[ubuntu/bionic-proposed] openssl 1.0.2g-1ubuntu14 (Accepted)

[Marc Deslauriers]

openssl (1.0.2g-1ubuntu14) bionic; urgency=medium

  * SECURITY UPDATE: Malformed X.509 IPAddressFamily could cause OOB read
    - debian/patches/CVE-2017-3735.patch: avoid out-of-bounds read in
      crypto/x509v3/v3_addr.c.
    - CVE-2017-3735
  * SECURITY UPDATE: bn_sqrx8x_internal carry bug on x86_64
    - debian/patches/CVE-2017-3736.patch: fix carry bug in
      bn_sqrx8x_internal in crypto/bn/asm/x86_64-mont5.pl.
    - CVE-2017-3736
  * debian/patches/fix_armhf_ftbfs.patch: fix build with gcc-7.2 on armhf.
    (LP: #1729850)

Date: Mon, 06 Nov 2017 07:56:00 -0500
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu14
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 06 Nov 2017 07:56:00 -0500
Source: openssl
Binary: openssl libssl1.0.0 libcrypto1.0.0-udeb libssl1.0.0-udeb libssl-dev libssl1.0-dev libssl-doc libssl1.0.0-dbg
Architecture: source
Version: 1.0.2g-1ubuntu14
Distribution: bionic
Urgency: medium
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Description:
 libcrypto1.0.0-udeb - Secure Sockets Layer toolkit - libcrypto udeb (udeb)
 libssl-dev - Secure Sockets Layer toolkit - development files
 libssl-doc - Secure Sockets Layer toolkit - development documentation
 libssl1.0-dev - Secure Sockets Layer toolkit - metapackage
 libssl1.0.0 - Secure Sockets Layer toolkit - shared libraries
 libssl1.0.0-dbg - Secure Sockets Layer toolkit - debug information
 libssl1.0.0-udeb - ssl shared library - udeb (udeb)
 openssl    - Secure Sockets Layer toolkit - cryptographic utility
Launchpad-Bugs-Fixed: 1729850
Changes:
 openssl (1.0.2g-1ubuntu14) bionic; urgency=medium
 .
   * SECURITY UPDATE: Malformed X.509 IPAddressFamily could cause OOB read
     - debian/patches/CVE-2017-3735.patch: avoid out-of-bounds read in
       crypto/x509v3/v3_addr.c.
     - CVE-2017-3735
   * SECURITY UPDATE: bn_sqrx8x_internal carry bug on x86_64
     - debian/patches/CVE-2017-3736.patch: fix carry bug in
       bn_sqrx8x_internal in crypto/bn/asm/x86_64-mont5.pl.
     - CVE-2017-3736
   * debian/patches/fix_armhf_ftbfs.patch: fix build with gcc-7.2 on armhf.
     (LP: #1729850)
Checksums-Sha1:
 bad79b6b5fff4e5c313600204118ac370589298b 2492 openssl_1.0.2g-1ubuntu14.dsc
 f0d011b6bfa8216d34aeee2a36c70a88c819e438 112388 openssl_1.0.2g-1ubuntu14.debian.tar.xz
 da26dc304f8d27a27490ffee57e8f7474a47e49f 5728 openssl_1.0.2g-1ubuntu14_source.buildinfo
Checksums-Sha256:
 d2cd6c1ddfbba9e75c6fc23e659ca51c5c0c2f3f6350fd2a373b601b8ec5b07d 2492 openssl_1.0.2g-1ubuntu14.dsc
 cbd6463bf3178a94c78e375e87dd7d79bb6cc24be0e6cedcbe5651a687f2d486 112388 openssl_1.0.2g-1ubuntu14.debian.tar.xz
 848c4743f2f5b7547110bccdb422bd9f9b5f81bf1ed5c1506f8755c2520d37b3 5728 openssl_1.0.2g-1ubuntu14_source.buildinfo
Files:
 47f846d27bea3d9aa992649128db822c 2492 utils optional openssl_1.0.2g-1ubuntu14.dsc
 3de3eaf6c9e2f04cac9fbad1ff73739c 112388 utils optional openssl_1.0.2g-1ubuntu14.debian.tar.xz
 8acde8bce7381117d7f1da263e980d01 5728 utils optional openssl_1.0.2g-1ubuntu14_source.buildinfo
Original-Maintainer: Debian OpenSSL Team <pkg-openssl-devel at lists.alioth.debian.org>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJaAHFEAAoJEGVp2FWnRL6Tc/4QALzqXmIFqWT14d2ehttpBnIR
zMGvxiwJpx/hB5e0Dqygrmc+RyEVXQ5+Ly02ZPSal+56hntLHwgfHVvdPOXgG/I6
AwAAEMA646m1K+ORPsVcvwpBDabW238Mj4z8LNpSYi9kOxnhrFpay8weDhfUKwiv
zO7kKwCRIJ0BZ3WAOMXurY1vK4FGAMXoATEK6AXxB35JMKBp6CyUQnM/VoL5Z8YF
jTs8lZ6sxUtCpKoeYt7KqWRbTP8ClKeGNvVULtDAYyVv3+9isDBzsEJ6Wa3q+xnD
wCjtyfODvfRnglc25pKpxavZZNxXZfxrsm/8ZqOKjN3r/DdLWD+efDhxPz39fuoU
zz7ONDzRpvRkIIjbATIUVjk2DD4M0aXwnZ2I8nJz5nCHrlCqo7nuB3tMYmx6h1aE
yYFEkLfyt9JXnBCQ+1fASFM58DQyN/4dcvPHkZ7e2DJshc+6NaGw1Cnpsy1BQbYM
dwPWaRs4d4/OzaPiaVK8H5c+XXQwu3DH5v4w6HUrTLUgSA2VDj334wNCi1RNpnuy
peWz/aP+92YkfWSBefTn/m0TzhUCteWGVGMoytgCJSjRBKUKu/HImECMV0P/ZFn0
Gh9N8O46IsaMXHLXVzQecQQ964orJhH/f3hHLlIplj5sqlXKMs5pe5nOy0JhopOY
HDzxCrPA3oC/0ZpB4jbE
=3auy
-----END PGP SIGNATURE-----