From nobody Thu Sep 24 20:20:09 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1788868910571158.43543429833505; Tue, 8 Sep 2026 05:01:50 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1411336.1642108 (Exim 4.92) (envelope-from ) id 1x3uVX-0006fd-Oz; Tue, 08 Sep 2026 12:00:59 +0000 Received: by outflank-mailman (output) from mailman id 1411336.1642108; Tue, 08 Sep 2026 12:00:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1x3uVX-0006bh-F5; Tue, 08 Sep 2026 12:00:59 +0000 Received: by outflank-mailman (input) for mailman id 1411336; Tue, 08 Sep 2026 12:00:57 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1x3uVU-00061x-Lr; Tue, 08 Sep 2026 12:00:56 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1x3uVU-00H0es-2W; Tue, 08 Sep 2026 14:00:56 +0200 Received: from [10.42.69.6] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a9ff8ef-bab6-0a2a0a5309dd-0a2a450691f0-34 for ; Tue, 08 Sep 2026 14:00:56 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-16d1c6.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a9ff8f6-195a-0a2a45060019-6882d725cd8e-3 for ; Tue, 08 Sep 2026 14:00:55 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1x3uVM-004n5G-0m; Tue, 08 Sep 2026 12:00:48 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1x3uVM-00GkcL-1j; Tue, 08 Sep 2026 12:00:48 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.510 (Entity 5.510) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 512 v3 (CVE-2026-79604) - oxenstored: Unbounded accumulation of watches Message-Id: Date: Tue, 08 Sep 2026 12:00:48 +0000 X-purgate-ID: tlsNG-16d1c6/1788868855-F460277B-5B52116B/0/0 X-purgate-type: clean X-purgate-size: 30031 X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.13.1.5.4/288.865.29 X-ZM-MESSAGEID: 1788868912852158501 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Reported-by: David Korczynski Reviewed-by: Andrii Sultanov -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-79604 / XSA-512 version 3 oxenstored: Unbounded accumulation of watches UPDATES IN VERSION 3 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Public release. ISSUE DESCRIPTION =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Oxenstored maintains two datastructures about watches; one global trie, and one hashtable tracked per domain. When a xenbus reconnect is requested, watches are not cleared out of the global trie. IMPACT =3D=3D=3D=3D=3D=3D A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. VULNERABLE SYSTEMS =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D All version of Xen from 4.6 onwards are vulnerable. Only systems using the Ocaml Xenstored implementation are vulnerable. Systems using the C Xenstored implementation are not vulnerable. MITIGATION =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D There are no mitigations. CREDITS =3D=3D=3D=3D=3D=3D=3D Found by Anthropic using agents to study the security of open-source projects, with Ada Logics validating and reporting. RESOLUTION =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Applying the appropriate set of attached patches resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. For xen.git oxenstored: xsa512-?.patch xen-unstable - Xen 4.18.x xsa512-4.17-?.patch Xen 4.17.x For xapi-project/oxenstored: xsa512-oxenstored-?.patch oxenstored master $ sha256sum xsa512* c4f92a3e032f853a85cbd43391b6fd6a2c8f6f4caeee49bec9bc97a5279ce9a3 xsa512-1.= patch 2cc57079eda8f0db34885e8be242d736f590ae8094c60a044b55b4889e10392f xsa512-2.= patch 16bfa30473d4ba67dea69f1915357ecbe4aefc3b10bfd413f0bd7a7d2cfe2a80 xsa512-4.= 17-1.patch 7c23fb0e64429db074d7ec4cf7ba6ba319b69d5f1d059aa848c19b9ce148244c xsa512-4.