~ubuntu-branches/ubuntu/hardy/openssl/hardy-updates

• Changes
• Files

~ubuntu-branches/ubuntu/hardy/openssl/hardy-updates » Changes from revision 37

From Revision 37 to 18

expand all

collapse all

Rev		Summary	Authors	Tags	Date	Diff	Files
37		* SECURITY UPDATE: denial of service via invalid OCSP key * SECURITY UPDATE: denial of service via invalid OCSP key   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=66e8211c0b1347970096e04b18aa52567c325200   - CVE-2013-0166 * SECURITY UPDATE: "Lucky Thirteen" timing side-channel TLS attack   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=270881316664396326c461ec7a124aec2c6cc081   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=35a65e814beb899fa1c69a7673a8956c6059dce7   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=a33e6702a0db1b9f4648d247b8b28a5c0e42ca13   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2928cb4c82d6516d9e65ede4901a5957d8c39c32   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=b3a959a337b8083bc855623f24cebaf43a477350   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=be88529753897c29c677d1becb321f0072c0659c   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=99f5093347c65eecbd05f0668aea94b32fcf20d7   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=24b28060975c01b749391778d13ec2ea1323a1aa   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=924b11742296c13816a9f301e76fea023003920c   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=c23a7458209e773ffcd42bdcfa5cf2564df86bd7   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1909df070fb5c5b87246a2de19c17588deba5818   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=33ccde59a1ece0f68cc4b64e930001ab230725b1   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=5f9345a2f0b592457fc4a619ac98ea59ffd394ba   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=40e0de03955e218f45a7979cb46fba193f4e7fc2   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1213e6c3c2d7abeeb886d911a3c6c06c5da2e3a4   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=ca3b81c8580a609edac1f13a3f62d4348d66c3a8   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=6351adecb4726476def5f5ad904a7d2e63480d53   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=fb092ef4fca897344daf7189526f5f26be6487ce   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=59b1129e0a50fdf7e4e58d7c355783a7bfc1f44c   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4ea7019165db53b92b4284461c5c88bfe7c6e57d   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=76c61a5d1adb92388f39e585e4af860a20feb9bb   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=ff58eaa4b645a38f3a226cf566d969fffa64ef94   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=5864fd2061f43dc8f89b5755f19bd2a35dec636c   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=fbe621d08f2026926c91c1c5f386b27605e39a43   - http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=a8655eb21a7f9a313db18daa6ccaed928fb6027c   - CVE-2013-0169	Marc Deslauriers	0.9.8g-4ubuntu3.20	11 years ago
36		* SECURITY UPDATE: denial of service attack in DTLS implemen... * SECURITY UPDATE: denial of service attack in DTLS implementation   - ssl/d1_enc.c: guard for integer overflow before skipping     explicit IV   - http://cvs.openssl.org/chngview?cn=22558   - CVE-2012-2333 * SECURITY UPDATE: million message attack (MMA) in CMS   - crypto/pkcs7/pk7_doit.c: use a random key if RSA decryption     fails to avoid leaking timing information   - http://cvs.openssl.org/chngview?cn=22238   - CVE-2012-0884 * crypto/pkcs7/pk7_smime.c: detect symmetric crypto errors in   PKCS7_decrypt   - http://cvs.openssl.org/chngview?cn=22161	Steve Beattie	0.9.8g-4ubuntu3.19	11 years ago
