On Thu, Dec 18, 2008 at 7:00 AM, a800 <[email protected]> wrote: > The FreeBSD advisory says one has to upgrade to 7.0-RELEASE-p6 to get he > bug fixed. pfSense 1.2.1-RC4 image I have downloaded couple days ago > says it runs 7.0-RELEASE-p5. > > Do you mean this flaw was fixed in the source tree of pfSense, > independently from FreeBSD?
Yes. But looking into this, I believe 1.2.1 should have been on -p6 since we pulled the arc4random patch due to it making it's way into the RELENG_7_0 branch. > I wonder if this fact was mentioned in some release notes or changelog > document? I am doing a security review of a custom firewall based on CVS commit logs. Adding patch http://cvs.pfsense.org/cgi-bin/cvsweb.cgi/tools/builder_scripts/patches.RELENG_1_2?rev=1.31;content-type=text%2Fx-cvsweb-markup Removing patch http://cvs.pfsense.org/cgi-bin/cvsweb.cgi/tools/builder_scripts/patches.RELENG_1_2?rev=1.33;content-type=text%2Fx-cvsweb-markup --Bill --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] Commercial support available - https://portal.pfsense.org