= 17-2.patch 28c6267057ccf3508eee92dd82a9726e6b0d616fd7cc3e7dcee9cbfd3b0b80f7 xsa512-ox= enstored-1.patch 00b9df35d9cc3ee393385a65725a2a681e31b9e00c4d1d76e0441e284f005707 xsa512-ox= enstored-2.patch $ DEPLOYMENT DURING EMBARGO =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmqf98gMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZk9kIAMqGI+5EVMLUd++EmpLqiTyGPcMYcDexca9XIpfJ Gx+DICPIRfRDCFtUG4jEeEDi8lmDvIKp5XXTNRkxyWF3uVKYDA5xCxekKOGmS40A p46pGzVVzGeSKdm2FfxEDDyuhhET5QrZLN98rJBcoL0/aX5sI4UoDR/FfdFemoAV BVrRG4WgQuBDa7+/t4jgZ8DysZbn/zmLoOtNIPVtaH5zvep0ehGQSnR8sAOEB+mV tmiW3kQoR1hxlOF/p1iVKLoBdOtJktwJ+Tk6OCCssS5TNGlGcpTs0KPukkXKwrem vYDYkHeUTf4rd3khUfCdW1S0Gc/3XSBtdL26VSj1xku5kMA=3D =3D6TLi -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa512-1.patch" Content-Disposition: attachment; filename="xsa512-1.patch" Content-Transfer-Encoding: base64 RnJvbSA1MzMyYTJjNDZkYjRmOTZlNWQ1YTU3MTAwYzU1MDc2ZmU1NjEwYmVi IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBBbmRyaWkgU3VsdGFu b3YgPGFuZHJpeS5zdWx0YW5vdkB2YXRlcy50ZWNoPgpEYXRlOiBUaHUsIDIw IEF1ZyAyMDI2IDE2OjAwOjAyICswMTAwClN1YmplY3Q6IG94ZW5zdG9yZWQ6 IEZhY3RvciBvdXQgUHJvY2Vzcy5kb19yZWNvbm5lY3QoKQoKVGhlIGxvZ2lj IGZsb3cgaGVyZSBpcyBjb21wbGljYXRlZC4gIEluIHByZXBhcmF0aW9uIHRv IGZpeCBhIGJ1ZywgZmFjdG9yIG91dApyZWNvbm5lY3RpbmcgYSB4ZW5idXMg Y29ubmVjdGlvbiwgYW5kIGZvbGQgSGlzdG9yeS5yZWNvbm5lY3QgaW50byBp dCdzIHNpbmdsZQpjYWxsZXIuCgpObyBmdW5jdGlvbmFsIGNoYW5nZS4KClRo aXMgaXMgcGFydCBvZiBYU0EtNTEyIC8gQ1ZFLTIwMjYtNzk2MDQuCgpTaWdu ZWQtb2ZmLWJ5OiBBbmRyaWkgU3VsdGFub3YgPGFuZHJpeS5zdWx0YW5vdkB2 YXRlcy50ZWNoPgpTaWduZWQtb2ZmLWJ5OiBBbmRyZXcgQ29vcGVyIDxhbmRy ZXcuY29vcGVyM0BjaXRyaXguY29tPgpSZXZpZXdlZC1ieTogQW5kcmlpIFN1 bHRhbm92IDxhbmRyaXkuc3VsdGFub3ZAdmF0ZXMudGVjaD4KCmRpZmYgLS1n aXQgYS90b29scy9vY2FtbC94ZW5zdG9yZWQvaGlzdG9yeS5tbCBiL3Rvb2xz L29jYW1sL3hlbnN0b3JlZC9oaXN0b3J5Lm1sCmluZGV4IGYwM2ZiMTgzMjky My4uMzQ3NGE2MmRhMjMwIDEwMDY0NAotLS0gYS90b29scy9vY2FtbC94ZW5z dG9yZWQvaGlzdG9yeS5tbAorKysgYi90b29scy9vY2FtbC94ZW5zdG9yZWQv aGlzdG9yeS5tbApAQCAtMzksMTAgKzM5LDYgQEAgbGV0IGVuZF90cmFuc2Fj dGlvbiB0eG4gY29uIHRpZCBjb21taXQgPQogICB0cmltIH50eG4gKCk7CiAg IHN1Y2Nlc3MKIAotbGV0IHJlY29ubmVjdCBjb24gPQotICB0cmltICgpOwot ICBDb25uZWN0aW9uLmRvX3JlY29ubmVjdCBjb24KLQogbGV0IHB1c2ggKHg6 IGhpc3RvcnlfcmVjb3JkKSA9CiAgIGxldCBkb20gPSB4LmNvbi5Db25uZWN0 aW9uLmRvbSBpbgogICBtYXRjaCBkb20gd2l0aApkaWZmIC0tZ2l0IGEvdG9v bHMvb2NhbWwveGVuc3RvcmVkL3Byb2Nlc3MubWwgYi90b29scy9vY2FtbC94 ZW5zdG9yZWQvcHJvY2Vzcy5tbAppbmRleCAwYzljNDYwYTk5MTUuLmJjNjhj NTRjOWFiYSAxMDA2NDQKLS0tIGEvdG9vbHMvb2NhbWwveGVuc3RvcmVkL3By b2Nlc3MubWwKKysrIGIvdG9vbHMvb2NhbWwveGVuc3RvcmVkL3Byb2Nlc3Mu bWwKQEAgLTM1MCw2ICszNTAsMTMgQEAgbGV0IGRvX3Jlc2V0X3dhdGNoZXMg Y29uIF90IF9kb21haW5zIGNvbnMgX2RhdGEgPQogICBDb25uZWN0aW9ucy5k ZWxfd2F0Y2hlcyBjb25zIGNvbjsKICAgQ29ubmVjdGlvbi5kZWxfdHJhbnNh Y3Rpb25zIGNvbgogCitsZXQgZG9fcmVjb25uZWN0IGNvbnMgY29uID0KKyAg bGV0IGRvbXN0ciA9IENvbm5lY3Rpb24uZ2V0X2RvbXN0ciBjb24gaW4KKyAg aW5mbyAiJXMgcmVxdWVzdHMgYSByZWNvbm5lY3QiIGRvbXN0cjsKKyAgSGlz dG9yeS50cmltICgpOworICBDb25uZWN0aW9uLmRvX3JlY29ubmVjdCBjb247 CisgIGluZm8gIiVzIHJlY29ubmVjdGlvbiBjb21wbGV0ZSIgZG9tc3RyCisK ICgqIG9ubHkgaW4gPj0geGVuMy4zICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgKikKIGxldCBkb19zZXRfdGFyZ2V0IGNvbiBfdCBf ZG9tYWlucyBjb25zIGRhdGEgPQogICBpZiBub3QgKENvbm5lY3Rpb24uaXNf ZG9tMCBjb24pCkBAIC03MzUsOSArNzQyLDcgQEAgbGV0IGRvX2lucHV0IHN0 b3JlIGNvbnMgZG9tcyBjb24gPQogICAgICAgaWYgQ29ubmVjdGlvbi5jYW5f aW5wdXQgY29uIHRoZW4gQ29ubmVjdGlvbi5kb19pbnB1dCBjb24KICAgICAg IGVsc2UgTm9uZQogICAgIHdpdGggWGVuYnVzLlhiLlJlY29ubmVjdCAtPgot ICAgICAgaW5mbyAiJXMgcmVxdWVzdHMgYSByZWNvbm5lY3QiIChDb25uZWN0 aW9uLmdldF9kb21zdHIgY29uKTsKLSAgICAgIEhpc3RvcnkucmVjb25uZWN0 IGNvbjsKLSAgICAgIGluZm8gIiVzIHJlY29ubmVjdGlvbiBjb21wbGV0ZSIg KENvbm5lY3Rpb24uZ2V0X2RvbXN0ciBjb24pOworICAgICAgZG9fcmVjb25u ZWN0IGNvbnMgY29uOwogICAgICAgTm9uZQogICAgICAgIHwgSW52YWxpZF9h cmd1bWVudCBleHAgfCBGYWlsdXJlIGV4cCAtPgogICAgICAgICAgZXJyb3Ig