sLAv4zC57PEGVLg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765933335; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=Og68yjtYezAtBkiLYJkj2LUtqVM7gVkCsQ5Dg3zGydo=; b=xJSAkDJZdlLR8vU+BtD9JGAJa0sZ5IbQbIYJNadVR3fWVBfwm6yzRDk/G5UME362yWGwvR XeiX3E0X5RmU6l1UHTbfWTfrIypZaPaobbX+46BSX+LqWe2H6kbrv40/YFN14GUaJ91W4x dsBaE7E98XnJKFxxnJpkQ7OXYyWUP9EZtYWYDYRq8d4Y/Wf0pDFuEbaqYl89VExQfc5Zze VpZDasb+4G92rOF0SaSTpP2sLaIV9YCrTgobibjT8aChkzUTshMc1pJGcWA3sE4Wjfjo/D coWhynKRvNwiPjnR2nXPk1ZYPMAtCSU7OBoMHZqtBxCXPHezff/7HGm/uPksTg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765933335; a=rsa-sha256; cv=none; b=P0lNPGykGUutNtOY7T20UpBI6Ss6c58BjdhZZlQcHvF/N7latx+jJC73NBaqK4IRHfUw6P lqi6pxsTVfWKAmnxXlQzkxxwT9NwTy+ZmsHKhehiPZ37GCh8YHU46tS2K8kZ+OOFRyrLIn vba+8N9bmjrMOFbHir0857M+psxXHBI0v7+g1UNs83Uw5ps2cvIN7dnA8bwd3dLc9LKrLY EF1sCOxOhK6zmvGOPmr5LK9EFz4QbO3G8C1mW70DhWtKtU6M3fBy6k0R2PBSLmHaKen41s IW0Y47bZ6+4QLK8o8Ge+PWEP8tuTYuqxd2pYmvSIVXRSE5AAxLOnuV+7CpxAcA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: by freefall.freebsd.org (Postfix, from userid 945) id BAF90E16E; Wed, 17 Dec 2025 01:02:14 +0000 (-00) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-25:12.rtsold Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20251217010214.BAF90E16E@freefall.freebsd.org> Date: Wed, 17 Dec 2025 01:02:14 +0000 (-00) List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-25:12.rtsold Security Advisory The FreeBSD Project Topic: Remote code execution via ND6 Router Advertisements Category: core Module: rtsold Announced: 2025-12-16 Credits: Kevin Day Affects: All supported versions of FreeBSD. Corrected: 2025-12-16 23:39:32 UTC (stable/15, 15.0-STABLE) 2025-12-16 23:43:01 UTC (releng/15.0, 15.0-RELEASE-p1) 2025-12-16 23:45:05 UTC (stable/14, 14.3-STABLE) 2025-12-16 23:43:25 UTC (releng/14.3, 14.3-RELEASE-p7) 2025-12-16 23:44:10 UTC (stable/13, 13.4-STABLE) 2025-12-16 23:43:33 UTC (releng/13.5, 13.5-RELEASE-p8) CVE Name: CVE-2025-14558 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background rtsold(8) and rtsol(8) are programs which process router advertisement packets as part of the IPv6 stateless address autoconfiguration (SLAAC) mechanism. II. Problem Description The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed. III. Impact Systems running rtsol(8) or rtsold(8) are vulnerable to remote code execution from systems on the same network segment. In particular, router advertisement messages are not routable and should be dropped by routers, so the attack does not cross network boundaries. IV. Workaround No workaround is available. Users not using IPv6, and IPv6 users that do not configure the system to accept router advertisement messages, are not affected. A network interface listed by ifconfig(8) accepts router advertisement messages if the string "ACCEPT_RTADV" is present in the nd6 option list. