~ubuntu-branches/ubuntu/dapper/openssl/dapper-proposed

• Changes
• Files

~ubuntu-branches/ubuntu/dapper/openssl/dapper-proposed » Changes from revision 16

From Revision 16

expand all

collapse all

Rev		Summary	Authors	Tags	Date	Diff	Files
16		* SECURITY UPDATE: TLS renegotiation flaw (LP: #616759) * SECURITY UPDATE: TLS renegotiation flaw (LP: #616759)   - apps/{s_client,s_server}.c, doc/ssl/SSL_CTX_set_options.pod,     ssl/{d1_both,d1_clnt,d1_srvr,s23_clnt,s3_both,s3_clnt,s3_pkt,s3_srvr,     ssl_err,ssl_lib,t1_lib,t1_reneg}.c, ssl/Makefile, ssl/{ssl3,ssl,     ssl_locl,tls1}.h: add rfc5746 support. Patch backport thanks to     Red Hat.   - CVE-2009-3555	Marc Deslauriers	0.9.8a-7ubuntu0.12	13 years ago
15		* SECURITY UPDATE: memory leak possible during state clean-u... * SECURITY UPDATE: memory leak possible during state clean-up.   - crypto/comp/c_zlib.c: upstream fixes applied inline.   - CVE-2009-4355	Kees Cook	0.9.8a-7ubuntu0.11	14 years ago
14		* SECURITY UPDATE: certificate spoofing via hash collisions ... * SECURITY UPDATE: certificate spoofing via hash collisions from MD2   design flaws.   - crypto/evp/c_alld.c, ssl/ssl_algs.c: disable MD2 digest.   - crypto/x509/x509_vfy.c: skip signature check for self signed     certificates   - http://marc.info/?l=openssl-cvs&m=124508133203041&w=2   - http://marc.info/?l=openssl-cvs&m=124704528713852&w=2   - CVE-2009-2409	Marc Deslauriers	0.9.8a-7ubuntu0.10	14 years ago
13		* SECURITY UPDATE: denial of service via memory consumption ... * SECURITY UPDATE: denial of service via memory consumption from large   number of future epoch DTLS records.   - crypto/pqueue.*: add new pqueue_size counter function.   - ssl/d1_pkt.c: use pqueue_size to limit size of queue to 100.   - http://cvs.openssl.org/chngview?cn=18187   - CVE-2009-1377 * SECURITY UPDATE: denial of service via memory consumption from   duplicate or invalid sequence numbers in DTLS records.   - ssl/d1_both.c: discard message if it's a duplicate or too far in the     future.   - http://marc.info/?l=openssl-dev&m=124263491424212&w=2   - CVE-2009-1378 * SECURITY UPDATE: denial of service or other impact via use-after-free   in dtls1_retrieve_buffered_fragment.   - ssl/d1_both.c: use temp frag_len instead of freed frag.   - http://rt.openssl.org/Ticket/Display.html?id=1923   - CVE-2009-1379 * SECURITY UPDATE: denial of service via DTLS ChangeCipherSpec packet   that occurs before ClientHello.   - ssl/s3_pkt.c: abort if s->session is NULL.   - ssl/{ssl.h,ssl_err.c}: add new error codes.   - http://cvs.openssl.org/chngview?cn=17369   - CVE-2009-1386 * SECURITY UPDATE: denial of service via an out-of-sequence DTLS   handshake message.   - ssl/d1_both.c: don't buffer fragments with no data.   - http://cvs.openssl.org/chngview?cn=17958   - CVE-2009-1387	Marc Deslauriers	0.9.8a-7ubuntu0.9	14 years ago
12		* SECURITY UPDATE: crash via invalid memory access when prin... * SECURITY UPDATE: crash via invalid memory access when printing BMPString   or UniversalString with invalid length   - crypto/asn1/tasn_dec.c, crypto/asn1/asn1_err.c and crypto/asn1/asn1.h:     return error if invalid length   - CVE-2009-0590   - http://www.openssl.org/news/secadv_20090325.txt   - patch from upstream CVS:     crypto/asn1/asn1.h:1.128.2.11->1.128.2.12     crypto/asn1/asn1_err.c:1.54.2.4->1.54.2.5     crypto/asn1/tasn_dec.c:1.26.2.10->1.26.2.11	Jamie Strandboge	0.9.8a-7ubuntu0.7	15 years ago
11		* SECURITY UPDATE: clients treat malformed signatures as goo... * SECURITY UPDATE: clients treat malformed signatures as good when verifying   server DSA and ECDSA certificates   - update apps/speed.c, apps/spkac.c, apps/verify.c, apps/x509.c,     ssl/s2_clnt.c, ssl/s2_srvr.c, ssl/s3_clnt.c, s3_srvr.c, and     ssl/ssltest.c to properly check the return code of EVP_VerifyFinal()   - patch based on upstream patch for #2008-016   - CVE-2008-5077	Jamie Strandboge	0.9.8a-7ubuntu0.6	15 years ago