ImNhdWdodCBleGNlcHRpb24gJXMiIGV4cDsKQEAgLTc2MCw3ICs3NjUsNyBA QCBsZXQgZG9faW5wdXQgc3RvcmUgY29ucyBkb21zIGNvbiA9CiAgICAgd3Jp dGVfYWNjZXNzX2xvZyB+dHkgfnRpZCB+Y29uOihDb25uZWN0aW9uLmdldF9k b21zdHIgY29uKSB+ZGF0YTsKICAgICBDb25uZWN0aW9uLmluY3Jfb3BzIGNv bgogCi1sZXQgZG9fb3V0cHV0IF9zdG9yZSBfY29ucyBfZG9tcyBjb24gPQor bGV0IGRvX291dHB1dCBfc3RvcmUgY29ucyBfZG9tcyBjb24gPQogICBDb25u ZWN0aW9uLnNvdXJjZV9mbHVzaF93YXRjaGV2ZW50cyBjb247CiAgIGlmIENv bm5lY3Rpb24uaGFzX291dHB1dCBjb24gdGhlbiAoCiAgICAgaWYgQ29ubmVj dGlvbi5oYXNfbmV3X291dHB1dCBjb24gdGhlbiAoCkBAIC03NzUsOCArNzgw LDYgQEAgbGV0IGRvX291dHB1dCBfc3RvcmUgX2NvbnMgX2RvbXMgY29uID0K ICAgICB0cnkKICAgICAgIGlnbm9yZSAoQ29ubmVjdGlvbi5kb19vdXRwdXQg Y29uKQogICAgIHdpdGggWGVuYnVzLlhiLlJlY29ubmVjdCAtPgotICAgICAg aW5mbyAiJXMgcmVxdWVzdHMgYSByZWNvbm5lY3QiIChDb25uZWN0aW9uLmdl dF9kb21zdHIgY29uKTsKLSAgICAgIEhpc3RvcnkucmVjb25uZWN0IGNvbjsK LSAgICAgIGluZm8gIiVzIHJlY29ubmVjdGlvbiBjb21wbGV0ZSIgKENvbm5l Y3Rpb24uZ2V0X2RvbXN0ciBjb24pCisgICAgICBkb19yZWNvbm5lY3QgY29u cyBjb24KICAgKQogCg== --=separator Content-Type: application/octet-stream; name="xsa512-2.patch" Content-Disposition: attachment; filename="xsa512-2.patch" Content-Transfer-Encoding: base64 RnJvbSA4ZGM0Y2E1MGU2MmYyNTg3YTAyMTNiMDc4ZmM5MDhmZGZiNTQ4Mjhi IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBBbmRyaWkgU3VsdGFu b3YgPGFuZHJpeS5zdWx0YW5vdkB2YXRlcy50ZWNoPgpEYXRlOiBUaHUsIDIw IEF1ZyAyMDI2IDE1OjAwOjAyICswMDAwClN1YmplY3Q6IG94ZW5zdG9yZWQ6 IFJlc2V0IHRoZSB3YXRjaGVzIHRyaWUgb24gZG9tYWluIHJlY29ubmVjdAoK b3hlbnN0b3JlZCBtYWludGFpbnMgdHdvIGRhdGFzdHJ1Y3R1cmVzIGFib3V0 IHdhdGNoZXM7IG9uZSBnbG9iYWwgdHJpZSwgYW5kCm9uZSBoYXNodGFibGUg dHJhY2tlZCBwZXIgZG9tYWluLiAgQm90aCBuZWVkIGtlZXBpbmcgaW4gc3lu YywgYW5kIHJpZ2h0IG5vdwp0aGUgZ2xvYmFsIHRyaWUgaXMgbm90IGVtcHRp ZWQgd2hlbiBhIHhlbmJ1cyByZWNvbm5lY3QgaXMgcmVxdWVzdGVkLgoKVGhp cyBpcyBiYXNpY2FsbHkgdGhlIHNhbWUgYnVnIGFzIFhTQS0zMzAsIGNvbW1p dCA0OTFhMDc3ZWQ0YzUKKCJ0b29scy9vY2FtbC94ZW5zdG9yZWQ6IGRlbGV0 ZSB3YXRjaCBmcm9tIHRyaWUgdG9vIHdoZW4gcmVzZXR0aW5nIHdhdGNoZXMi KSwKanVzdCB0aWNrbGVkIHZpYSBhbm90aGVyIHBhdGguCgpBcnJhbmdlIGZv ciBib3RoIFByb2Nlc3MuZG9fcmVzZXRfd2F0Y2hlcygpIGFuZCBQcm9jZXNz LmRvX3JlY29ubmVjdCgpIHRvCnNoYXJlIGEgY29tbW9uIGNvZGVwYXRoIGZv ciB0aGUgcmVzZXR0aW5nIG9mIHdhdGNoZXMgYW5kIHRyYW5zYWN0aW9ucy4K Tm90YWJseSwgdGhpcyBtZWFucyB0aGF0IHRoZSBsYXR0ZXIgbm93IGNhbGxz IENvbm5lY3Rpb25zLmRlbF93YXRjaGVzKCkgd2hpY2gKY2xlYXJzIHRoZSBn bG9iYWwgdHJpZSB0b28uCgpDb25uZWN0aW9ucy5kZWxfd2F0Y2hlcygpIGFs cmVhZHkgY2FsbHMgQ29ubmVjdGlvbi5kZWxfd2F0Y2hlcygpIHNvIHJlbW92 ZSB0aGUKcmUtY2xlYXJpbmcgb2YgdGhlIHN0YXRlIGZyb20gQ29ubmVjdGlv bi5kb19yZWNvbm5lY3QoKS4KCk1vdmUgSGlzdG9yeS50cmltKCkgaW50byBy ZXNldF93YXRjaGVzX2FuZF90cmFuc2FjdGlvbnMoKSBzbyBpdCdzIG9uIHRo ZQpjb21tb24gcGF0aCwgYW5kIHBsYWNlIGl0IGFmdGVyIHJlbW92aW5nIHRo ZSB0cmFuc2FjdGlvbnMgcmF0aGVyIHRoYW4gYmVmb3JlLgoKVGhpcyBpcyBw YXJ0IG9mIFhTQS01MTIgLyBDVkUtMjAyNi03OTYwNC4KClJlcG9ydGVkLWJ5 OiBEYXZpZCBLb3Jjenluc2tpIDxEYXZpZEBBZGFsb2dpY3MuY29tPgpGaXhl czogNjc0YWQyYmU0MDlkICgieGVuc3RvcmU6IGV4dGVuZCB0aGUgeGVuc3Rv cmUgcmluZyB3aXRoIGEgJ2Nsb3NpbmcnIHNpZ25hbCIpClNpZ25lZC1vZmYt Ynk6IEFuZHJpaSBTdWx0YW5vdiA8YW5kcml5LnN1bHRhbm92QHZhdGVzLnRl Y2g+ClNpZ25lZC1vZmYtYnk6IEFuZHJldyBDb29wZXIgPGFuZHJldy5jb29w ZXIzQGNpdHJpeC5jb20+ClJldmlld2VkLWJ5OiBBbmRyaWkgU3VsdGFub3Yg PGFuZHJpeS5zdWx0YW5vdkB2YXRlcy50ZWNoPgoKZGlmZiAtLWdpdCBhL3Rv b2xzL29jYW1sL3hlbnN0b3JlZC9jb25uZWN0aW9uLm1sIGIvdG9vbHMvb2Nh bWwveGVuc3RvcmVkL2Nvbm5lY3Rpb24ubWwKaW5kZXggZDExMDExZTE2NDM5 Li4zN2ViMjQ0NGI5MzYgMTAwNjQ0Ci0tLSBhL3Rvb2xzL29jYW1sL3hlbnN0 b3JlZC9jb25uZWN0aW9uLm1sCisrKyBiL3Rvb2xzL29jYW1sL3hlbnN0b3Jl ZC9jb25uZWN0aW9uLm1sCkBAIC0xNDgsMTMgKzE0OCwxMSBAQCBsZXQgbWFy a19hc19iYWQgY29uID0KIGxldCBpbml0aWFsX25leHRfdGlkID0gMQogCiBs ZXQgZG9fcmVjb25uZWN0IGNvbiA9CisgICgqIHRyYW5zYWN0aW9ucyBhbmQg d2F0Y2hlcyBoYW5kbGVkIGJ5IGNhbGxlciAqKQogICBYZW5idXMuWGIucmVj