35		* SECURITY UPDATE: incomplete fix for CVE-2012-2110 * SECURITY UPDATE: incomplete fix for CVE-2012-2110   - crypto/buffer/buffer.c: also verify 'len' in BUF_MEM_grow and     BUF_MEM_grow_clean is non-negative   - http://cvs.openssl.org/chngview?cn=22479   - CVE-2012-2131 * crypto/buffer/buffer.c: Use correct error code in BUF_MEM_grow_clean()   - http://cvs.openssl.org/chngview?cn=22476	Jamie Strandboge	0.9.8g-4ubuntu3.18	11 years ago
34		* SECURITY UPDATE: fix various overflows * SECURITY UPDATE: fix various overflows   - adjust crypto/a_d2i_fp.c, crypto/buffer.c and crypto/mem.c to verify     size of lengths   - http://cvs.openssl.org/chngview?cn=22439   - CVE-2012-2110	Jamie Strandboge	0.9.8g-4ubuntu3.17	12 years ago
33		* SECURITY UPDATE: ECDSA private key timing attack * SECURITY UPDATE: ECDSA private key timing attack   - crypto/ecdsa/ecs_ossl.c: compute with fixed scalar length   - http://cvs.openssl.org/chngview?cn=20892   - CVE-2011-1945 * SECURITY UPDATE: ECDH ciphersuite denial of service   - ssl/s3_lib.c, file ssl/s3_srvr.c: fix memory usage for thread     safety   - http://cvs.openssl.org/chngview?cn=21334   - CVE-2011-3210 * SECURITY UPDATE: DTLS plaintext recovery attack (LP: #922229)   - ssl/d1_pkt.c: perform all computations before discarding messages   - http://cvs.openssl.org/chngview?cn=21942   - http://cvs.openssl.org/chngview?cn=19574   - CVE-2011-4108 * SECURITY UPDATE: policy check double free vulnerability   - crypto/x509v3/pcy_map.c, crypto/x509v3/pcy_tree.c: only free     domain policy in one location   - http://cvs.openssl.org/chngview?cn=21941   - CVE-2011-4019 * SECURITY UPDATE: incorrect elliptic curve computation TLS key   exposure   - crypto/bn/bn_nist.c: perform ellyiptic curve computations     correctly   - update to http://cvs.openssl.org/fileview?f=openssl/crypto/bn/bn_nist.c&v=1.20   - CVE-2011-4354 * SECURITY UPDATE: SSL 3.0 block padding exposure   - ssl/s3_enc.c: clear bytes used for block padding of SSL 3.0     records.   - http://cvs.openssl.org/chngview?cn=21940   - CVE-2011-4576 * SECURITY UPDATE: malformed RFC 3779 data denial of service attack   - crypto/x509v3/v3_addr.c: prevent malformed RFC3779 data     from triggering an assertion failure   - http://cvs.openssl.org/chngview?cn=21937   - CVE-2011-4577 * SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service   - ssl/s3_srvr.c, ssl/ssl.h, ssl/ssl3.h, ssl/ssl_err.c: Only allow     one SGC handshake restart for SSL/TLS.   - CVE-2011-4619 * SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack   - ssl/d1_pkt.c: improve handling of DTLS MAC   - http://cvs.openssl.org/chngview?cn=22032   - CVE-2012-0050 * crypto/ecdsa/ecdsatest.c: fix ECDSA tests   - http://cvs.openssl.org/chngview?cn=21777   - http://cvs.openssl.org/chngview?cn=21995 * debian/libssl0.9.8.postinst: Only issue the reboot notification for   servers by testing that the X server is not running (LP: #244250)	Steve Beattie	0.9.8g-4ubuntu3.15	12 years ago
32		* SECURITY UPDATE: ciphersuite downgrade vulnerability * SECURITY UPDATE: ciphersuite downgrade vulnerability   - ssl/s3_clnt.c, ssl/s3_srvr.c: disable workaround for Netscape     cipher suite bug   - http://openssl.org/news/secadv_20101202.txt   - CVE-2010-4180	Steve Beattie	0.9.8g-4ubuntu3.13	13 years ago