10		* SECURITY UPDATE: DTLS implementation can lead to remote co... * SECURITY UPDATE: DTLS implementation can lead to remote code execution. * ssl/{ssl_err,d1_both}.c, ssl/{dtls1,ssl}.h: patched inline with upstream   fixes backported thanks to Ludwig Nussel. * References   http://www.openssl.org/news/secadv_20071012.txt   CVE-2007-4995	Kees Cook	0.9.8a-7ubuntu0.5	16 years ago
9		[ Jamie Strandboge ] [ Jamie Strandboge ] * SECURITY UPDATE: off-by-one error in SSL_get_shared_ciphers() results in   buffer overflow * ssl/ssl_lib.c: applied upstream patch from openssl CVS thanks to   Stephan Hermann * References:   CVE-2007-5135   http://www.securityfocus.com/archive/1/archive/1/480855/100/0/threaded   Fixes LP: #146269 [ Kees Cook ] * SECURITY UPDATE: side-channel attacks via BN_from_montgomery function. * crypto/bn/bn_mont.c: upstream patch from openssl CVS thanks to Debian. * References   CVE-2007-3108	Kees Cook	0.9.8a-7ubuntu0.4	16 years ago
8		crypto/dh/dh_key.c: Fix return value to prevent free'ing an ... crypto/dh/dh_key.c: Fix return value to prevent free'ing an uninit'ed pointer.	Martin Pitt	0.9.8a-7ubuntu0.3	17 years ago
7		* SECURITY UPDATE: Remote arbitrary code execution, remote D... * SECURITY UPDATE: Remote arbitrary code execution, remote DoS. * crypto/asn1/tasn_dec.c, asn1_d2i_ex_primitive(): Initialize 'ret' to avoid   an infinite loop in some circumstances. [CVE-2006-2937] * ssl/ssl_lib.c, SSL_get_shared_ciphers(): Fix len comparison to correctly   handle invalid long cipher list strings. [CVE-2006-3738] * ssl/s2_clnt.c, get_server_hello(): Check for NULL session certificate to   avoid client crash with malicious server responses. [CVE-2006-4343] * Certain types of public key could take disproportionate amounts of time to   process. Apply patch from Bodo Moeller to impose limits to public key type   values (similar to Mozilla's libnss). Fixes CPU usage/memory DoS. [CVE-2006-2940] * Updated patch in previous package version to fix a few corner-case   regressions. (This reverts the changes to rsa_eay.c/rsa.h/rsa_err.c, which   were determined to not be necessary).	Martin Pitt	0.9.8a-7ubuntu0.2	17 years ago
6		* SECURITY UPDATE: signature forgery in some cases. * SECURITY UPDATE: signature forgery in some cases. * Apply http://www.openssl.org/news/patch-CVE-2006-4339.txt:   - Check excessive data in padding of PKCS #1 v1.5 signatures to prevent     applications from incorrectly verifying the certificate. * References:   CVE-2006-4339   http://www.openssl.org/news/secadv_20060905.txt	Martin Pitt	0.9.8a-7ubuntu0.1	17 years ago
5		Fake sync from Debian to resolve a problem with establishing... Fake sync from Debian to resolve a problem with establishing TCP connections over the BIO API, add a new debconf translation, and resolve a build failure with libio-socket-ssl-perl.	Adam Conrad	0.9.8a-7build1	18 years ago
4		Stop ssh from crashing randomly on sparc (Closes: #335912) Stop ssh from crashing randomly on sparc (Closes: #335912) Patch from upstream cvs.	Kurt Roeckx	0.9.8a-5	18 years ago
3		* really fix der_chop. The fix from -1 was not really includ... * really fix der_chop. The fix from -1 was not really included (closes:   #281212)  * still fixes security problem CAN-2004-0975 etc.   - tempfile raise condition in der_chop   - Avoid a race condition when CRLs are checked in a multi threaded      environment.	Christoph Martin	0.9.7e-3	19 years ago
2		rename -pic.a libraries to _pic.a (closes: #250016) rename -pic.a libraries to _pic.a (closes: #250016)	Christoph Martin	0.9.7d-3	19 years ago
1		Import upstream version 0.9.7d Import upstream version 0.9.7d	Christoph Martin	upstream-0.9.7d	19 years ago

Loggerhead is a web-based interface for Breezy
Version: 2.0.1