b25uZWN0IGNvbi54YjsKICAgKCogZG9tIGlzIHRoZSBzYW1lICopCi0gIEhh c2h0YmwuY2xlYXIgY29uLnRyYW5zYWN0aW9uczsKICAgY29uLm5leHRfdGlk IDwtIGluaXRpYWxfbmV4dF90aWQ7Ci0gIEhhc2h0YmwuY2xlYXIgY29uLndh dGNoZXM7CiAgICgqIGFub25pZCBpcyB0aGUgc2FtZSAqKQotICBjb24ubmJf d2F0Y2hlcyA8LSAwOwogICBjb24uc3RhdF9uYl9vcHMgPC0gMDsKICAgKCog cGVybSBpcyB0aGUgc2FtZSAqKQogICAoKQpkaWZmIC0tZ2l0IGEvdG9vbHMv b2NhbWwveGVuc3RvcmVkL3Byb2Nlc3MubWwgYi90b29scy9vY2FtbC94ZW5z dG9yZWQvcHJvY2Vzcy5tbAppbmRleCBiYzY4YzU0YzlhYmEuLmZjMjU1OGFj M2Q5YiAxMDA2NDQKLS0tIGEvdG9vbHMvb2NhbWwveGVuc3RvcmVkL3Byb2Nl c3MubWwKKysrIGIvdG9vbHMvb2NhbWwveGVuc3RvcmVkL3Byb2Nlc3MubWwK QEAgLTM0NSwxNSArMzQ1LDE4IEBAIGxldCBkb19pc2ludHJvZHVjZWQgY29u IF90IGRvbWFpbnMgX2NvbnMgZGF0YSA9CiAgIGluCiAgIGlmIGRvbWlkID0g RGVmaW5lLmRvbWlkX3NlbGYgfHwgRG9tYWlucy5leGlzdCBkb21haW5zIGRv bWlkIHRoZW4gIlRcMDAwIiBlbHNlICJGXDAwMCIKIAotKCogb25seSBpbiB4 ZW4gPj0gNC4yICopCi1sZXQgZG9fcmVzZXRfd2F0Y2hlcyBjb24gX3QgX2Rv bWFpbnMgY29ucyBfZGF0YSA9CitsZXQgcmVzZXRfd2F0Y2hlc19hbmRfdHJh bnNhY3Rpb25zIGNvbnMgY29uID0KICAgQ29ubmVjdGlvbnMuZGVsX3dhdGNo ZXMgY29ucyBjb247Ci0gIENvbm5lY3Rpb24uZGVsX3RyYW5zYWN0aW9ucyBj b24KKyAgQ29ubmVjdGlvbi5kZWxfdHJhbnNhY3Rpb25zIGNvbjsKKyAgSGlz dG9yeS50cmltICgpCisKK2xldCBkb19yZXNldF93YXRjaGVzIGNvbiBfdCBf ZG9tYWlucyBjb25zIF9kYXRhID0KKyAgcmVzZXRfd2F0Y2hlc19hbmRfdHJh bnNhY3Rpb25zIGNvbnMgY29uCiAKIGxldCBkb19yZWNvbm5lY3QgY29ucyBj b24gPQogICBsZXQgZG9tc3RyID0gQ29ubmVjdGlvbi5nZXRfZG9tc3RyIGNv biBpbgogICBpbmZvICIlcyByZXF1ZXN0cyBhIHJlY29ubmVjdCIgZG9tc3Ry OwotICBIaXN0b3J5LnRyaW0gKCk7CisgIHJlc2V0X3dhdGNoZXNfYW5kX3Ry YW5zYWN0aW9ucyBjb25zIGNvbjsKICAgQ29ubmVjdGlvbi5kb19yZWNvbm5l Y3QgY29uOwogICBpbmZvICIlcyByZWNvbm5lY3Rpb24gY29tcGxldGUiIGRv bXN0cgogCg== --=separator Content-Type: application/octet-stream; name="xsa512-4.17-1.patch" Content-Disposition: attachment; filename="xsa512-4.17-1.patch" Content-Transfer-Encoding: base64 RnJvbSBjYTIxZjIyOGZlODMwMmYzZmM3MjRiMmZmZjQ2YjI0OTA2ZDlkY2Q3 IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBBbmRyaWkgU3VsdGFu b3YgPGFuZHJpeS5zdWx0YW5vdkB2YXRlcy50ZWNoPgpEYXRlOiBUaHUsIDIw IEF1ZyAyMDI2IDE2OjAwOjAyICswMTAwClN1YmplY3Q6IG94ZW5zdG9yZWQ6 IEZhY3RvciBvdXQgUHJvY2Vzcy5kb19yZWNvbm5lY3QoKQoKVGhlIGxvZ2lj IGZsb3cgaGVyZSBpcyBjb21wbGljYXRlZC4gIEluIHByZXBhcmF0aW9uIHRv IGZpeCBhIGJ1ZywgZmFjdG9yIG91dApyZWNvbm5lY3RpbmcgYSB4ZW5idXMg Y29ubmVjdGlvbiwgYW5kIGZvbGQgSGlzdG9yeS5yZWNvbm5lY3QgaW50byBp dCdzIHNpbmdsZQpjYWxsZXIuCgpObyBmdW5jdGlvbmFsIGNoYW5nZS4KClRo aXMgaXMgcGFydCBvZiBYU0EtNTEyIC8gQ1ZFLTIwMjYtNzk2MDQuCgpTaWdu ZWQtb2ZmLWJ5OiBBbmRyaWkgU3VsdGFub3YgPGFuZHJpeS5zdWx0YW5vdkB2 YXRlcy50ZWNoPgpTaWduZWQtb2ZmLWJ5OiBBbmRyZXcgQ29vcGVyIDxhbmRy ZXcuY29vcGVyM0BjaXRyaXguY29tPgpSZXZpZXdlZC1ieTogQW5kcmlpIFN1 bHRhbm92IDxhbmRyaXkuc3VsdGFub3ZAdmF0ZXMudGVjaD4KCmRpZmYgLS1n aXQgYS90b29scy9vY2FtbC94ZW5zdG9yZWQvaGlzdG9yeS5tbCBiL3Rvb2xz L29jYW1sL3hlbnN0b3JlZC9oaXN0b3J5Lm1sCmluZGV4IGJhNWM5Y2I1NzFm Zi4uMDI5ODAyYmQxNTQ0IDEwMDY0NAotLS0gYS90b29scy9vY2FtbC94ZW5z dG9yZWQvaGlzdG9yeS5tbAorKysgYi90b29scy9vY2FtbC94ZW5zdG9yZWQv aGlzdG9yeS5tbApAQCAtMzksMTAgKzM5LDYgQEAgbGV0IGVuZF90cmFuc2Fj dGlvbiB0eG4gY29uIHRpZCBjb21taXQgPQogCXRyaW0gfnR4biAoKTsKIAlz dWNjZXNzCiAKLWxldCByZWNvbm5lY3QgY29uID0KLQl0cmltICgpOwotCUNv bm5lY3Rpb24uZG9fcmVjb25uZWN0IGNvbgotCiBsZXQgcHVzaCAoeDogaGlz dG9yeV9yZWNvcmQpID0KIAlsZXQgZG9tID0geC5jb24uQ29ubmVjdGlvbi5k b20gaW4KIAltYXRjaCBkb20gd2l0aApkaWZmIC0tZ2l0IGEvdG9vbHMvb2Nh bWwveGVuc3RvcmVkL3Byb2Nlc3MubWwgYi90b29scy9vY2FtbC94ZW5zdG9y ZWQvcHJvY2Vzcy5tbAppbmRleCAwMmJkMGY3ZDgwOTguLjMzMTYxZGE1ZWI4 YiAxMDA2NDQKLS0tIGEvdG9vbHMvb2NhbWwveGVuc3RvcmVkL3Byb2Nlc3Mu bWwKKysrIGIvdG9vbHMvb2NhbWwveGVuc3RvcmVkL3Byb2Nlc3MubWwKQEAg LTMzMyw2ICszMzMsMTMgQEAgbGV0IGRvX3Jlc2V0X3dhdGNoZXMgY29uIF90 IF9kb21haW5zIGNvbnMgX2RhdGEgPQogICBDb25uZWN0aW9ucy5kZWxfd2F0 Y2hlcyBjb25zIGNvbjsKICAgQ29ubmVjdGlvbi5kZWxfdHJhbnNhY3Rpb25z