31		* SECURITY UPDATE: TLS race condition leading to a buffer ov... * SECURITY UPDATE: TLS race condition leading to a buffer overflow and   possible code execution. (LP: #676243)   - ssl/t1_lib.c: stricter NULL/not-NULL checking   - http://openssl.org/news/secadv_20101116.txt   - CVE-2010-3864	Steve Beattie	0.9.8g-4ubuntu3.12	13 years ago
30		* SECURITY UPDATE: denial of service and possible code execu... * SECURITY UPDATE: denial of service and possible code execution via   unchecked bn_wexpand return values. (LP: #655884)   - crypto/bn/{bn_mul,bn_div,bn_gf2m}.c, crypto/ec/ec2_smpl.c,     engines/e_ubsec.c: check return values.   - http://cvs.openssl.org/chngview?cn=18936   - http://cvs.openssl.org/chngview?cn=19309   - CVE-2009-3245 * SECURITY UPDATE: denial of service and possible code execution via   crafted private key with an invalid prime.   - ssl/s3_clnt.c: set bn_ctx to NULL after freeing it.   - http://www.mail-archive.com/openssl-dev@openssl.org/msg28049.html   - CVE-2010-2939	Marc Deslauriers	0.9.8g-4ubuntu3.11	13 years ago
29		* SECURITY UPDATE: TLS renegotiation flaw (LP: #616759) * SECURITY UPDATE: TLS renegotiation flaw (LP: #616759)   - apps/{s_cb,s_client,s_server}.c, doc/ssl/SSL_CTX_set_options.pod,     ssl/{d1_both,d1_clnt,d1_srvr,s3_both,s3_clnt,s3_pkt,s3_srvr,ssl_err,     ssl_lib,t1_lib,t1_reneg}.c, ssl/Makefile, ssl/{ssl3,ssl,ssl_locl,     tls1}.h: backport rfc5746 support from openssl 0.9.8m.   - CVE-2009-3555 * Enable tlsext, and backport some patches from jaunty now that tlsext is   enabled.   - Fix a problem with tlsext preventing firefox 3 from connection.   - Don't add extentions to ssl v3 connections. It breaks with some     other software.	Marc Deslauriers	0.9.8g-4ubuntu3.10	13 years ago
28		* SECURITY UPDATE: memory leak possible during state clean-u... * SECURITY UPDATE: memory leak possible during state clean-up.   - crypto/comp/c_zlib.c: upstream fixes applied inline.   - CVE-2009-4355	Kees Cook	0.9.8g-4ubuntu3.9	14 years ago
27		* SECURITY UPDATE: certificate spoofing via hash collisions ... * SECURITY UPDATE: certificate spoofing via hash collisions from MD2   design flaws.   - crypto/evp/c_alld.c, ssl/ssl_algs.c: disable MD2 digest.   - crypto/x509/x509_vfy.c: skip signature check for self signed     certificates   - http://marc.info/?l=openssl-cvs&m=124508133203041&w=2   - http://marc.info/?l=openssl-cvs&m=124704528713852&w=2   - CVE-2009-2409	Marc Deslauriers	0.9.8g-4ubuntu3.8	14 years ago
26		* SECURITY UPDATE: denial of service via memory consumption ... * SECURITY UPDATE: denial of service via memory consumption from large   number of future epoch DTLS records.   - crypto/pqueue.*: add new pqueue_size counter function.   - ssl/d1_pkt.c: use pqueue_size to limit size of queue to 100.   - http://cvs.openssl.org/chngview?cn=18187   - CVE-2009-1377 * SECURITY UPDATE: denial of service via memory consumption from   duplicate or invalid sequence numbers in DTLS records.   - ssl/d1_both.c: discard message if it's a duplicate or too far in the     future.   - http://marc.info/?l=openssl-dev&m=124263491424212&w=2   - CVE-2009-1378 * SECURITY UPDATE: denial of service or other impact via use-after-free   in dtls1_retrieve_buffered_fragment.   - ssl/d1_both.c: use temp frag_len instead of freed frag.   - http://rt.openssl.org/Ticket/Display.html?id=1923   - CVE-2009-1379 * SECURITY UPDATE: denial of service via DTLS ChangeCipherSpec packet   that occurs before ClientHello.   - ssl/s3_pkt.c: abort if s->session is NULL.   - ssl/{ssl.h,ssl_err.c}: add new error codes.   - http://cvs.openssl.org/chngview?cn=17369   - CVE-2009-1386 * SECURITY UPDATE: denial of service via an out-of-sequence DTLS   handshake message.   - ssl/d1_both.c: don't buffer fragments with no data.   - http://cvs.openssl.org/chngview?cn=17958   - CVE-2009-1387	Marc Deslauriers	0.9.8g-4ubuntu3.7	14 years ago
