[ubuntu/utopic-proposed] openssl 1.0.1f-1ubuntu7 (Accepted)

[Marc Deslauriers]

openssl (1.0.1f-1ubuntu7) utopic; urgency=medium

  * SECURITY UPDATE: double free when processing DTLS packets
    - debian/patches/CVE-2014-3505.patch: fix double free in ssl/d1_both.c.
    - CVE-2014-3505
  * SECURITY UPDATE: DTLS memory exhaustion
    - debian/patches/CVE-2014-3506.patch: fix DTLS handshake message size
      checks in ssl/d1_both.c.
    - CVE-2014-3506
  * SECURITY UPDATE: DTLS memory leak from zero-length fragments
    - debian/patches/CVE-2014-3507.patch: fix memory leak and return codes
      in ssl/d1_both.c.
    - CVE-2014-3507
  * SECURITY UPDATE: information leak in pretty printing functions
    - debian/patches/CVE-2014-3508.patch: fix OID handling in
      crypto/asn1/a_object.c, crypto/objects/obj_dat.c.
    - CVE-2014-3508
  * SECURITY UPDATE: race condition in ssl_parse_serverhello_tlsext
    - debian/patches/CVE-2014-3509.patch: fix race in ssl/t1_lib.c.
    - CVE-2014-3509
  * SECURITY UPDATE: DTLS anonymous EC(DH) denial of service
    - debian/patches/CVE-2014-3510.patch: check for server certs in
      ssl/d1_clnt.c, ssl/s3_clnt.c.
    - CVE-2014-3510
  * SECURITY UPDATE: TLS protocol downgrade attack
    - debian/patches/CVE-2014-3511.patch: properly handle fragments in
      ssl/s23_srvr.c.
    - CVE-2014-3511
  * SECURITY UPDATE: SRP buffer overrun
    - debian/patches/CVE-2014-3512.patch: check parameters in
      crypto/srp/srp_lib.c.
    - CVE-2014-3512
  * SECURITY UPDATE: crash with SRP ciphersuite in Server Hello message
    - debian/patches/CVE-2014-5139.patch: fix SRP authentication and make
      sure ciphersuite is set up correctly in ssl/s3_clnt.c, ssl/ssl_lib.c,
      ssl/s3_lib.c, ssl/ssl.h, ssl/ssl_ciph.c, ssl/ssl_locl.h.
    - CVE-2014-5139