IGNvbgogCitsZXQgZG9fcmVjb25uZWN0IGNvbnMgY29uID0KKyAgbGV0IGRv bXN0ciA9IENvbm5lY3Rpb24uZ2V0X2RvbXN0ciBjb24gaW4KKyAgaW5mbyAi JXMgcmVxdWVzdHMgYSByZWNvbm5lY3QiIGRvbXN0cjsKKyAgSGlzdG9yeS50 cmltICgpOworICBDb25uZWN0aW9uLmRvX3JlY29ubmVjdCBjb247CisgIGlu Zm8gIiVzIHJlY29ubmVjdGlvbiBjb21wbGV0ZSIgZG9tc3RyCisKICgqIG9u bHkgaW4gPj0geGVuMy4zICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgKikKIGxldCBkb19zZXRfdGFyZ2V0IGNvbiBfdCBfZG9tYWlu cyBjb25zIGRhdGEgPQogCWlmIG5vdCAoQ29ubmVjdGlvbi5pc19kb20wIGNv bikKQEAgLTcxOCw5ICs3MjUsNyBAQCBsZXQgZG9faW5wdXQgc3RvcmUgY29u cyBkb21zIGNvbiA9CiAJCQlpZiBDb25uZWN0aW9uLmNhbl9pbnB1dCBjb24g dGhlbiBDb25uZWN0aW9uLmRvX2lucHV0IGNvbgogCQkJZWxzZSBOb25lCiAJ CXdpdGggWGVuYnVzLlhiLlJlY29ubmVjdCAtPgotCQkJaW5mbyAiJXMgcmVx dWVzdHMgYSByZWNvbm5lY3QiIChDb25uZWN0aW9uLmdldF9kb21zdHIgY29u KTsKLQkJCUhpc3RvcnkucmVjb25uZWN0IGNvbjsKLQkJCWluZm8gIiVzIHJl Y29ubmVjdGlvbiBjb21wbGV0ZSIgKENvbm5lY3Rpb24uZ2V0X2RvbXN0ciBj b24pOworCQkJZG9fcmVjb25uZWN0IGNvbnMgY29uOwogCQkJTm9uZQogCQl8 IEludmFsaWRfYXJndW1lbnQgZXhwIHwgRmFpbHVyZSBleHAgLT4KIAkJCWVy cm9yICJjYXVnaHQgZXhjZXB0aW9uICVzIiBleHA7CkBAIC03NDMsNyArNzQ4 LDcgQEAgbGV0IGRvX2lucHV0IHN0b3JlIGNvbnMgZG9tcyBjb24gPQogCQl3 cml0ZV9hY2Nlc3NfbG9nIH50eSB+dGlkIH5jb246KENvbm5lY3Rpb24uZ2V0 X2RvbXN0ciBjb24pIH5kYXRhOwogCQlDb25uZWN0aW9uLmluY3Jfb3BzIGNv bgogCi1sZXQgZG9fb3V0cHV0IF9zdG9yZSBfY29ucyBfZG9tcyBjb24gPQor bGV0IGRvX291dHB1dCBfc3RvcmUgY29ucyBfZG9tcyBjb24gPQogCUNvbm5l Y3Rpb24uc291cmNlX2ZsdXNoX3dhdGNoZXZlbnRzIGNvbjsKIAlpZiBDb25u ZWN0aW9uLmhhc19vdXRwdXQgY29uIHRoZW4gKAogCQlpZiBDb25uZWN0aW9u Lmhhc19uZXdfb3V0cHV0IGNvbiB0aGVuICgKQEAgLTc1OCw4ICs3NjMsNiBA QCBsZXQgZG9fb3V0cHV0IF9zdG9yZSBfY29ucyBfZG9tcyBjb24gPQogCQl0 cnkKIAkJCWlnbm9yZSAoQ29ubmVjdGlvbi5kb19vdXRwdXQgY29uKQogCQl3 aXRoIFhlbmJ1cy5YYi5SZWNvbm5lY3QgLT4KLQkJCWluZm8gIiVzIHJlcXVl c3RzIGEgcmVjb25uZWN0IiAoQ29ubmVjdGlvbi5nZXRfZG9tc3RyIGNvbik7 Ci0JCQlIaXN0b3J5LnJlY29ubmVjdCBjb247Ci0JCQlpbmZvICIlcyByZWNv bm5lY3Rpb24gY29tcGxldGUiIChDb25uZWN0aW9uLmdldF9kb21zdHIgY29u KQorCQkJZG9fcmVjb25uZWN0IGNvbnMgY29uOwogCSkKIAo= --=separator Content-Type: application/octet-stream; name="xsa512-4.17-2.patch" Content-Disposition: attachment; filename="xsa512-4.17-2.patch" Content-Transfer-Encoding: base64 RnJvbSA2NmIzMTA1NzA5OTZjNjliZjc5NTRhYWJhY2RkNjY3ODYzMGVmOGFj IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBBbmRyaWkgU3VsdGFu b3YgPGFuZHJpeS5zdWx0YW5vdkB2YXRlcy50ZWNoPgpEYXRlOiBUaHUsIDIw IEF1ZyAyMDI2IDE1OjAwOjAyICswMDAwClN1YmplY3Q6IG94ZW5zdG9yZWQ6 IFJlc2V0IHRoZSB3YXRjaGVzIHRyaWUgb24gZG9tYWluIHJlY29ubmVjdAoK b3hlbnN0b3JlZCBtYWludGFpbnMgdHdvIGRhdGFzdHJ1Y3R1cmVzIGFib3V0 IHdhdGNoZXM7IG9uZSBnbG9iYWwgdHJpZSwgYW5kCm9uZSBoYXNodGFibGUg dHJhY2tlZCBwZXIgZG9tYWluLiAgQm90aCBuZWVkIGtlZXBpbmcgaW4gc3lu YywgYW5kIHJpZ2h0IG5vdwp0aGUgZ2xvYmFsIHRyaWUgaXMgbm90IGVtcHRp ZWQgd2hlbiBhIHhlbmJ1cyByZWNvbm5lY3QgaXMgcmVxdWVzdGVkLgoKVGhp cyBpcyBiYXNpY2FsbHkgdGhlIHNhbWUgYnVnIGFzIFhTQS0zMzAsIGNvbW1p dCA0OTFhMDc3ZWQ0YzUKKCJ0b29scy9vY2FtbC94ZW5zdG9yZWQ6IGRlbGV0 ZSB3YXRjaCBmcm9tIHRyaWUgdG9vIHdoZW4gcmVzZXR0aW5nIHdhdGNoZXMi KSwKanVzdCB0aWNrbGVkIHZpYSBhbm90aGVyIHBhdGguCgpBcnJhbmdlIGZv ciBib3RoIFByb2Nlc3MuZG9fcmVzZXRfd2F0Y2hlcygpIGFuZCBQcm9jZXNz LmRvX3JlY29ubmVjdCgpIHRvCnNoYXJlIGEgY29tbW9uIGNvZGVwYXRoIGZv ciB0aGUgcmVzZXR0aW5nIG9mIHdhdGNoZXMgYW5kIHRyYW5zYWN0aW9ucy4K Tm90YWJseSwgdGhpcyBtZWFucyB0aGF0IHRoZSBsYXR0ZXIgbm93IGNhbGxz IENvbm5lY3Rpb25zLmRlbF93YXRjaGVzKCkgd2hpY2gKY2xlYXJzIHRoZSBn bG9iYWwgdHJpZSB0b28uCgpDb25uZWN0aW9ucy5kZWxfd2F0Y2hlcygpIGFs cmVhZHkgY2FsbHMgQ29ubmVjdGlvbi5kZWxfd2F0Y2hlcygpIHNvIHJlbW92 ZSB0aGUKcmUtY2xlYXJpbmcgb2YgdGhlIHN0YXRlIGZyb20gQ29ubmVjdGlv bi5kb19yZWNvbm5lY3QoKS4KCk1vdmUgSGlzdG9yeS50cmltKCkgaW50byBy ZXNldF93YXRjaGVzX2FuZF90cmFuc2FjdGlvbnMoKSBzbyBpdCdzIG9uIHRo ZQpjb21tb24gcGF0aCwgYW5kIHBsYWNlIGl0IGFmdGVyIHJlbW92aW5nIHRo ZSB0cmFuc2FjdGlvbnMgcmF0aGVyIHRoYW4gYmVmb3JlLgoKVGhpcyBpcyBw