[ubuntu/precise-security] openssl098 0.9.8o-7ubuntu3.1 (Accepted)
Jamie Strandboge
jamie at ubuntu.com
Tue Apr 24 21:33:17 UTC 2012
openssl098 (0.9.8o-7ubuntu3.1) precise-security; urgency=low
* Bring up to date with latest security patches from Ubuntu 11.04:
* SECURITY UPDATE: ECDSA private key timing attack
- debian/patches/CVE-2011-1945.patch: compute with fixed scalar
length
- CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
- debian/patches/CVE-2011-3210.patch: fix memory usage for thread
safety
- CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
- debian/patches/CVE-2011-4108.patch: perform all computations
before discarding messages
- CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
- debian/patches/CVE-2011-4019.patch: only free domain policyin
one location
- CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
- debian/patches/CVE-2011-4576.patch: clear bytes used for block
padding of SSL 3.0 records.
- CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
- debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
data from triggering an assertion failure
- CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
- debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
restart for SSL/TLS.
- CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
- debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
- CVE-2012-0050
* SECURITY UPDATE: NULL pointer dereference in S/MIME messages with broken
headers
- debian/patches/CVE-2006-7250+2012-1165.patch: adjust mime_hdr_cmp()
and mime_param_cmp() to not dereference the compared strings if either
is NULL
- CVE-2006-7250
- CVE-2012-1165
* SECURITY UPDATE: fix various overflows
- debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
crypto/buffer.c and crypto/mem.c to verify size of lengths
- CVE-2012-2110
* SECURITY UPDATE: incomplete fix for CVE-2012-2110
- debian/patches/CVE-2012-2131.patch: also verify 'len' in BUF_MEM_grow
and BUF_MEM_grow_clean is non-negative
- CVE-2012-2131
* debian/patches/CVE-2012-2110b.patch: Use correct error code in
BUF_MEM_grow_clean()
Date: Tue, 24 Apr 2012 10:06:47 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/precise/+source/openssl098/0.9.8o-7ubuntu3.1
-------------- next part --------------
Format: 1.8
Date: Tue, 24 Apr 2012 10:06:47 -0500
Source: openssl098
Binary: libssl0.9.8 libssl0.9.8-dbg libcrypto0.9.8-udeb
Architecture: source
Version: 0.9.8o-7ubuntu3.1
Distribution: precise-security
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description:
libcrypto0.9.8-udeb - crypto shared library - udeb (udeb)
libssl0.9.8 - SSL shared libraries
libssl0.9.8-dbg - Symbol tables for libssl and libcrypto
Changes:
openssl098 (0.9.8o-7ubuntu3.1) precise-security; urgency=low
.
* Bring up to date with latest security patches from Ubuntu 11.04:
* SECURITY UPDATE: ECDSA private key timing attack
- debian/patches/CVE-2011-1945.patch: compute with fixed scalar
length
- CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
- debian/patches/CVE-2011-3210.patch: fix memory usage for thread
safety
- CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
- debian/patches/CVE-2011-4108.patch: perform all computations
before discarding messages
- CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
- debian/patches/CVE-2011-4019.patch: only free domain policyin
one location
- CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
- debian/patches/CVE-2011-4576.patch: clear bytes used for block
padding of SSL 3.0 records.
- CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
- debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
data from triggering an assertion failure
- CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
- debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
restart for SSL/TLS.
- CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
- debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
- CVE-2012-0050
* SECURITY UPDATE: NULL pointer dereference in S/MIME messages with broken
headers
- debian/patches/CVE-2006-7250+2012-1165.patch: adjust mime_hdr_cmp()
and mime_param_cmp() to not dereference the compared strings if either
is NULL
- CVE-2006-7250
- CVE-2012-1165
* SECURITY UPDATE: fix various overflows
- debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
crypto/buffer.c and crypto/mem.c to verify size of lengths
- CVE-2012-2110
* SECURITY UPDATE: incomplete fix for CVE-2012-2110
- debian/patches/CVE-2012-2131.patch: also verify 'len' in BUF_MEM_grow
and BUF_MEM_grow_clean is non-negative
- CVE-2012-2131
* debian/patches/CVE-2012-2110b.patch: Use correct error code in
BUF_MEM_grow_clean()
Checksums-Sha1:
108cda9701e58a8ec72aaddc23ed2a45701ffad0 2217 openssl098_0.9.8o-7ubuntu3.1.dsc
8cfae30f3696d070cb7f5d30e4b19bd5e5bb8331 100902 openssl098_0.9.8o-7ubuntu3.1.debian.tar.gz
Checksums-Sha256:
e58b4e2c5712fa5a529ee0368a069a8a1afb25bdd7491fbe634c1baf32541578 2217 openssl098_0.9.8o-7ubuntu3.1.dsc
a2b8061e2924b414dd5fa9ecd572c94b3269657f8b9c3e029491f25100a27f0b 100902 openssl098_0.9.8o-7ubuntu3.1.debian.tar.gz
Files:
0df4c348f111a568538658c8bccb45e9 2217 utils optional openssl098_0.9.8o-7ubuntu3.1.dsc
48b6261ab924673d73e16fb963c3628d 100902 utils optional openssl098_0.9.8o-7ubuntu3.1.debian.tar.gz
Original-Maintainer: Debian OpenSSL Team <pkg-openssl-devel at lists.alioth.debian.org>
More information about the Precise-changes
mailing list