Several patches available

+ httpd(8) 's mod_include module fails to properly validate the length of 
user supplied tag strings prior to copying them to a local buffer, causing 
a buffer overflow. This would require enabling the XBitHack directive or server-side includes 
and making use of a malicious document.
3.5 patch:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/026_httpd3.patch
3.6 patch:  
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/009_httpd.patch

+ A bug in the tcp(4) stack allows an invalid argument to be used in 
calculating the TCP retransmit timeout. By sending packets with specific 
values in the TCP timestamp option, an attacker can cause a system panic.
3.5 patch:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/027_rtt.patch
3.6 patch:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/010_rtt.patch

+ More stringent checking should be done in the copy(9) functions to 
prevent their misuse.  i386 and amd64 only.
3.6 patches:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/i386/011_locore.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/amd64/012_copy.patch
the same patches can be used for 3.5.

+ Bugs in the tcp(4) stack can lead to memory exhaustion or processing of 
TCP segments with invalid SACK options and cause a system crash.
3.5 patch:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/030_sack.patch
3.6 patch:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/013_sack.patch

+ Due to buffer overflows in telnet(1), a malicious server or 
man-in-the-middle attack could allow execution of arbitrary code with the 
privileges of the user invoking telnet(1). Noone should use telnet 
anymore. Please use ssh(1).
3.5 patch:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/031_telnet.patch
3.6 patch:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/014_telnet.patch

+ Handle an edge condition in tcp(4) timestamps.
3.5 patch:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/032_tcp2.patch
3.6 patch:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/015_tcp.patch



-- 
all we're waiting for is for something worth waiting for