YXJ0IG9mIFhTQS01MTIgLyBDVkUtMjAyNi03OTYwNC4KClJlcG9ydGVkLWJ5 OiBEYXZpZCBLb3Jjenluc2tpIDxEYXZpZEBBZGFsb2dpY3MuY29tPgpGaXhl czogNjc0YWQyYmU0MDlkICgieGVuc3RvcmU6IGV4dGVuZCB0aGUgeGVuc3Rv cmUgcmluZyB3aXRoIGEgJ2Nsb3NpbmcnIHNpZ25hbCIpClNpZ25lZC1vZmYt Ynk6IEFuZHJpaSBTdWx0YW5vdiA8YW5kcml5LnN1bHRhbm92QHZhdGVzLnRl Y2g+ClNpZ25lZC1vZmYtYnk6IEFuZHJldyBDb29wZXIgPGFuZHJldy5jb29w ZXIzQGNpdHJpeC5jb20+ClJldmlld2VkLWJ5OiBBbmRyaWkgU3VsdGFub3Yg PGFuZHJpeS5zdWx0YW5vdkB2YXRlcy50ZWNoPgoKZGlmZiAtLWdpdCBhL3Rv b2xzL29jYW1sL3hlbnN0b3JlZC9jb25uZWN0aW9uLm1sIGIvdG9vbHMvb2Nh bWwveGVuc3RvcmVkL2Nvbm5lY3Rpb24ubWwKaW5kZXggNTRmN2Y3NjUxNjdi Li5hOTFjYWFiZWM2NzQgMTAwNjQ0Ci0tLSBhL3Rvb2xzL29jYW1sL3hlbnN0 b3JlZC9jb25uZWN0aW9uLm1sCisrKyBiL3Rvb2xzL29jYW1sL3hlbnN0b3Jl ZC9jb25uZWN0aW9uLm1sCkBAIC0xNDgsMTMgKzE0OCwxMSBAQCBsZXQgbWFy a19hc19iYWQgY29uID0KIGxldCBpbml0aWFsX25leHRfdGlkID0gMQogCiBs ZXQgZG9fcmVjb25uZWN0IGNvbiA9CisJKCogdHJhbnNhY3Rpb25zIGFuZCB3 YXRjaGVzIGhhbmRsZWQgYnkgY2FsbGVyICopCiAJWGVuYnVzLlhiLnJlY29u bmVjdCBjb24ueGI7CiAJKCogZG9tIGlzIHRoZSBzYW1lICopCi0JSGFzaHRi bC5jbGVhciBjb24udHJhbnNhY3Rpb25zOwogCWNvbi5uZXh0X3RpZCA8LSBp bml0aWFsX25leHRfdGlkOwotCUhhc2h0YmwuY2xlYXIgY29uLndhdGNoZXM7 CiAJKCogYW5vbmlkIGlzIHRoZSBzYW1lICopCi0JY29uLm5iX3dhdGNoZXMg PC0gMDsKIAljb24uc3RhdF9uYl9vcHMgPC0gMDsKIAkoKiBwZXJtIGlzIHRo ZSBzYW1lICopCiAJKCkKZGlmZiAtLWdpdCBhL3Rvb2xzL29jYW1sL3hlbnN0 b3JlZC9wcm9jZXNzLm1sIGIvdG9vbHMvb2NhbWwveGVuc3RvcmVkL3Byb2Nl c3MubWwKaW5kZXggMzMxNjFkYTVlYjhiLi5iMmVlNGQwYWRmMWIgMTAwNjQ0 Ci0tLSBhL3Rvb2xzL29jYW1sL3hlbnN0b3JlZC9wcm9jZXNzLm1sCisrKyBi L3Rvb2xzL29jYW1sL3hlbnN0b3JlZC9wcm9jZXNzLm1sCkBAIC0zMjgsMTUg KzMyOCwxOCBAQCBsZXQgZG9faXNpbnRyb2R1Y2VkIGNvbiBfdCBkb21haW5z IF9jb25zIGRhdGEgPQogCQlpbgogCWlmIGRvbWlkID0gRGVmaW5lLmRvbWlk X3NlbGYgfHwgRG9tYWlucy5leGlzdCBkb21haW5zIGRvbWlkIHRoZW4gIlRc MDAwIiBlbHNlICJGXDAwMCIKIAotKCogb25seSBpbiB4ZW4gPj0gNC4yICop Ci1sZXQgZG9fcmVzZXRfd2F0Y2hlcyBjb24gX3QgX2RvbWFpbnMgY29ucyBf ZGF0YSA9CitsZXQgcmVzZXRfd2F0Y2hlc19hbmRfdHJhbnNhY3Rpb25zIGNv bnMgY29uID0KICAgQ29ubmVjdGlvbnMuZGVsX3dhdGNoZXMgY29ucyBjb247 Ci0gIENvbm5lY3Rpb24uZGVsX3RyYW5zYWN0aW9ucyBjb24KKyAgQ29ubmVj dGlvbi5kZWxfdHJhbnNhY3Rpb25zIGNvbjsKKyAgSGlzdG9yeS50cmltICgp CisKK2xldCBkb19yZXNldF93YXRjaGVzIGNvbiBfdCBfZG9tYWlucyBjb25z IF9kYXRhID0KKyAgcmVzZXRfd2F0Y2hlc19hbmRfdHJhbnNhY3Rpb25zIGNv bnMgY29uCiAKIGxldCBkb19yZWNvbm5lY3QgY29ucyBjb24gPQogICBsZXQg ZG9tc3RyID0gQ29ubmVjdGlvbi5nZXRfZG9tc3RyIGNvbiBpbgogICBpbmZv ICIlcyByZXF1ZXN0cyBhIHJlY29ubmVjdCIgZG9tc3RyOwotICBIaXN0b3J5 LnRyaW0gKCk7CisgIHJlc2V0X3dhdGNoZXNfYW5kX3RyYW5zYWN0aW9ucyBj b25zIGNvbjsKICAgQ29ubmVjdGlvbi5kb19yZWNvbm5lY3QgY29uOwogICBp bmZvICIlcyByZWNvbm5lY3Rpb24gY29tcGxldGUiIGRvbXN0cgogCg== --=separator Content-Type: application/octet-stream; name="xsa512-oxenstored-1.patch" Content-Disposition: attachment; filename="xsa512-oxenstored-1.patch" Content-Transfer-Encoding: base64 RnJvbSA1NDkzMTI2OTJkZTFkMjJlNzBiZTc1YjkzMzllZjFlNTc1YmFhOTY0 IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBBbmRyaWkgU3VsdGFu b3YgPGFuZHJpeS5zdWx0YW5vdkB2YXRlcy50ZWNoPgpEYXRlOiBUaHUsIDIw IEF1ZyAyMDI2IDE2OjAwOjAyICswMTAwClN1YmplY3Q6IG94ZW5zdG9yZWQ6 IEZhY3RvciBvdXQgUHJvY2Vzcy5kb19yZWNvbm5lY3QoKQoKVGhlIGxvZ2lj IGZsb3cgaGVyZSBpcyBjb21wbGljYXRlZC4gIEluIHByZXBhcmF0aW9uIHRv IGZpeCBhIGJ1ZywgZmFjdG9yIG91dApyZWNvbm5lY3RpbmcgYSB4ZW5idXMg Y29ubmVjdGlvbiwgYW5kIGZvbGQgSGlzdG9yeS5yZWNvbm5lY3QgaW50byBp dCdzIHNpbmdsZQpjYWxsZXIuCgpObyBmdW5jdGlvbmFsIGNoYW5nZS4KClRo aXMgaXMgcGFydCBvZiBYU0EtNTEyIC8gQ1ZFLTIwMjYtNzk2MDQuCgpTaWdu ZWQtb2ZmLWJ5OiBBbmRyaWkgU3VsdGFub3YgPGFuZHJpeS5zdWx0YW5vdkB2 YXRlcy50ZWNoPgpTaWduZWQtb2ZmLWJ5OiBBbmRyZXcgQ29vcGVyIDxhbmRy ZXcuY29vcGVyM0BjaXRyaXguY29tPgpSZXZpZXdlZC1ieTogQW5kcmlpIFN1 bHRhbm92IDxhbmRyaXkuc3VsdGFub3ZAdmF0ZXMudGVjaD4KCmRpZmYgLS1n aXQgYS9veGVuc3RvcmVkL2hpc3RvcnkubWwgYi9veGVuc3RvcmVkL2hpc3Rv