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-25:12/rtsold.patch # fetch https://security.FreeBSD.org/patches/SA-25:12/rtsold.patch.asc # gpg --verify rtsold.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart the applicable daemons, or reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/15/ 6759fbb1a553 stable/15-n281548 releng/15.0/ 408f5c61821f releng/15.0-n280998 stable/14/ 26702912e857 stable/14-n273051 releng/14.3/ 3c54b204bf86 releng/14.3-n271454 stable/13/ 4fef5819cca9 stable/13-n259643 releng/13.5/ 35cee6a90119 releng/13.5-n259186 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmlB+cMACgkQbljekB8A Gu9YXA//UpSYz4dseSTcDElpN6jp/2W0+OKDYVqRkH0PaLwZX8iGugm8QwqCxLoL m1xK2BJir15wuUYmD++EYbjHajXrKIPaD+sW9KjqxgxDVsQWwfl9ZND743JM5TFE Y3fx8halkChIwtNGCNDHTu5N2DmEPoTO03jOqKqjH6PZwJ6ycYTw4zJvPdP5eDiT +zWpTNNm0VCkBQQB7ukJGku3zWAh4swZWylP2GvyzifcYKR3Z4OGhDdwQCBa99cn jC67D7vURTqlk4pcTFJ6JrIVRIQJdNWQGRou3hAedE59bpAZZc8B/fd//Ganmrit CBG1kMLYVxtV3/12+maEt/DLEMM7isGJPQiSWYe+qseBcdakmuJ8hdR8HKTqrK40 57ZO59CnzEFr49DrrTD4B97cJwtrXLWtUp4LiXxuYy0CkCl8CiXvcgovCBusQpx+ r68dgbfcH0UY/ryQp0ZWTI1y3NKmOSuPVpkW4Ss0BeGESlA4DJHuEwIs1D4TnOJL 90C5D7v7jeOtdXhZ6BHVLtXB+nn8zMpAO209H/pRQWJdAEpABheKCgisP9C80g6h kM300GZjH4joYDyFbMYrW6uWfylwDFC1g8MdFi8yjZzEEOfrKNcY63b+Kx+c3xNL hIa8yUcjLYHvMRnjTQU1bgUVU+SmW6n05HcqtWV7VKh39ATJcX4= =TK7t -----END PGP SIGNATURE----- From nobody Wed Dec 17 03:25:10 2025 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dWK1P1pf0z6Lllc; Wed, 17 Dec 2025 03:25:13 +0000 (UTC) (envelope-from cperciva@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dWK1P1GN1z47KQ; Wed, 17 Dec 2025 03:25:13 +0000 (UTC) (envelope-from cperciva@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765941913; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=8G+uZLkrwESSJTl2vnab1R1Af8QTPhCmxLnwG8gykMw=; b=F1H7QuLzHgI+RUGVrcFqCgSw4GjyIysvYJDvPnAdIGLVw7bjI4AUMQ9IMjVt9CweVyi6lI h7YInWP6iEJxquO1EOEdPaEOYSeCFk9YsdS1iKRzjnxRvwfjhrbqntUpm5gDPZE3qi4g+g eEAqDuVWlLDw90u7nUOUYD+B7U7unOb9Jj+zmWM1iJeM1S/BzR9Dvlj28eyelcZBuJsE/P lJzm4wpX5semJP5Cax+iSjKFcJyri4ZuyAQwWJdAchWiGca+oGCQs/gUCfBYSM1Gh1J5+K nr6YbKFwikiynZloMg3BDQTlX00EmPXUZ+brtF9zvDR0RCsrSvwgInZRBjyoDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765941913; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=8G+uZLkrwESSJTl2vnab1R1Af8QTPhCmxLnwG8gykMw=; b=gF4xJRko1aVV1664TDhDnoVAmdxsGd2fvPi7fyAMZ4vPNtWjiQrqw4ekvKqmvOCaAJD1UX C+59huiD3JJqTX8tkINtxIp3uZUFme4Es0sOJAq1G0E37RuXFDIyNJODwNt+q+eTe4m1z9 vOqm/dZ0Rb4AvlMQQtnD3DuSfw0SidKsPnKooM9JK0kV9e+nUhOhzkyOpvefi+9WTJY8bC 48rnK2pbuLIHRpjGljpktbvjWLsffvY//SuXCtuaVoP3DTTEDytmRFE6erZ2tBOtrQ7SA1 