[ubuntu/natty-security] openssl_0.9.8o-5ubuntu1.2_amd64_translations.tar.gz, openssl_0.9.8o-5ubuntu1.2_powerpc_translations.tar.gz, openssl_0.9.8o-5ubuntu1.2_i386_translations.tar.gz, openssl, openssl_0.9.8o-5ubuntu1.2_armel_translations.tar.gz 0.9.8o-5ubuntu1.2 (Accepted)
Steve Beattie
sbeattie at ubuntu.com
Thu Feb 9 21:35:42 UTC 2012
openssl (0.9.8o-5ubuntu1.2) natty-security; urgency=low
* SECURITY UPDATE: ECDSA private key timing attack
- debian/patches/CVE-2011-1945.patch: compute with fixed scalar
length
- CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
- debian/patches/CVE-2011-3210.patch: fix memory usage for thread
safety
- CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
- debian/patches/CVE-2011-4108.patch: perform all computations
before discarding messages
- CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
- debian/patches/CVE-2011-4019.patch: only free domain policyin
one location
- CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
- debian/patches/CVE-2011-4576.patch: clear bytes used for block
padding of SSL 3.0 records.
- CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
- debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
data from triggering an assertion failure
- CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
- debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
restart for SSL/TLS.
- CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
- debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
- CVE-2012-0050
* debian/libssl0.9.8.postinst: Only issue the reboot notification for
servers by testing that the X server is not running (LP: #244250)
Date: Tue, 31 Jan 2012 01:27:53 -0800
Changed-By: Steve Beattie <sbeattie at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/natty/+source/openssl/0.9.8o-5ubuntu1.2
-------------- next part --------------
Format: 1.8
Date: Tue, 31 Jan 2012 01:27:53 -0800
Source: openssl
Binary: openssl openssl-doc libssl0.9.8 libcrypto0.9.8-udeb libssl0.9.8-udeb libssl-dev libssl0.9.8-dbg
Architecture: source
Version: 0.9.8o-5ubuntu1.2
Distribution: natty-security
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Steve Beattie <sbeattie at ubuntu.com>
Description:
libcrypto0.9.8-udeb - crypto shared library - udeb (udeb)
libssl-dev - SSL development libraries, header files and documentation
libssl0.9.8 - SSL shared libraries
libssl0.9.8-dbg - Symbol tables for libssl and libcrypto
libssl0.9.8-udeb - ssl shared library - udeb (udeb)
openssl - Secure Socket Layer (SSL) binary and related cryptographic tools
openssl-doc - Secure Socket Layer (SSL) documentation
Launchpad-Bugs-Fixed: 244250
Changes:
openssl (0.9.8o-5ubuntu1.2) natty-security; urgency=low
.
* SECURITY UPDATE: ECDSA private key timing attack
- debian/patches/CVE-2011-1945.patch: compute with fixed scalar
length
- CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
- debian/patches/CVE-2011-3210.patch: fix memory usage for thread
safety
- CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
- debian/patches/CVE-2011-4108.patch: perform all computations
before discarding messages
- CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
- debian/patches/CVE-2011-4019.patch: only free domain policyin
one location
- CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
- debian/patches/CVE-2011-4576.patch: clear bytes used for block
padding of SSL 3.0 records.
- CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
- debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
data from triggering an assertion failure
- CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
- debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
restart for SSL/TLS.
- CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
- debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
- CVE-2012-0050
* debian/libssl0.9.8.postinst: Only issue the reboot notification for
servers by testing that the X server is not running (LP: #244250)
Checksums-Sha1:
08cb88371ee2f3169405c4f0ec03217d1912c371 2116 openssl_0.9.8o-5ubuntu1.2.dsc
7838480f00a248ea04436181726756c5db6eaa96 100211 openssl_0.9.8o-5ubuntu1.2.debian.tar.gz
Checksums-Sha256:
f0c805fee86649f49cc234ca9201253b37e63d400f30cac14483f82643c4726b 2116 openssl_0.9.8o-5ubuntu1.2.dsc
66fe97728e1b52aa5d7ca9b4644cc66a7ab009b14885609d2720fd35912dcf5c 100211 openssl_0.9.8o-5ubuntu1.2.debian.tar.gz
Files:
9b191cf4d65ced89204093fd4dee96cb 2116 utils optional openssl_0.9.8o-5ubuntu1.2.dsc
b72cc0920ea01c2a1436a3af259deb7b 100211 utils optional openssl_0.9.8o-5ubuntu1.2.debian.tar.gz
Original-Maintainer: Debian OpenSSL Team <pkg-openssl-devel at lists.alioth.debian.org>
More information about the Natty-changes
mailing list