cnkubWwKaW5kZXggYmUxOTk0ZjE4MDIwLi40OTBkN2EwZWU2NmUgMTAwNjQ0 Ci0tLSBhL294ZW5zdG9yZWQvaGlzdG9yeS5tbAorKysgYi9veGVuc3RvcmVk L2hpc3RvcnkubWwKQEAgLTQxLDEwICs0MSw2IEBAIGxldCBlbmRfdHJhbnNh Y3Rpb24gdHhuIGNvbiB0aWQgY29tbWl0ID0KICAgbGV0IHN1Y2Nlc3MgPSBD b25uZWN0aW9uLmVuZF90cmFuc2FjdGlvbiBjb24gdGlkIGNvbW1pdCBpbgog ICB0cmltIH50eG4gKCkgOyBzdWNjZXNzCiAKLWxldCByZWNvbm5lY3QgY29u ID0KLSAgdHJpbSAoKSA7Ci0gIENvbm5lY3Rpb24uZG9fcmVjb25uZWN0IGNv bgotCiBsZXQgcHVzaCAoeCA6IGhpc3RvcnlfcmVjb3JkKSA9CiAgIGxldCBk b20gPSB4LmNvbi5Db25uZWN0aW9uLmRvbSBpbgogICBtYXRjaCBkb20gd2l0 aApkaWZmIC0tZ2l0IGEvb3hlbnN0b3JlZC9wcm9jZXNzLm1sIGIvb3hlbnN0 b3JlZC9wcm9jZXNzLm1sCmluZGV4IDQ3N2I0ZTQxYjNiZS4uNTIzYWQ0ZmFh ZmQ4IDEwMDY0NAotLS0gYS9veGVuc3RvcmVkL3Byb2Nlc3MubWwKKysrIGIv b3hlbnN0b3JlZC9wcm9jZXNzLm1sCkBAIC00NzcsNiArNDc3LDEzIEBAIGxl dCBkb19yZXNldF93YXRjaGVzIGNvbiBfdCBfZG9tYWlucyBjb25zIF9kYXRh ID0KICAgQ29ubmVjdGlvbnMuZGVsX3dhdGNoZXMgY29ucyBjb24gOwogICBD b25uZWN0aW9uLmRlbF90cmFuc2FjdGlvbnMgY29uCiAKK2xldCBkb19yZWNv bm5lY3QgY29ucyBjb24gPQorICBsZXQgZG9tc3RyID0gQ29ubmVjdGlvbi5n ZXRfZG9tc3RyIGNvbiBpbgorICBpbmZvICIlcyByZXF1ZXN0cyBhIHJlY29u bmVjdCIgZG9tc3RyIDsKKyAgSGlzdG9yeS50cmltICgpIDsKKyAgQ29ubmVj dGlvbi5kb19yZWNvbm5lY3QgY29uIDsKKyAgaW5mbyAiJXMgcmVjb25uZWN0 aW9uIGNvbXBsZXRlIiBkb21zdHIKKwogKCogb25seSBpbiA+PSB4ZW4zLjMg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAqKQogbGV0 IGRvX3NldF90YXJnZXQgY29uIF90IF9kb21haW5zIGNvbnMgZGF0YSA9CiAg IGlmIG5vdCAoQ29ubmVjdGlvbi5pc19kb20wIGNvbikgdGhlbgpAQCAtOTc2 LDEwICs5ODMsNyBAQCBsZXQgZG9faW5wdXQgc3RvcmUgY29ucyBkb21zIGNv biA9CiAgICAgICAgIE5vbmUKICAgICB3aXRoCiAgICAgfCBYZW5idXMuWGIu UmVjb25uZWN0IC0+Ci0gICAgICAgIGluZm8gIiVzIHJlcXVlc3RzIGEgcmVj b25uZWN0IiAoQ29ubmVjdGlvbi5nZXRfZG9tc3RyIGNvbikgOwotICAgICAg ICBIaXN0b3J5LnJlY29ubmVjdCBjb24gOwotICAgICAgICBpbmZvICIlcyBy ZWNvbm5lY3Rpb24gY29tcGxldGUiIChDb25uZWN0aW9uLmdldF9kb21zdHIg Y29uKSA7Ci0gICAgICAgIE5vbmUKKyAgICAgICAgZG9fcmVjb25uZWN0IGNv bnMgY29uIDsgTm9uZQogICAgIHwgSW52YWxpZF9hcmd1bWVudCBleHAgfCBG YWlsdXJlIGV4cCAtPgogICAgICAgICBlcnJvciAiY2F1Z2h0IGV4Y2VwdGlv biAlcyIgZXhwIDsKICAgICAgICAgZXJyb3IgImdvdCBhIGJhZCBjbGllbnQg JXMiIChzcHJpbnRmICIlLThzIiAoQ29ubmVjdGlvbi5nZXRfZG9tc3RyIGNv bikpIDsKQEAgLTEwMDIsNyArMTAwNiw3IEBAIGxldCBkb19pbnB1dCBzdG9y ZSBjb25zIGRvbXMgY29uID0KICAgICAgIHdyaXRlX2FjY2Vzc19sb2cgfnR5 IH50aWQgfmNvbjooQ29ubmVjdGlvbi5nZXRfZG9tc3RyIGNvbikgfmRhdGEg OwogICAgICAgQ29ubmVjdGlvbi5pbmNyX29wcyBjb24KIAotbGV0IGRvX291 dHB1dCBfc3RvcmUgX2NvbnMgX2RvbXMgY29uID0KK2xldCBkb19vdXRwdXQg X3N0b3JlIGNvbnMgX2RvbXMgY29uID0KICAgQ29ubmVjdGlvbi5zb3VyY2Vf Zmx1c2hfd2F0Y2hldmVudHMgY29uIDsKICAgaWYgQ29ubmVjdGlvbi5oYXNf b3V0cHV0IGNvbiB0aGVuICgKICAgICAoIGlmIENvbm5lY3Rpb24uaGFzX25l d19vdXRwdXQgY29uIHRoZW4KQEAgLTEwMTUsOCArMTAxOSw1IEBAIGxldCBk b19vdXRwdXQgX3N0b3JlIF9jb25zIF9kb21zIGNvbiA9CiAgICAgICAgIHdy aXRlX2Fuc3dlcl9sb2cgfnR5IH50aWQgfmNvbjooQ29ubmVjdGlvbi5nZXRf ZG9tc3RyIGNvbikgfmRhdGEKICAgICApIDsKICAgICB0cnkgaWdub3JlIChD b25uZWN0aW9uLmRvX291dHB1dCBjb24pCi0gICAgd2l0aCBYZW5idXMuWGIu UmVjb25uZWN0IC0+Ci0gICAgICBpbmZvICIlcyByZXF1ZXN0cyBhIHJlY29u bmVjdCIgKENvbm5lY3Rpb24uZ2V0X2RvbXN0ciBjb24pIDsKLSAgICAgIEhp c3RvcnkucmVjb25uZWN0IGNvbiA7Ci0gICAgICBpbmZvICIlcyByZWNvbm5l Y3Rpb24gY29tcGxldGUiIChDb25uZWN0aW9uLmdldF9kb21zdHIgY29uKQor ICAgIHdpdGggWGVuYnVzLlhiLlJlY29ubmVjdCAtPiBkb19yZWNvbm5lY3Qg Y29ucyBjb24KICAgKQo= --=separator Content-Type: application/octet-stream; name="xsa512-oxenstored-2.patch" Content-Disposition: attachment; filename="xsa512-oxenstored-2.patch" Content-Transfer-Encoding: base64 RnJvbSBkYTQ3YjU5Njk1NzZkNjBlODg2NGI1ZWNjNGZkMGRiNjdlN2U0NjAx IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBBbmRyaWkgU3VsdGFu b3YgPGFuZHJpeS5zdWx0YW5vdkB2YXRlcy50ZWNoPgpEYXRlOiBUaHUsIDIw IEF1ZyAyMDI2IDE1OjAwOjAyICswMDAwClN1YmplY3Q6IG94ZW5zdG9yZWQ6 IFJlc2V0IHRoZSB3YXRjaGVzIHRyaWUgb24gZG9tYWluIHJlY29ubmVjdAoK