FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F14.2 2025-09-30T15:36:37Z 2025-09-30T15:36:37Z Gordon Tetlow gordon@FreeBSD.org 2025-09-30T15:36:37Z urn:sha1:16a79708d089423ec0c3d32f25e7ca97ae58e97b Approved by: so 2025-09-30T15:31:54Z Gordon Tetlow gordon@FreeBSD.org 2025-09-30T15:27:08Z urn:sha1:6a0d914d9c3ebd8c150b7f90e79616d16efefee8 Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) Out-of-bounds read in HTTP client no_proxy handling (CVE-2025-9232) Obtained from: OpenSSL Approved by: so Security: FreeBSD-SA-25:08.openssl Security: CVE-2025-9230 Security: CVE-2025-9232 (cherry picked from commit 270158508d7c55a0737c2a9915cd4afc8fabdaf0) 2025-09-30T04:58:01Z Colin Percival cperciva@FreeBSD.org 2025-09-23T06:55:08Z urn:sha1:3447fea3523b56a235b9f8fe9234893f00795379 Upgrading from 14.x to 15.x with freebsd-update broke because libc depends on the new libsys library; freebsd-update installed the new libc before creating libsys, and every step after that failed because all the tools (including gunzip and install) are dynamically linked and need a working libc. Enforce ordering when installing shared objects: First libsys, then libc, then libthr, and then all the rest of the shared object files. This is a candidate for an Errata Notice since the issue this fixes breaks upgrades. PR: 289769 Reported by: Graham Perrin Reviewed by: kib MFC after: 3 days Sponsored by: https://www.patreon.com/cperciva Differential Revision: https://reviews.freebsd.org/D52688 Approved by: so Security: FreeBSD-EN-25:18.freebsd-update (cherry picked from commit 7ece602e00e85195fc426a2401c49921cd39735e) (cherry picked from commit e26928669f39c8683aea74040b9e2472e944c43a) 2025-09-16T16:28:35Z Gordon Tetlow gordon@FreeBSD.org 2025-09-16T16:28:35Z urn:sha1:f3ffa7eb382a2b90816f94aa2fb2431688e0c2b8 Approved by: so 2025-09-14T00:21:16Z John-Mark Gurney jmg@FreeBSD.org 2025-08-18T20:25:37Z urn:sha1:722746b39e6ecaa4eeb36005c9bd69a9bcd68528 if the syscall muxes are used, up to two additional arguments may be required. This means that the 8 required for mmap increases up to 10 (for __syscall). Sponsored by: Juniper Networks, Inc. Approved by: so Security: FreeBSD-EN-25:15.arm64 (cherry picked from commit 740b879c6ade531adebeba7cd2f261bbe650797f) (cherry picked from commit 17d87881a363c160e7e8cdb252d0261214c1a50b) 2025-08-08T00:18:32Z Gordon Tetlow gordon@FreeBSD.org 2025-08-08T00:18:32Z urn:sha1:0781dd1545f6ed8a12cad7c3b98cf7c36c5af36f Approved by: so 2025-08-07T23:53:04Z Martin Matuska mm@FreeBSD.org 2025-06-01T20:16:26Z urn:sha1:c0979bd2734f792c33bd45932f2eefe792dc74c2 libarchive 3.8.1 New features: #2088 7-zip reader: improve self-extracting archive detection #2137 zip writer: added XZ, LZMA, ZSTD and BZIP2 support #2403 zip writer: added LZMA + RISCV BCJ filter #2601 bsdtar: support --mtime and --clamp-mtime #2602 libarchive: mbedtls 3.x compatibility Security fixes: #2422 tar reader: Handle truncation in the middle of a GNU long linkname (CVE-2024-57970) #2532 tar reader: fix unchecked return value in list_item_verbose() (CVE-2025-25724) #2532 unzip: fix null pointer dereference (CVE-2025-1632) #2568 warc: prevent signed integer overflow (CVE-2025-5916) #2584 rar: do not skip past EOF while reading (CVE-2025-5918) #2588 tar: fix overflow in build_ustar_entry (CVE-2025-5917) #2598 rar: fix double free with over 4 billion nodes (CVE-2025-5914) #2599 rar: fix heap-buffer-overflow (CVE-2025-5915) Important bugfixes: #2399 7-zip reader: add SPARC filter support for non-LZMA compressors #2405 tar reader: ignore ustar size when pax size is present #2435 tar writer: fix bug when -s/a/b/ used more than once with b flag #2459 7-zip reader: add POWERPC filter support for non-LZMA compressors #2519 libarchive: handle ARCHIVE_FILTER_LZOP in archive_read_append_filter #2539 libarchive: add missing seeker function to archive_read_open_FILE() #2544 gzip: allow setting the original filename for gzip compressed files #2564 libarchive: improve lseek handling #2582 rar: support large headers on 32 bit systems #2587 bsdtar: don't hardlink negative inode files together #2596 rar: support large headers on 32 bit systems #2606 libarchive: support @-prefixed Unix epoch timestamps as date strings #2634 tar: Support negative time values with pax #2637 tar: Keep block alignment after pax error #2642 libarchive: fix FILE_skip regression #2643 tar: Handle extra bytes after sparse entries #2649 compress: Prevent call stack overflow #2651 iso9660: always check archive_string_ensure return value CVE: CVE-2024-57970, CVE-2025-1632, CVE-2025-25724, CVE-2025-5914, CVE-2025-5915, CVE-2025-5916, CVE-2025-5917, CVE-2025-5918 PR: 286944 (exp-run, main, libarchive 3.8.0) Approved by: so Security: FreeBSD-SA-25:07.libarchive (cherry picked from commit 2e113ef82465598b8c26e0ca415fbe90677fbd47) (cherry picked from commit 6dad4525a2910496ecf3c41de659aac906f6c1f4) 2025-08-07T23:23:56Z Oleg Streejak oleg@pcbtech.ru 2025-07-17T17:06:50Z urn:sha1:168703212b618f32b42ed1f9e062a74d7f0cc534 This is a small oversight in the transition to netlink; the non-netlink implementation would explicitly flush its stdout as necessary to avoid apparent long stalls in output when we end up fully-buffered. Adjust the netlink implementation to do the same. This was noticed while trying to triage failures in the wg-quick script. Commit message by kevans, patch by author. PR: 278265 Fixes: 091fec1188929 ("route: switch transport protocol [...]") Approved by: so Security: FreeBSD-EN-25:14.route (cherry picked from commit 97b61b22edba74c62adba1d022fb73541aa5ff93) (cherry picked from commit dd695839efd80fe81143cd6c7a552c30df8448f6) 2025-07-02T06:03:15Z Gordon Tetlow gordon@FreeBSD.org 2025-07-02T06:03:15Z urn:sha1:d9352700f9357aa170c1e4dc144537998ec66025 Approved by: so 2025-07-02T05:56:35Z Gordon Tetlow gordon@FreeBSD.org 2025-07-02T05:56:35Z urn:sha1:49b07b94662b92edb6d8de1e997fa805ac8d2b7c Approved by: so Security: FreeBSD-SA-25:06.xz Security: CVE-2025-31115