lwObQvniR1n1ElMNlL1u+fkAxPbWMCcLQuDtktD6Nl2JqhjJrWzgIv+BopLa3w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765941913; a=rsa-sha256; cv=none; b=vnCbQ+UrbUv6MAyk7TxUU+dUXr1SiYgFMbaIQvTvO5s6STKJ2g/8QPgh017M6YXA9G7zOU GkuqleskjmVEOKYDvteOJ9vYGacGSqUkkAKPk8lbkBd0Snux+6QOI6h4xoTiy6o1vGrrZ3 TEuTpeUbeUL+p4/OQxoG/34ZxNGe/bOYXhMqUXs6Ir5jnMEyh9iBVDjnmJ3eaXmZFRxFQa GDN1UhLVj5wx7GuX9yPGDZ4cARpHskNFr5uJX4d1d7rC+vW+xfofmgwJa4JslLNmyE2lPg rS9wK78QhxifXpJhzhduEDTbNzxd9hASaRlwyHFhXntKVcis+UuRE4ZBsi7fHQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from [192.168.6.36] (S0106684a76304d01.vf.shawcable.net [70.69.240.84]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: cperciva/mail) by smtp.freebsd.org (Postfix) with ESMTPSA id 4dWK1N5QGxzCVb; Wed, 17 Dec 2025 03:25:12 +0000 (UTC) (envelope-from cperciva@freebsd.org) Message-ID: <3f5c61f2-b3ae-4a95-b22a-659b4fa9c0a6@freebsd.org> Date: Tue, 16 Dec 2025 19:25:10 -0800 List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: FreeBSD Security Advisory FreeBSD-SA-25:12.rtsold To: freebsd-security@freebsd.org, freebsd-pkgbase@FreeBSD.org References: <20251217010214.E6507E38F@freefall.freebsd.org> Content-Language: en-US From: Colin Percival Autocrypt: addr=cperciva@freebsd.org; keydata= xsFNBGWMSrYBEACdWRqDn3B3SKO7IG0/fGHYtfs26f3Q5QeAcasy1fQLniwGQWn5rlILhbCD K/jdNoDm5Zxq20eqyffoDNObCjnHgg4tGANdi+RmDy+7CDpE789H8dss9y7Pt5DlGGAXQQnt hxush3EYS/Ctprd9UUL/lzOOLOU1aNtzB84tNrJBtcJmL7OYHfyTSNFxvedqJrrasejIQOLI t/DQ89BPzz+vsKHz7FJPXh3fsVkzLA00DJYcfkgxyABfJNA7U6yMwd4DVSdx/SsvfIDMVXnu UXCXswo106WPZbYGlZPpq0wW6iibtTerJix+8AeuwXvl9O1p8yESK4ErkIxCnmghTSz+pdzj z/6xBRkdDM9VdZ0r+CzsaNXMpDOzFuKyjaiYBdgCLljbDnXIHFcqXenrZ7Xwkm09g/M4uVSh pIUG2RYa6tsHSQoGCp3f2RZv1znfViKQFbbL83QjtPA20AhseZSYbHp1FPhXyy9J0wkGL16L e99g6gdGeIRE82BZjBjKGDkoyDPq+oDRSFl8NtzmIKy+cfz00nViqcTF4bREXEawFGhlpO0X O9q8mijI9iFB6zaPBiSdJGBL5ML5qLTNCl8Zlf4m1TBvmRTqF/lzMHVXHidDoUhpSh/y3AFZ 1KrYc27ztJQywDJPJPWPbtY8YhFLFs377gfP8WldsZjzp8nvoQARAQABzSVDb2xpbiBQZXJj aXZhbCA8Y3BlcmNpdmFARnJlZUJTRC5vcmc+wsGRBBMBCAA7FiEEglY7hNBiDtwN+4ZBOJfy 4i5lrT8FAmWMSrYCGwMICwkNCAwHCwMFFQoJCAsFFgMCAQACHgUCF4AACgkQOJfy4i5lrT++ ig/9GZKdN2fHSyrANKZX38ivd7IX2wAYouqH9DrQM94W8IciaDLmarN4Pl9mY+aucMwQUSyp uNtKOJwKqhVVaalF9Zw0sRMH4CJuvT7vKCtZ3q1Okb7soRvFte4d+vXhvPxCvBFDA5JzU7Lg DR5eqqcvF1dN1OuCq16pl0zCOSH/Jr5ToE3LM3Av1KBGcZD7ZSzHRWsFjV5AOUJKySuA3GwJ e/jASQcQ0YfCnru8ntLmYg/2SKvZFlfthZiCBnAppMt4n4BUAw3TDvf10HIDtdneejawcbLS gofLCvGqumwbZYAMKWrFzT4+7KQvr0pOw8QD7EbxnB4f9hQ7UiVF8qWsyKU3iv6b5JLhbS59 ooKRccyOvdMLcVJ0ZdpqoxrNv061ZUqLL5RiWjBlc1qjBnDxeg5oyM0rT8WLftdgvyH6RQt0 KWngumBAT5AT2DUYL8Uz1490cqfO9K4yEGZAJB9XRVX1g2IWTOjae+0g9ZII+h91UngFz+Rz aKDeseKBbCGDOFXx1TqKiHl2g255ZnUxKYTlucFtguv4gDGBgEk4G9JaEWBw1IWblcKhxH7L 2vWsUhvwghjIxHdO/RkeIeHvSp4YZxCJ7a3TaJLYAlwYopfTKVzNhcDY5h5syEuoHjyJCxXK