b3hlbnN0b3JlZCBtYWludGFpbnMgdHdvIGRhdGFzdHJ1Y3R1cmVzIGFib3V0 IHdhdGNoZXM7IG9uZSBnbG9iYWwgdHJpZSwgYW5kCm9uZSBoYXNodGFibGUg dHJhY2tlZCBwZXIgZG9tYWluLiAgQm90aCBuZWVkIGtlZXBpbmcgaW4gc3lu YywgYW5kIHJpZ2h0IG5vdwp0aGUgZ2xvYmFsIHRyaWUgaXMgbm90IGVtcHRp ZWQgd2hlbiBhIHhlbmJ1cyByZWNvbm5lY3QgaXMgcmVxdWVzdGVkLgoKVGhp cyBpcyBiYXNpY2FsbHkgdGhlIHNhbWUgYnVnIGFzIFhTQS0zMzAsIGNvbW1p dCA5MTAzODhiYjRmMzcKKCJ0b29scy9vY2FtbC94ZW5zdG9yZWQ6IGRlbGV0 ZSB3YXRjaCBmcm9tIHRyaWUgdG9vIHdoZW4gcmVzZXR0aW5nIHdhdGNoZXMi KSwKanVzdCB0aWNrbGVkIHZpYSBhbm90aGVyIHBhdGguCgpBcnJhbmdlIGZv ciBib3RoIFByb2Nlc3MuZG9fcmVzZXRfd2F0Y2hlcygpIGFuZCBQcm9jZXNz LmRvX3JlY29ubmVjdCgpIHRvCnNoYXJlIGEgY29tbW9uIGNvZGVwYXRoIGZv ciB0aGUgcmVzZXR0aW5nIG9mIHdhdGNoZXMgYW5kIHRyYW5zYWN0aW9ucy4K Tm90YWJseSwgdGhpcyBtZWFucyB0aGF0IHRoZSBsYXR0ZXIgbm93IGNhbGxz IENvbm5lY3Rpb25zLmRlbF93YXRjaGVzKCkgd2hpY2gKY2xlYXJzIHRoZSBn bG9iYWwgdHJpZSB0b28uCgpDb25uZWN0aW9ucy5kZWxfd2F0Y2hlcygpIGFs cmVhZHkgY2FsbHMgQ29ubmVjdGlvbi5kZWxfd2F0Y2hlcygpIHNvIHJlbW92 ZSB0aGUKcmUtY2xlYXJpbmcgb2YgdGhlIHN0YXRlIGZyb20gQ29ubmVjdGlv bi5kb19yZWNvbm5lY3QoKS4KCk1vdmUgSGlzdG9yeS50cmltKCkgaW50byBy ZXNldF93YXRjaGVzX2FuZF90cmFuc2FjdGlvbnMoKSBzbyBpdCdzIG9uIHRo ZQpjb21tb24gcGF0aCwgYW5kIHBsYWNlIGl0IGFmdGVyIHJlbW92aW5nIHRo ZSB0cmFuc2FjdGlvbnMgcmF0aGVyIHRoYW4gYmVmb3JlLgoKVGhpcyBpcyBw YXJ0IG9mIFhTQS01MTIgLyBDVkUtMjAyNi03OTYwNC4KClJlcG9ydGVkLWJ5 OiBEYXZpZCBLb3Jjenluc2tpIDxEYXZpZEBBZGFsb2dpY3MuY29tPgpGaXhl czogNjc0YWQyYmU0MDlkICgieGVuc3RvcmU6IGV4dGVuZCB0aGUgeGVuc3Rv cmUgcmluZyB3aXRoIGEgJ2Nsb3NpbmcnIHNpZ25hbCIpClNpZ25lZC1vZmYt Ynk6IEFuZHJpaSBTdWx0YW5vdiA8YW5kcml5LnN1bHRhbm92QHZhdGVzLnRl Y2g+ClNpZ25lZC1vZmYtYnk6IEFuZHJldyBDb29wZXIgPGFuZHJldy5jb29w ZXIzQGNpdHJpeC5jb20+ClJldmlld2VkLWJ5OiBBbmRyaWkgU3VsdGFub3Yg PGFuZHJpeS5zdWx0YW5vdkB2YXRlcy50ZWNoPgoKZGlmZiAtLWdpdCBhL294 ZW5zdG9yZWQvY29ubmVjdGlvbi5tbCBiL294ZW5zdG9yZWQvY29ubmVjdGlv bi5tbAppbmRleCAyOWQxOTExZjMxNzkuLjU4YjkwYThmYWE1YyAxMDA2NDQK LS0tIGEvb3hlbnN0b3JlZC9jb25uZWN0aW9uLm1sCisrKyBiL294ZW5zdG9y ZWQvY29ubmVjdGlvbi5tbApAQCAtMTkzLDEzICsxOTMsMTEgQEAgbGV0IG1h cmtfYXNfYmFkIGNvbiA9CiBsZXQgaW5pdGlhbF9uZXh0X3RpZCA9IDEKIAog bGV0IGRvX3JlY29ubmVjdCBjb24gPQorICAoKiB0cmFuc2FjdGlvbnMgYW5k IHdhdGNoZXMgaGFuZGxlZCBieSBjYWxsZXIgKikKICAgWGVuYnVzLlhiLnJl Y29ubmVjdCBjb24ueGIgOwogICAoKiBkb20gaXMgdGhlIHNhbWUgKikKLSAg SGFzaHRibC5jbGVhciBjb24udHJhbnNhY3Rpb25zIDsKICAgY29uLm5leHRf dGlkIDwtIGluaXRpYWxfbmV4dF90aWQgOwotICBIYXNodGJsLmNsZWFyIGNv bi53YXRjaGVzIDsKICAgKCogYW5vbmlkIGlzIHRoZSBzYW1lICopCi0gIGNv bi5uYl93YXRjaGVzIDwtIDAgOwogICBjb24uc3RhdF9uYl9vcHMgPC0gMCA7 CiAgICgqIHBlcm0gaXMgdGhlIHNhbWUgKikKICAgKCkKZGlmZiAtLWdpdCBh L294ZW5zdG9yZWQvcHJvY2Vzcy5tbCBiL294ZW5zdG9yZWQvcHJvY2Vzcy5t bAppbmRleCA1MjNhZDRmYWFmZDguLjAzOGNkYjcyYmUwYiAxMDA2NDQKLS0t IGEvb3hlbnN0b3JlZC9wcm9jZXNzLm1sCisrKyBiL294ZW5zdG9yZWQvcHJv Y2Vzcy5tbApAQCAtNDcyLDE1ICs0NzIsMTggQEAgbGV0IGRvX2lzaW50cm9k dWNlZCBjb24gX3QgZG9tYWlucyBfY29ucyBkYXRhID0KICAgZWxzZQogICAg ICJGXDAwMCIKIAotKCogb25seSBpbiB4ZW4gPj0gNC4yICopCi1sZXQgZG9f cmVzZXRfd2F0Y2hlcyBjb24gX3QgX2RvbWFpbnMgY29ucyBfZGF0YSA9Cits ZXQgcmVzZXRfd2F0Y2hlc19hbmRfdHJhbnNhY3Rpb25zIGNvbnMgY29uID0K ICAgQ29ubmVjdGlvbnMuZGVsX3dhdGNoZXMgY29ucyBjb24gOwotICBDb25u ZWN0aW9uLmRlbF90cmFuc2FjdGlvbnMgY29uCisgIENvbm5lY3Rpb24uZGVs X3RyYW5zYWN0aW9ucyBjb24gOworICBIaXN0b3J5LnRyaW0gKCkKKworbGV0 IGRvX3Jlc2V0X3dhdGNoZXMgY29uIF90IF9kb21haW5zIGNvbnMgX2RhdGEg PQorICByZXNldF93YXRjaGVzX2FuZF90cmFuc2FjdGlvbnMgY29ucyBjb24K IAogbGV0IGRvX3JlY29ubmVjdCBjb25zIGNvbiA9CiAgIGxldCBkb21zdHIg PSBDb25uZWN0aW9uLmdldF9kb21zdHIgY29uIGluCiAgIGluZm8gIiVzIHJl cXVlc3RzIGEgcmVjb25uZWN0IiBkb21zdHIgOwotICBIaXN0b3J5LnRyaW0g KCkgOworICByZXNldF93YXRjaGVzX2FuZF90cmFuc2FjdGlvbnMgY29ucyBj b24gOwogICBDb25uZWN0aW9uLmRvX3JlY29ubmVjdCBjb24gOwogICBpbmZv ICIlcyByZWNvbm5lY3Rpb24gY29tcGxldGUiIGRvbXN0cgogCg== --=separator--