Skip to content

ReleaseNotes.md

Latest commit

 

History

History
630 lines (442 loc) · 21.3 KB

ReleaseNotes.md

File metadata and controls

630 lines (442 loc) · 21.3 KB
Raw

Release Notes for OmniOSce v11 r151056

r151056aw (2026-10-07)

Weekly release for w/c 05th of October 2026.

This update requires a reboot

Security Fixes

  • Fixed a flaw in the bhyve instruction emulator which allowed a privileged user in a guest to panic the host by issuing a REP MOVS or REP STOS instruction against the local APIC (CVE-2026-102916).

  • Fixed several vulnerabilities in system daemons whose doors are accessible to unprivileged local users. A local user could exhaust kernel memory by repeatedly passing file descriptors to nscd (CVE-2026-104112), crash ipmgmtd, nwamd or reparsed (CVE-2026-104113, CVE-2026-104114 and CVE-2026-104115), change the persistent IPMP configuration through ipmgmtd (CVE-2026-104117), or disrupt zonestat in other zones and discover which zones are running (CVE-2026-104116).

  • Fixed two issues in the inotify(7) facility which could reveal the timing of another user's file activity. Adding a watch now requires a descriptor that is open for reading, and reads and writes on a FIFO no longer generate events.

  • Fixed a kernel panic due to a stack overflow in the event that too many inotify watches were placed on the same vnode.

  • pcre2 has been updated to version 10.49, fixing multiple security issues including an out-of-bounds write when using a growable JIT stack (CVE-2026-103111).

  • iperf3(1) has been updated to version 3.22, fixing multiple vulnerabilities including a remote use-after-free in the server and a heap buffer overflow in authentication (CVE-2026-101283 and CVE-2026-101276).

  • Python has been updated to version 3.13.16, fixing multiple security issues including a flaw in the tarfile extraction filters which could allow a crafted archive to modify files outside the destination directory (CVE-2026-82049).

Other Changes

  • The time zone database has been updated to version 2026e.

r151056av (2026-10-02)

Weekly release for w/c 28th of September 2026.

This is a non-reboot update

Security Fixes

  • expat has been updated to version 2.8.5, fixing a UTF-16 decoding flaw in the XML parser which could allow malformed input to reach the application (CVE-2026-93990).

  • OpenSSL has been updated to version 3.5.9, fixing multiple vulnerabilities including a heap memory disclosure in DTLS handshake retransmission (CVE-2026-84782).


r151056au (2026-09-24)

Weekly release for w/c 21st of September 2026.

This is a non-reboot update

Security Fixes

Other Changes

  • rsync(1) has been updated to version 3.5.1, fixing several path handling regressions from 3.5.0. See the upstream release notes for the full list of changes.

r151056at (2026-09-18)

Weekly release for w/c 14th of September 2026.

This is a non-reboot update

Security Fixes

  • vim(1) has been updated to version 9.2.1014, fixing multiple security issues.

  • libxml2 has been updated to version 2.15.4, fixing multiple security issues including out-of-bounds memory accesses and integer overflows in the XML parser.

  • libxslt has been updated to version 1.1.45, fixing type confusion issues in the XSLT engine which could cause a crash or memory corruption when processing a crafted stylesheet (CVE-2025-7424 and CVE-2025-11731).

  • xz has been updated to version 5.8.4, fixing a buffer overflow when decoding an index that contains no records (CVE-2026-34743) and an invalid memory access in the decoder following a failed memory allocation (GHSA-5qpq-xqfv-j9pg).

Other Changes

  • The time zone database has been updated to version 2026d.

  • libxml2 is now built with -D_REENTRANT so that it uses the per-thread errno. Without this, error codes could be mixed up between threads in a multi-threaded program.


r151056as (2026-09-10)

Weekly release for w/c 7th of September 2026.

This update requires a reboot

Security Fixes


r151056aq (2026-08-25)

Weekly release for w/c 24th of August 2026.

This update requires a reboot

Security Fixes

  • OpenSSL has been updated to version 3.5.8, fixing multiple vulnerabilities.

