[ubuntu/oneiric-security] openssl098 0.9.8o-7ubuntu1.2 (Accepted)

[Jamie Strandboge]

openssl098 (0.9.8o-7ubuntu1.2) oneiric-security; urgency=low

  * Bring up to date with latest security patches from Ubuntu 11.04:
    * SECURITY UPDATE: ECDSA private key timing attack
    - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
      length
    - CVE-2011-1945
  * SECURITY UPDATE: ECDH ciphersuite denial of service
    - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
      safety
    - CVE-2011-3210
  * SECURITY UPDATE: DTLS plaintext recovery attack
    - debian/patches/CVE-2011-4108.patch: perform all computations
      before discarding messages
    - CVE-2011-4108
  * SECURITY UPDATE: policy check double free vulnerability
    - debian/patches/CVE-2011-4019.patch: only free domain policyin
      one location
    - CVE-2011-4019
  * SECURITY UPDATE: SSL 3.0 block padding exposure
    - debian/patches/CVE-2011-4576.patch: clear bytes used for block
      padding of SSL 3.0 records.
    - CVE-2011-4576
  * SECURITY UPDATE: malformed RFC 3779 data denial of service attack
    - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
      data from triggering an assertion failure
    - CVE-2011-4577
  * SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
    - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
      restart for SSL/TLS.
    - CVE-2011-4619
  * SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
    - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
    - CVE-2012-0050
  * SECURITY UPDATE: NULL pointer dereference in S/MIME messages with broken
    headers
    - debian/patches/CVE-2006-7250+2012-1165.patch: adjust mime_hdr_cmp()
      and mime_param_cmp() to not dereference the compared strings if either
      is NULL
    - CVE-2006-7250
    - CVE-2012-1165
  * SECURITY UPDATE: fix various overflows
    - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
      crypto/buffer.c and crypto/mem.c to verify size of lengths
    - CVE-2012-2110
  * SECURITY UPDATE: incomplete fix for CVE-2012-2110
    - debian/patches/CVE-2012-2131.patch: also verify 'len' in BUF_MEM_grow
      and BUF_MEM_grow_clean is non-negative
    - CVE-2012-2131
  * debian/patches/CVE-2012-2110b.patch: Use correct error code in
    BUF_MEM_grow_clean()

Date: Tue, 24 Apr 2012 10:00:29 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/oneiric/+source/openssl098/0.9.8o-7ubuntu1.2
-------------- next part --------------
Format: 1.8
Date: Tue, 24 Apr 2012 10:00:29 -0500
Source: openssl098
Binary: libssl0.9.8 libssl0.9.8-dbg libcrypto0.9.8-udeb
Architecture: source
Version: 0.9.8o-7ubuntu1.2
Distribution: oneiric-security
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 libcrypto0.9.8-udeb - crypto shared library - udeb (udeb)
 libssl0.9.8 - SSL shared libraries
 libssl0.9.8-dbg - Symbol tables for libssl and libcrypto
Changes: 
 openssl098 (0.9.8o-7ubuntu1.2) oneiric-security; urgency=low
 .
   * Bring up to date with latest security patches from Ubuntu 11.04:
     * SECURITY UPDATE: ECDSA private key timing attack
     - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
       length
     - CVE-2011-1945
   * SECURITY UPDATE: ECDH ciphersuite denial of service
     - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
       safety
     - CVE-2011-3210
   * SECURITY UPDATE: DTLS plaintext recovery attack
     - debian/patches/CVE-2011-4108.patch: perform all computations
       before discarding messages
     - CVE-2011-4108
   * SECURITY UPDATE: policy check double free vulnerability
     - debian/patches/CVE-2011-4019.patch: only free domain policyin
       one location
     - CVE-2011-4019
   * SECURITY UPDATE: SSL 3.0 block padding exposure
     - debian/patches/CVE-2011-4576.patch: clear bytes used for block
       padding of SSL 3.0 records.
     - CVE-2011-4576
   * SECURITY UPDATE: malformed RFC 3779 data denial of service attack
     - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
       data from triggering an assertion failure
     - CVE-2011-4577
   * SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
     - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
       restart for SSL/TLS.
     - CVE-2011-4619
   * SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
     - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
     - CVE-2012-0050
   * SECURITY UPDATE: NULL pointer dereference in S/MIME messages with broken
     headers
     - debian/patches/CVE-2006-7250+2012-1165.patch: adjust mime_hdr_cmp()
       and mime_param_cmp() to not dereference the compared strings if either
       is NULL
     - CVE-2006-7250
     - CVE-2012-1165
   * SECURITY UPDATE: fix various overflows
     - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
       crypto/buffer.c and crypto/mem.c to verify size of lengths
     - CVE-2012-2110
   * SECURITY UPDATE: incomplete fix for CVE-2012-2110
     - debian/patches/CVE-2012-2131.patch: also verify 'len' in BUF_MEM_grow
       and BUF_MEM_grow_clean is non-negative
     - CVE-2012-2131
   * debian/patches/CVE-2012-2110b.patch: Use correct error code in
     BUF_MEM_grow_clean()
Checksums-Sha1: 
 9a2575b296f4d44d166fe92c8dd89ffa614b79d9 2085 openssl098_0.9.8o-7ubuntu1.2.dsc
 0373571e8c018a0130921902da94c77eb7d4b504 102911 openssl098_0.9.8o-7ubuntu1.2.debian.tar.gz
Checksums-Sha256: 
 32301cc502f0877f96834a40ecf7f522d14dbae6d3f6785ed9f0ce3d3642527f 2085 openssl098_0.9.8o-7ubuntu1.2.dsc
 3edbccb3bd687d76cc3753ff6817ab166f4cdd2ee87c07a9c8ccd4d9bfb62b31 102911 openssl098_0.9.8o-7ubuntu1.2.debian.tar.gz
Files: 
 a4d8b995451c38944a8c425b19f51bf8 2085 utils optional openssl098_0.9.8o-7ubuntu1.2.dsc
 8bc0eb81ac2c0ff11754c3c6217a8b6c 102911 utils optional openssl098_0.9.8o-7ubuntu1.2.debian.tar.gz
Original-Maintainer: Debian OpenSSL Team <pkg-openssl-devel at lists.alioth.debian.org>