[ubuntu/lucid-security] openssl_0.9.8k-7ubuntu8.8_amd64_translations.tar.gz, openssl_0.9.8k-7ubuntu8.8_ia64_translations.tar.gz, openssl_0.9.8k-7ubuntu8.8_i386_translations.tar.gz, openssl_0.9.8k-7ubuntu8.8_armel_translations.tar.gz, openssl, openssl_0.9.8k-7ubuntu8.8_powerpc_translations.tar.gz, openssl_0.9.8k-7ubuntu8.8_sparc_translations.tar.gz 0.9.8k-7ubuntu8.8 (Accepted)

[Steve Beattie]

openssl (0.9.8k-7ubuntu8.8) lucid-security; urgency=low

  * SECURITY UPDATE: ECDSA private key timing attack
    - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
      length
    - CVE-2011-1945
  * SECURITY UPDATE: ECDH ciphersuite denial of service
    - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
      safety
    - CVE-2011-3210
  * SECURITY UPDATE: DTLS plaintext recovery attack
    - debian/patches/CVE-2011-4108.patch: perform all computations
      before discarding messages
    - CVE-2011-4108
  * SECURITY UPDATE: policy check double free vulnerability
    - debian/patches/CVE-2011-4019.patch: only free domain policyin
      one location
    - CVE-2011-4019
  * SECURITY UPDATE: SSL 3.0 block padding exposure
    - debian/patches/CVE-2011-4576.patch: clear bytes used for block
      padding of SSL 3.0 records.
    - CVE-2011-4576
  * SECURITY UPDATE: malformed RFC 3779 data denial of service attack
    - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
      data from triggering an assertion failure
    - CVE-2011-4577
  * SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
    - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
      restart for SSL/TLS.
    - CVE-2011-4619
  * SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
    - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
    - CVE-2012-0050
  * debian/patches/openssl-fix_ECDSA_tests.patch: fix ECDSA tests
  * debian/libssl0.9.8.postinst: Only issue the reboot notification for
    servers by testing that the X server is not running (LP: #244250)

Date: Tue, 31 Jan 2012 01:41:34 -0800
Changed-By: Steve Beattie <sbeattie at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/lucid/+source/openssl/0.9.8k-7ubuntu8.8
-------------- next part --------------
Format: 1.8
Date: Tue, 31 Jan 2012 01:41:34 -0800
Source: openssl
Binary: openssl openssl-doc libssl0.9.8 libcrypto0.9.8-udeb libssl0.9.8-udeb libssl-dev libssl0.9.8-dbg
Architecture: source
Version: 0.9.8k-7ubuntu8.8
Distribution: lucid-security
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Steve Beattie <sbeattie at ubuntu.com>
Description: 
 libcrypto0.9.8-udeb - crypto shared library - udeb (udeb)
 libssl-dev - SSL development libraries, header files and documentation
 libssl0.9.8 - SSL shared libraries
 libssl0.9.8-dbg - Symbol tables for libssl and libcrypto
 libssl0.9.8-udeb - ssl shared library - udeb (udeb)
 openssl    - Secure Socket Layer (SSL) binary and related cryptographic tools
 openssl-doc - Secure Socket Layer (SSL) documentation
Launchpad-Bugs-Fixed: 244250
Changes: 
 openssl (0.9.8k-7ubuntu8.8) lucid-security; urgency=low
 .
   * SECURITY UPDATE: ECDSA private key timing attack
     - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
       length
     - CVE-2011-1945
   * SECURITY UPDATE: ECDH ciphersuite denial of service
     - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
       safety
     - CVE-2011-3210
   * SECURITY UPDATE: DTLS plaintext recovery attack
     - debian/patches/CVE-2011-4108.patch: perform all computations
       before discarding messages
     - CVE-2011-4108
   * SECURITY UPDATE: policy check double free vulnerability
     - debian/patches/CVE-2011-4019.patch: only free domain policyin
       one location
     - CVE-2011-4019
   * SECURITY UPDATE: SSL 3.0 block padding exposure
     - debian/patches/CVE-2011-4576.patch: clear bytes used for block
       padding of SSL 3.0 records.
     - CVE-2011-4576
   * SECURITY UPDATE: malformed RFC 3779 data denial of service attack
     - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
       data from triggering an assertion failure
     - CVE-2011-4577
   * SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
     - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
       restart for SSL/TLS.
     - CVE-2011-4619
   * SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
     - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
     - CVE-2012-0050
   * debian/patches/openssl-fix_ECDSA_tests.patch: fix ECDSA tests
   * debian/libssl0.9.8.postinst: Only issue the reboot notification for
     servers by testing that the X server is not running (LP: #244250)
Checksums-Sha1: 
 458b1a3bbd610d75f927e6927f3c691743aa149d 2097 openssl_0.9.8k-7ubuntu8.8.dsc
 c2ed1e91d5fe68524d35dd26addff3bc7f1940fc 122447 openssl_0.9.8k-7ubuntu8.8.diff.gz
Checksums-Sha256: 
 67e7ad9f98c5300bef0941f92823e5a8d81597ad556df1860285c8f50702ca6d 2097 openssl_0.9.8k-7ubuntu8.8.dsc
 86c5a07f999898a0fd87eed5f4d655a85de09dcd4d7d5c2d4ca27194668ede68 122447 openssl_0.9.8k-7ubuntu8.8.diff.gz
Files: 
 1b5686eed1f8f266c076c4d253676624 2097 utils optional openssl_0.9.8k-7ubuntu8.8.dsc
 84ce65610995b1a06c37867a7c3919e2 122447 utils optional openssl_0.9.8k-7ubuntu8.8.diff.gz
Original-Maintainer: Debian OpenSSL Team <pkg-openssl-devel at lists.alioth.debian.org>