25		* SECURITY UPDATE: crash via invalid memory access when prin... * SECURITY UPDATE: crash via invalid memory access when printing BMPString   or UniversalString with invalid length   - crypto/asn1/tasn_dec.c, crypto/asn1/asn1_err.c and crypto/asn1/asn1.h:     return error if invalid length   - CVE-2009-0590   - http://www.openssl.org/news/secadv_20090325.txt   - patch from upstream CVS:     crypto/asn1/asn1.h:1.128.2.11->1.128.2.12     crypto/asn1/asn1_err.c:1.54.2.4->1.54.2.5     crypto/asn1/tasn_dec.c:1.26.2.10->1.26.2.11	Jamie Strandboge	0.9.8g-4ubuntu3.5	15 years ago
24		* SECURITY UPDATE: clients treat malformed signatures as goo... * SECURITY UPDATE: clients treat malformed signatures as good when verifying   server DSA and ECDSA certificates   - update apps/speed.c, apps/spkac.c, apps/verify.c, apps/x509.c,     ssl/s2_clnt.c, ssl/s2_srvr.c, ssl/s3_clnt.c, s3_srvr.c, and     ssl/ssltest.c to properly check the return code of EVP_VerifyFinal()   - patch based on upstream patch for #2008-016   - CVE-2008-5077	Jamie Strandboge	0.9.8g-4ubuntu3.4	15 years ago
23		* SECURITY UPDATE: fix denial of service when 'Server Key ex... * SECURITY UPDATE: fix denial of service when 'Server Key exchange message'   is omitted from a TLS handshake * ssl/s3_clnt.c: make sure s->session->sess_cert is not NULL * SECURITY UPDATE: fix denial of service when using tlsext. Note that   this version of openssl does not use tlsext by default. * ssl/t1_lib.c: make sure s->session->tlsext_hostname is set to NULL to   prevent double free. * References   CVE-2008-1672   CVE-2008-0891   LP: #235913	Jamie Strandboge	0.9.8g-4ubuntu3.3	15 years ago
22		* SECURITY UPDATE: PRNG seeding was not fully operational. * SECURITY UPDATE: PRNG seeding was not fully operational. * crypto/rand/md_rand.c: restore upstream code.	Kees Cook	0.9.8g-4ubuntu3.1	15 years ago
21		* Use a different priority for libssl0.9.8/restart-services ... * Use a different priority for libssl0.9.8/restart-services depending on whether   a desktop, or server dist-upgrade is being performed. (LP: #91814) * Display a system restart required notification bubble on libssl0.9.8 upgrade.	Luke Yelavich	0.9.8g-4ubuntu3	16 years ago
20		Ship documentation in new openssl-doc package, since it is v... Ship documentation in new openssl-doc package, since it is very large and not terribly useful for the casual desktop user.	Martin Pitt	0.9.8g-4ubuntu2	16 years ago
19		* Merge from unstable; remaining changes: * Merge from unstable; remaining changes:   - Configure: Add support for lpia.   - Replace duplicate files in the doc directory with symlinks.   - Link using -Bsymbolic-functions.	Matthias Klose	0.9.8g-4ubuntu1	16 years ago
18		* Merge with Debian; remaining changes: * Merge with Debian; remaining changes:   - Configure: Add support for lpia.   - Replace duplicate files in the doc directory with symlinks.	Matthias Klose	0.9.8g-3ubuntu1	16 years ago

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1