
PROBLEM: (86871, 89903) (PATCH ID: OSF520-187)
********
Problem 1: Under rare circumstances, a remote host can submit incoming
print jobs in an erroneous manner that involves bad RFC 1179 protocol messages.
If the remote sender continuously resubmits the job, an event storm may
result that fills up the printing log file.
Problem 2:  In a TruCluster, lpd maintains a connection to the event manager.
If the event manager is stopped (with /usr/sbin/evmstop) and restarted (with
/usr/sbin/evmstart), lpd loses its connection to the local socket (/dev/printer)
used by the local printing commands (lpr and lprm) and it loses its connection
to the remote printing socket (515).  This will cause local use of lpr to
hang and will block incoming remote jobs.

Problem 3:  The procedure the parent lpd used to reconnect to the event manager 
after it was disabled (wtih /usr/sbin/evmstop) was flawed, and under certain
circumstances, such as lpd being kept busy with newly submitted jobs after
the event manager was restarted, lpd would be too busy to reconnect to
the event manager.  The reconnect retry interval was also too long (60 seconds).


PROBLEM: (74585, BCSM41PFG, BCSM9074, 89294,
          81376, HPAQ70PN3) (PATCH ID: OSF520-182)
********
This patch corrects two problems with csh(1):
1. The first problem with csh(1) is if a non-root user performed an ls(1) 
   with wild card characters on a directory having permission 700, then 
   it would display the invalid error message, "Glob aborted."  Now it 
   displays the correct error message of "Permission denied".

2. The second problem with csh(1) is when nonomatch is set and a user performs 
   an ls(1) with one of the patterns as ?, it would not list any matched
   patterns but return "ls: ? not found".  Now it returns that message as well
   as any matched patterns.


PROBLEM: (88474, 89240, HPAQ610G9) (PATCH ID: OSF520-364)
********
This patch fixes a problem with the c shell (csh) so that it now correctly
recognizes the backslash ('\') meta character.


PROBLEM: (SSRT2260) (PATCH ID: OSF520-634)
********
A potential security vulnerability has been discovered,
where under certain circumstances, system integrity
may be compromised when a buffer overflow occurs in the 
lpq, lpr and lprm commnads. Buffer overflows are sometimes
exploited in an attempt to subvert the function of a 
privileged program and possibly execute commnads and the 
elevated privileges if the program file has the setuid
privilege.
HP has corrected this potential vulnerability.


PROBLEM: (94442) (PATCH ID: OSF520-639)
********
A potential security vulnerability has been discovered, where under
certain circumstances, system integrity may be compromised when a
buffer overflow occurs in the dxterm utility.  Buffer overflows are
sometimes exploited in an attempt to subvert the function of a
privileged program and possibly execute commands at the elevated
privileges if the program file has the setuid privilege.
HP has corrected this potential vulnerability.


PROBLEM: (BCGM6022J, BCGM704G5, BCGM704G8, 93947) (PATCH ID: OSF520-665)
********
This patch corrects the problem where telnetd leaves an extra udp port open.


PROBLEM: (94880) (PATCH ID: OSF520-757)
********
This fix corrects an lpc regression in the lpc buffer overflow fix.


PROBLEM: (94247) (PATCH ID: OSF520-622)
********
A potential security vulnerability has been discovered,
where under certain circumstances, system integrity may be
compromised when a buffer overflow occurs in the csh
utility.  Buffer overflows are sometimes
exploited in an attempt to subvert the function of a
privileged program and possibly execute commands at the
elevated privileges if the program file has the setuid
privilege.
HP has corrected this potential vulnerability.


PROBLEM: (92818) (PATCH ID: OSF520-607)
********
A potential security vulnerability has been discovered, where under
certain circumstances, system integrity may be compromised. This may
be in the form of improper file access.  HP has corrected this
potential vulnerability.


PROBLEM: (88424, 88447, 88485, 88536,
          SSRT1-40U, SSRT1-41U, SSRT1-42U, SSRT1-45U, SSRT1-48U) (PATCH ID: OSF520-544)
********
A potential security vulnerability has been discovered, where under
certain circumstances, system integrity may be compromised. This may
be in the form of improper file access.  Compaq has corrected this
potential vulnerability.


PROBLEM: (94599) (PATCH ID: OSF520-676)
********
A potential security vulnerability has been discovered, where under
certain circumstances, system integrity may be compromised when a
buffer overflow occurs in the telnetd daemon.  Buffer overflows are
sometimes exploited in an attempt to subvert the function of a
privileged program and possibly execute commands at the elevated
privileges if the program file has the setuid privilege.
HP has corrected this potential vulnerability.


PROBLEM: (TKT361836, TKT376858) (PATCH ID: OSF520-621)
********
This patch corrects the problem where a user may experience a core dump, 
when using csh from the Japanese locale.


PROBLEM: (95204) (PATCH ID: OSF520-829)
********
This patch fixes the problem with csh redirection 
while redirecting standard input and standard output
of a command to a file exist in home directory using 
tilde (~) operation.


PROBLEM: (117-1-18504) (PATCH ID: OSF520-549)
********
This patch fixes a number of problems in the lpd (line printer
daemon) subsystem.


PROBLEM: (117-1-21461/QAR) (PATCH ID: OSF520-815)
********
Prior to this fix, lpd treated entries in /etc/hosts.lpd in a
case sensitive manner (meaning that "node.domain" was treated
differently than "Node.Domain").  This fix causes lpd to treat
entries in /etc/hosts.lpd in a case insensitive manner (meaning
that now entries of the form "node.domain" are viewed as identical
to mixed case entries of the form "Node.Domain").


PROBLEM: (96049, NO_G06678) (PATCH ID: OSF520-1117)
********
The dbx debugger reports a segmentation fault for some Fortran programs when 
the user issues any command that references a symbol name.  For example, for 
the Fortran program qtest, dbx reports the following fatal error:
    % dbx qtest
    dbx version 5.1
    Type 'help' for help.
    
    qtest:  57  liw = nsize + 1
    (dbx) stop in gtequal_adj_neighbor
    sendsig: can't grow stack, pid 19345, proc dbx, sig 11
    Segmentation fault (core dumped)

This problem has been fixed.