SyoJYAVu8Yl2KUhvOtOmL1VZ6xyHnpdMRWKJZ5jOwU0EZYxKtgEQANYfgbtUMVnhjxDHhWLp g5kLHK3YW0TfJKzpXqDB7NiqxHofn4OcbZnVC3MKggcbs9o1/UtsjnlsG8550PfiYkDXvPiO RJwgbGs6MGIDK797C6cnBLQ8xwBa9SL4cl5iQFnhWmt6vwnJ+an/cm5JpYves3wL7jV09qU9 57hkHXEUcl38r4FssZzVcLKPUVTa3Un+QGRTGDGe/f4ctjMaqv0ZCM+l2ixPhf/vqESrfSLv V/+T3dmtUfXjazO3SABvsHwxgGuTTYOlKoPCaebr+BRdqm0xeIShoIlhvTI8y4clchqx/Uxg UG5X2kvU13k3DS3Q8uLE4Et9x1CcZT6WGgBZSR6R0WfD0SDnzufNnRWJ0dEPA2MtJHE7+85R Vi9j/IgZV+y5Ur+bnPkjDG1s2SVciX5v9HQ0oilcBhvx0j5lGE9hhurD9F+fCvkr4KdbCknE 6Y8ce8pCNBUoB/DqibJivOzTk9K9MGB5x0De5TerIrFiaw3/mQC9nGeO9dtE7wvDJetWeoTq 4BEaCzpufNqbkpOaTQILr4V6Gp7M6v97g83TVAwZntz/q8ptwuKQPZ2JaSFLZn7oWUpYXA5s +SIODFHLn6iMoYpBQskHQjnj4lEPJadl4qj+ZKA89iDAKsniyoFXsbJe2CPbMS1yzBxKZq6K D/jpt7BOnuHr/JrXABEBAAHCwXYEGAEIACAWIQSCVjuE0GIO3A37hkE4l/LiLmWtPwUCZYxK tgIbDAAKCRA4l/LiLmWtP3jmEACQrh9gWe8F1Tkw3m6VoHKwLc5he4tX3WpQa//soPO6iGG3 S3WPruQ46NrAaAojoOcKI9UONDO5rxG0ZTX53S+lu2EO47jbcLwOCjaEpjKpDRt9ZXBQE8Xl mtBE9Bp3W9gpjB1nE3KNM1mJYgsK0QdRpwwfh4pVgGpOj8j23I6MCK+v99zEBnpgCn2GX8W/ kctRXHqWwndHysOJtRP/zrl7dDaABF1f9efUl0LL3TD3GJ9VDz+DNOin/uK2a1hiJo8QzTRk PpfUQ2ebzDsrd1i/pOWkMSkdH+rEu4AGrXWtaBwrMyrGkL6Icb6yO+P9/z0W2wlgBf3P1YRt JPgQt/Dj3yvA/UnaV/QmuVQPjl13o24UnJGsZM8XGnNdfWBKkC1Q6VXC4QT+dyBHYH9MuE9d 6oGl8pFM1+cTfEfbM62/rRoPkF1yHMsI/903VxEvuUIKfhEZAVLFyHldooNxuchntHQP9y8J 8Ou9bWYQP7MnEn+kwSwrZkjurfPkan+xQvp6dDYnj3V0GwA5pprBMaB928VIDVOv+1PNQI3t Cvk5VPv/skq+TJRMHW7bFSt8PRa91cUf1FOLIz9APDiJOzXkwxUEHGV3zPSaUhs1JYjyBeGT wDAvtLUdjOnRhEUOwlnIrztmvyciutjJoVzKEEjj5WXnHk9L9kQ1bpAjkjTONw== In-Reply-To: <20251217010214.E6507E38F@freefall.freebsd.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 12/16/25 17:02, FreeBSD Security Advisories wrote: > This issue is corrected as of the corresponding Git commit hash in the > following stable and release branches: > > Branch/path Hash Revision > ------------------------------------------------------------------------- > releng/15.0/ 408f5c61821f releng/15.0-n280998 A quick heads-up here for pkgbase users: If you upgrade to 15.0-RELEASE-p1 and run `uname -v` you will see a different hash from this. This is due to a glitch in the way we build security updates for pkgbase -- in order to make sure that we have updated packages ready to go when commits go into the src tree, we build them in advance by taking the src tree from the release and applying patches generated with `git format-patch` from the security team's staging tree; but it turns out that running `git am` and ending up with the exact same commit hashes is not trivial. I'm hoping to get this sorted out before 15.0-RELEASE-p2! -- Colin Percival FreeBSD Release Engineering Lead & EC2 platform maintainer Founder, Tarsnap | www.tarsnap.com | Online backups for the truly paranoid