[Bug 677756] Re: Merge openssl 0.9.8o-3 (main) from Debian unstable (main)

[Launchpad Bug Tracker]

This bug was fixed in the package openssl - 0.9.8o-3ubuntu1

---------------
openssl (0.9.8o-3ubuntu1) natty; urgency=low

  * Merge from debian unstable (LP: #677756).  Remaining changes:
    - debian/patches/Bsymbolic-functions.patch: Link using
      -Bsymbolic-functions (refreshed)
    - Use a different priority for libssl0.9.8/restart-services
      depending on whether a desktop, or server dist-upgrade is being
      performed.
    - Display a system restart required notification bubble on libssl0.9.8
      upgrade.
    - Don't build for processors no longer supported: i486, i586
      (on i386), v8 (on sparc).
    - Create libssl0.9.8-udeb, for the benefit of wget-udeb (no
      wget-udeb package in Debian)
    - Replace duplicate files in the doc directory with symlinks.
    - Move runtime libraries to /lib, for the benefit of wpasupplicant
    - Ship documentation in openssl-doc, suggested by the package.
      (Debian bug 470594)
    - Use host compiler when cross-building (patch from Neil Williams in
      Debian bug 465248).
    - Don't run 'make test' when cross-building.
    - debian/patches/aesni.patch: Backport Intel AES-NI support from
      http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
    - debian/patches/perlpath-quilt.patch: Don't change perl #! paths
      under .pc.
    - debian/patches/no-sslv2.patch: disable SSLv2 to match NSS
      and GnuTLS. The protocol is unsafe and extremely deprecated.
      (Debian bug 589706)
  * Dropped patches, now upstream:
    - debian/patches/CVE-2010-2939.patch (Debian patch is identically
      named)

openssl (0.9.8o-3) unstable; urgency=high

  * Fix TLS extension parsing race condition (CVE-2010-3864) (Closes: #603709)
  * Re-add the engines.  They were missing since 0.9.8m-1.
    Patch by Joerg Schneider. (Closes: #603693)
  * Not all architectures were build using -g (Closes: #570702)
  * Add powerpcspe support (Closes: #579805)
  * Add armhf support (Closes: #596881)
  * Update translations:
    - Brazilian Portuguese (Closes: #592154)
    - Danish (Closes: #599459)
    - Vietnamese (Closes: #601536)
    - Arabic (Closes: #596166)
  * Generate the proper stamp file so that everything doesn't get build twice.

openssl (0.9.8o-2) unstable; urgency=high

  * Fix CVE-2010-2939: Double free using ECDH. (Closes: #594415)
 -- Steve Beattie <sbeattie at ubuntu.com>   Thu, 18 Nov 2010 12:54:37 -0800

** Changed in: openssl (Ubuntu)
       Status: Fix Committed => Fix Released

** Bug watch added: OpenSSL RT #2067
   http://rt.openssl.org/Ticket/Display.html?id=2067

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-2939

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-3864

-- 
Merge openssl 0.9.8o-3 (main) from Debian unstable (main)
https://bugs.launchpad.net/bugs/677756
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is a direct subscriber.

Status in “openssl” package in Ubuntu: Fix Released

Bug description:
Binary package hint: openssl

This version includes a fix for CVE-2010-3864 as well as re-enabling the engines in openssl.

openssl (0.9.8o-3) unstable; urgency=high

   * Fix TLS extension parsing race condition (CVE-2010-3864) (Closes: #603709)
   * Re-add the engines.  They were missing since 0.9.8m-1.
     Patch by Joerg Schneider. (Closes: #603693)
   * Not all architectures were build using -g (Closes: #570702)
   * Add powerpcspe support (Closes: #579805)
   * Add armhf support (Closes: #596881)
   * Update translations:
     - Brazilian Portuguese (Closes: #592154)
     - Danish (Closes: #599459)
     - Vietnamese (Closes: #601536)
     - Arabic (Closes: #596166)
   * Generate the proper stamp file so that everything doesn't get build twice.

 -- Kurt Roeckx <kurt at roeckx.be>  Tue, 16 Nov 2010 19:20:55 +0100
openssl (0.9.8o-2) unstable; urgency=high

   * Fix CVE-2010-2939: Double free using ECDH. (Closes: #594415)

 -- Kurt Roeckx <kurt at roeckx.be>  Thu, 26 Aug 2010 18:25:29 +0200