  • rsync(1) has been updated to version 3.5.0, resolving multiple security issues.

  • expat has been updated to version 2.8.3, fixing an out-of-bounds read in the XML parser (CVE-2026-72522).

  • OpenJDK packages have been updated to versions 1.8.504-01, 11.0.32.1+1, 17.0.20.1+1 and 21.0.12.1+1, incorporating the fixes from the 2026/07/21 and 2026/08/18 OpenJDK vulnerability advisories.

  • Updated AMD CPU microcode to 20260724.

Other Changes

  • OpenJDK 21 incorrectly determined that the system did not support IPv6, causing Java applications to run in IPv4-only mode.

  • The loadable builtin modules for bash(1) were missing from the package due to a silent build failure, and the default search path for loadable builtins did not include the directory to which they are delivered. The modules are now shipped once again.


r151056aj (2026-07-08)

Weekly release for w/c 06th of July 2026.

This update requires a reboot

Security Fixes

  • The ZFS_IOC_USERSPACE_MANY ioctl truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, which could result in a smaller allocation than expected and a subsequent kernel buffer overrun (CVE-2026-49429) - see illumos 18207.

  • The zfs ioctl interface could mis-parse corrupt nvlists supplied from userland, triggering a kernel panic - see illumos 18206.

  • An integer overflow in the poll(4D) driver's handling of a large nfds value could bypass the buffer size check and result in a kernel heap overflow (CVE-2026-35384) - see illumos 18003.

  • The dld ioctl framework performed a second copyin(9F) of data that had already been copied in by its callers, creating a time-of-check/time-of-use race in which userland could substitute different data after validation - see illumos 18020.

  • The SCTP INIT ACK chunk parameter parser did not fully validate address list parameters, allowing a crafted INIT ACK chunk to trigger kernel memory corruption - see illumos 18117.

  • curl(1) has been updated to version 8.21.0, fixing multiple security issues.

  • expat has been updated to version 2.8.2, addressing multiple security issues in the XML parser.

  • rsync(1) has been updated to version 3.4.4, resolving multiple security issues.

Other Changes

  • perl now uses gcc to link extension module instead of driving the illumos linker directly. The illumos linker is still used but using gcc allows for the proper insertion of required modules into the link path.

r151056af (2026-06-12)

Weekly release for w/c 8th of June 2026.

This update requires a reboot

Security Fixes

  • OpenSSL Has been updated to version 3.6.3, fixing multiple vulnerabilities.

  • Updated Intel CPU microcode to 20260512

  • 7zip updated to version 26.01

Other Changes

  • Bhyve leaked some CPU leafs on AMD that could cause some recent Linux guests to panic on a divide-by-zero.

r151056ac (2026-05-22)

Weekly release for w/c 18th of May 2026.

This update requires a reboot

Security Fixes

Other Changes

  • swprintf(3c) functions were incorrectly writing multibyte characters according to the LC_CTYPE of the current locale.

  • zonestat(1) was not honouring a provided list of zones (the -z option), instead always printing all zones.


r151056z (2026-04-29)

Weekly release for w/c 27th of April 2026.

This update requires a reboot

Security Fixes

  • openssl 3 has been updated to version 3.5.6, addressing multiple vulnerabilities.

  • The legacy openssl 1.0 and 1.1 packages have also been updated to address vulnerabilities.

  • Perl has been updated to version 5.42.2

Other Changes

  • Bhyve virtio-console devices now defer additional configuration until after the guest reports it is ready. This resolves an interoperability problem with windows guests.

  • The timezone database has been updated.


r151056t (2026-03-16)

Weekly release for w/c 16th of March 2026.

This update requires a reboot

Security Fixes

  • Intel CPU microcode updated to version 20260227.

  • Curl updated to version 8.19.0.

Other Changes

  • Setting the bootnext attribute in a bhyve-branded zone would cause the zone to fail to boot.

  • lpsched would dump core when using the traditional printing system.


r151056m (2026-01-29)

Weekly release for w/c 26th of January 2026.