Date: Thu, 07 Aug 2014 09:34:54 -0400
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/utopic/+source/openssl/1.0.1f-1ubuntu7
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 07 Aug 2014 09:34:54 -0400
Source: openssl
Binary: openssl libssl1.0.0 libcrypto1.0.0-udeb libssl1.0.0-udeb libssl-dev libssl-doc libssl1.0.0-dbg
Architecture: source
Version: 1.0.1f-1ubuntu7
Distribution: utopic
Urgency: medium
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Description:
 libcrypto1.0.0-udeb - Secure Sockets Layer toolkit - libcrypto udeb (udeb)
 libssl-dev - Secure Sockets Layer toolkit - development files
 libssl-doc - Secure Sockets Layer toolkit - development documentation
 libssl1.0.0 - Secure Sockets Layer toolkit - shared libraries
 libssl1.0.0-dbg - Secure Sockets Layer toolkit - debug information
 libssl1.0.0-udeb - ssl shared library - udeb (udeb)
 openssl    - Secure Sockets Layer toolkit - cryptographic utility
Changes:
 openssl (1.0.1f-1ubuntu7) utopic; urgency=medium
 .
   * SECURITY UPDATE: double free when processing DTLS packets
     - debian/patches/CVE-2014-3505.patch: fix double free in ssl/d1_both.c.
     - CVE-2014-3505
   * SECURITY UPDATE: DTLS memory exhaustion
     - debian/patches/CVE-2014-3506.patch: fix DTLS handshake message size
       checks in ssl/d1_both.c.
     - CVE-2014-3506
   * SECURITY UPDATE: DTLS memory leak from zero-length fragments
     - debian/patches/CVE-2014-3507.patch: fix memory leak and return codes
       in ssl/d1_both.c.
     - CVE-2014-3507
   * SECURITY UPDATE: information leak in pretty printing functions
     - debian/patches/CVE-2014-3508.patch: fix OID handling in
       crypto/asn1/a_object.c, crypto/objects/obj_dat.c.
     - CVE-2014-3508
   * SECURITY UPDATE: race condition in ssl_parse_serverhello_tlsext
     - debian/patches/CVE-2014-3509.patch: fix race in ssl/t1_lib.c.
     - CVE-2014-3509
   * SECURITY UPDATE: DTLS anonymous EC(DH) denial of service
     - debian/patches/CVE-2014-3510.patch: check for server certs in
       ssl/d1_clnt.c, ssl/s3_clnt.c.
     - CVE-2014-3510
   * SECURITY UPDATE: TLS protocol downgrade attack
     - debian/patches/CVE-2014-3511.patch: properly handle fragments in
       ssl/s23_srvr.c.
     - CVE-2014-3511
   * SECURITY UPDATE: SRP buffer overrun
     - debian/patches/CVE-2014-3512.patch: check parameters in
       crypto/srp/srp_lib.c.
     - CVE-2014-3512
   * SECURITY UPDATE: crash with SRP ciphersuite in Server Hello message
     - debian/patches/CVE-2014-5139.patch: fix SRP authentication and make
       sure ciphersuite is set up correctly in ssl/s3_clnt.c, ssl/ssl_lib.c,
       ssl/s3_lib.c, ssl/ssl.h, ssl/ssl_ciph.c, ssl/ssl_locl.h.
     - CVE-2014-5139
Checksums-Sha1:
 d5a3cb0cfaad05865a8bd693b90b42135d32e051 2417 openssl_1.0.1f-1ubuntu7.dsc
 dbe9d66a0f70d11fdc1eb080b96a506d4f15a3f1 104936 openssl_1.0.1f-1ubuntu7.debian.tar.xz
Checksums-Sha256:
 c6ce9d378a44e95e3f9bf03cfe57ede303053b2f89a87c9f35663a6028d5219b 2417 openssl_1.0.1f-1ubuntu7.dsc
 e4f6b2a1016dd49707bd18b8e6149845411fe053ba77f331991a6a4eea09480f 104936 openssl_1.0.1f-1ubuntu7.debian.tar.xz
Files:
 225141c07ed96c0d53528c312412835a 2417 utils optional openssl_1.0.1f-1ubuntu7.dsc
 988840e3d8478e58965fdf4d06b23497 104936 utils optional openssl_1.0.1f-1ubuntu7.debian.tar.xz
Original-Maintainer: Debian OpenSSL Team <pkg-openssl-devel at lists.alioth.debian.org>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJT45ySAAoJEGVp2FWnRL6TTaYP/jVJdYGdTKjC96SmrYAGj8xD
ciQ2B/LOVxhQUsFh4oY3QSyCJDYVsY3Diwux/3hBrtOdZV7o5pPg1Eqo/OcqF9wj
8CNwa/sGnLpUBICf9fQhMUKx6GmimKo+QyTMyEhvfsTTWL3m5iTZ8x2qnnIy47nt
axa2GELD6Xr7AHsVqKYOEWIfM6/YGl8wEjqZo/RUjg0f1Jj2v5SkH3wcQ1GJEUaq
ziTJfKrbDhJpxzRUKXpWPajYz0Il9d4EepNzpN7+53hsARlFJ+76kY/SLyNnN2BH
Fxlt7x8DkDCRleLiwddUC3M9viTijb5gx/s5mi+1sFBiG0a5WEZcqe2bDaMT7seF
7hOdgWew9N12h+PmqMxltQHxfDiGbUW/OxWLaMxgLjPYhvDlbhchfeIbt1lbO4mG
rifo8GddJnVO5vc2BkptXQjiz99l6cDCPT3dXZHZsXBbdG3SO3UMe4QxTAH90hvX
bbeVpRFkYmwDE4rnjwJiFlEsrWwJ/9o5qWOkzfMs3CPfayViHMDiNbr7yMZqvWCU
LWOb4y4Z6bbadq+1aC8Sbi5n0zs5Fm489S5g4NyfOtWH9xgvZuAvAwtX61n8GJmy
II6ua3+mF9wYvCBWTi6dvbyldW7KeylgMwzjzSkWN1dkk60gyeAiU44ciQUxW6sr
pQtqE+IhUZMvDEZKH52H
=3+or
-----END PGP SIGNATURE-----