This update requires a reboot

Security Fixes

  • AMD CPU microcode has been updated to version 20251202.

  • OpenSSL updated to version 3.5.5

  • OpenSSH was failing to generate login audit events.

Other Changes

  • Various Zen5 CPUs now have the RDSEED instruction re-enabled if they are running sufficiently new microcode.

  • AMX-equipped CPUs had excessive stack size requirements in order to successfully store floating-point register state. That has been remedied.

  • The GNU make utility previously contained a hard-coded compiler version in its default CXX variable.

  • A rarely occurring buffer overflow in rsyslog related to JSON encoding has been fixed.


r151056k (2026-01-14)

Weekly release for w/c 12th of January 2026.

This update requires a reboot

Security Fixes

  • Curl updated to version 8.18.0.

  • The bhyve mouse driver could de-reference a NULL pointer in some circumstances.

Other Changes

  • SMB Active Directory joins now fall back to seting the machine password via LDAP if kerberos fails. Many AD sites block kerberos for this.

  • NVMe devices used as a system boot device would previously end up with a single I/O queue, limiting performance.

  • NVMe devices could incorrectly return an error on queue saturation that is interpreted by ZFS as a device failure.

  • The IP Filter fragment cache table could become corrupt, resulting in a kernel panic.


r151056d (2025-11-26)

Weekly release for w/c 24th of November 2025.

This update requires a reboot

Security Fixes

  • Update Intel CPU microcode to 20251111.

  • Update AMD CPU microcode to 20251030.

  • Disable the faulty RDSEED instruction on vulnerable Zen5 processors.

Other Changes

  • Under specific circumstances, transactions in the ZFS transaction log could be replayed out of order following an unexpected system restart, potentially resulting in data corruption.

  • Unloading the softmac driver could result in a system panic.

  • The pcieadm utility can now decode Virtio vendor-specific capabilities.

  • Fix for a NFS client regression with macOS 14 server.

  • git updated to version 2.51.2

  • OpenJDK packages updated to versions 1.8.472-08, 11.0.29+7, 17.0.17+10 and 21.0.9+10.

  • Python updated to version 3.13.9.


Stable Release, 3rd of Nov 2025

uname -a shows omnios-r151056-128de81dcd

r151056 release repository: https://pkg.omnios.org/r151056/core

Upgrade Notes

Upgrades are supported from the r151054 release only. If upgrading from an earlier version, upgrade in stages, referring to the table at https://omnios.org/upgrade.

New features since r151054

System Features

  • Added support for management of NVMe namespaces on devices which support it.

  • The performance of the gethrtime(3c) library function has been significantly improved via use of the shared comm page.

  • The kernel runtime linker has been enhanced so that it is able to load larger kernel modules.

  • The DHCP "Interface MTU" option is now honoured when configuring network interfaces via DHCP.

  • Support for SMBIOS version 3.9.

Commands and Command Options

  • sed(1) can now process common escapes for \r, \n and \t

  • The pcre2(3) library is now built with JIT support.

  • pmap(1) now labels the comm page segment as such.

  • ucodeadm(8) can now inspect and manage binary AMD microcode files.

  • pkg(1) supports a new option --with-be to allow running pkg pieces in an alternative boot environment.

  • kstat(1) supports a new -V option that can be used in conjunction with -p to output just the kstat value.

  • The stack backtrace commands in mdb(1) such as ::findstack now support two additional options. -t will include function and parameter type information, and -s will show the change in stack size between frames. These commands have also been enhanced to show the probable function name when handling calls to functions that do not return.

  • mdb(1) has a new ::bcmp dcmd to compare memory regions.

Libraries and Library Functions

  • The POSIX getlocalename_l(3C) library function has been added.

  • getaddrinfo(3XNET) will now always return multiple entries for an unspecified socket type. It would previously only do this when the requested service did not appears in services(5).

LX zones

  • The emulated LX proc filesystem now exposes tunables for network buffer size and panic-on-oops.

Hardware Support

  • nvmeadm(8) has received multiple updates to extend support for vendor-specific log pages and commands.

  • The cxgbe network interface driver has been updated to improve performance and fix multiple issues.

  • The rge network interface driver has been updated to fix an issue caused when device statistics are required before the device is fully initialised.

Installer

  • It was previously not possible to configure the serial console configuration during installation for anything other than ttya; this has been corrected.

Deprecated features

  • The grub boot loader is deprecated and has been removed in the r151048 release. It will be supported in r151046 for the full LTS time frame, up to May 2026. If you have not yet migrated to the new boot loader, and would like assistance, please get in touch.

  • OpenSSL 1.0.x and 1.1.1 are deprecated and reached end-of-support at the end of 2019 and in September 2023 respectively. OmniOS has transitioned to OpenSSL 3 and still ships older versions for backwards compatibility, but these are maintained solely on a best-efforts basis. If possible, recompile software to use OpenSSL 3.

  • Python 2 is now end-of-life and will not receive any further updates. The python-27 package is still available for backwards compatibility but will be maintained only on a best-efforts basis.

  • OpenSSH in OmniOS no longer provides support for GSSAPI key exchange. This was removed in release r151038.

Package changes

Package Old Version New Version
compress/7zip 24.9 25.1
data/iso-codes 4.17.0 4.18.0
database/sqlite-3 3.49.1 3.50.4
developer/build/automake 1.17 1.18.1
developer/gcc13 13.3.0 13.4.0
developer/gcc14 14.2.0 14.3.0
developer/gnu-binutils 2.44 2.45
developer/macro/gnu-m4 1.4.19 1.4.20
developer/swig 4.3.0 4.3.1
developer/versioning/git 2.49.0 2.51.0
developer/versioning/mercurial 7.0 7.0.2
editor/vim 9.1.1202 9.1.1730
file/gnu-coreutils 9.6 9.8
library/glib2 2.82.5 2.84.4
library/libxml2 2.13.8 2.14.6
library/libxslt 1.1.42 1.1.43
library/nghttp2 1.65.0 1.67.1
library/nspr 4.36 4.37
library/pcre2 10.45 10.46
library/python-3/cffi-313 1.17.1 2.0.0.1
library/python-3/coverage-313 7.7.1 7.10.6
library/python-3/cryptography-313 44.0.2 45.0.7
library/python-3/meson-313 1.7.0 1.9.0
library/python-3/orjson-313 3.10.16 3.11.3
library/python-3/packaging-313 24.2 25.0
library/python-3/pip-313 25.0.1 25.2
library/python-3/pycodestyle-313 2.12.1 2.14.0
library/python-3/pyopenssl-313 25.0.0 25.1.0
library/python-3/setuptools-313 78.1.0 80.9.0
library/python-3/setuptools-rust-313 1.11.0 1.12.0
library/python-3/typing-extensions-313 4.13.0 4.15.0
library/readline 8.2.13 8.3
library/security/liboqs 0.12.0 Removed
library/security/oqs-provider 0.8.0 Removed
network/dns/bind 9.18.35 9.18.39
network/test/iperf 3.18 3.19.1
runtime/perl 5.40.2 5.42.0
runtime/python-313 3.13.3 3.13.7
security/sudo 1.9.17.1 1.9.17.2
service/network/chrony 4.6.1 4.8
service/network/ntpsec 1.2.3 1.2.4
shell/bash 5.2.32 5.3
shell/pipe-viewer 1.9.31 1.9.34
shell/tcsh 6.24.15 6.24.16
system/data/hardware-registry 2025.1.27 2025.6.9
system/library/mozilla-nss 3.110 3.116
system/microcode/amd 20241121 20250729
system/pciutils 3.13.0 3.14.0
system/rsyslog 8.2502.0 8.2508.0
system/test/fio 3.39 3.41
system/virtualization/open-vm-tools 12.5.0 13.0.0
text/gawk 5.3.1 5.3.2
text/gnu-diffutils 3.11 3.12
text/gnu-gettext 0.24 0.26
text/gnu-grep 3.11 3.12
text/gnu-patch 2.7.6 2.8
text/less 668 679