~ubuntu-branches/ubuntu/lucid/openssl/lucid-security

• Changes
• Files

~ubuntu-branches/ubuntu/lucid/openssl/lucid-security » Changes from revision 61

From Revision 44 to 25

expand all

collapse all

Rev		Summary	Authors	Tags	Date	Diff	Files
44		* SECURITY UPDATE: TLS renegotiation flaw (LP: #616759) * SECURITY UPDATE: TLS renegotiation flaw (LP: #616759)   - debian/patches/CVE-2009-3555-RFC5746.patch: backport rfc5746 support     from openssl 0.9.8m.   - CVE-2009-3555	Marc Deslauriers	0.9.8k-7ubuntu8.1	14 years ago
43		* SECURITY UPDATE: denial of service and possible arbitrary ... * SECURITY UPDATE: denial of service and possible arbitrary code   execution via unchecked return values   - debian/patches/CVE-2009-3245.patch: check bn_wexpand return value in     crypto/bn/{bn_div.c,bn_gf2m.c,bn_mul.c}, crypto/ec/ec2_smpl.c,     engines/e_ubsec.c.   - CVE-2009-3245 * SECURITY UPDATE: denial of service via "record of death"   - debian/patches/CVE-2010-0740.patch: only send back minor version     number in ssl/s3_pkt.c.   - CVE-2010-0740	Marc Deslauriers	0.9.8k-7ubuntu8	14 years ago
42		debian/patches/dtls-compatibility.patch: backport dtls compa... debian/patches/dtls-compatibility.patch: backport dtls compatibility code from 0.9.8m to fix interopability. (LP: #516318)	Marc Deslauriers	0.9.8k-7ubuntu7	14 years ago
41		* Backport Intel AES-NI support from * Backport Intel AES-NI support from   http://rt.openssl.org/Ticket/Display.html?id=2067 (LP: #485518). * Don't change perl #! paths under .pc.	Colin Watson	0.9.8k-7ubuntu6	14 years ago
40		* SECURITY UPDATE: memory leak possible during state clean-u... * SECURITY UPDATE: memory leak possible during state clean-up.   - Add CVE-2009-4355.patch, upstream fixes thanks to Debian.	Kees Cook	0.9.8k-7ubuntu5	14 years ago
39		releasing version 0.9.8k-7ubuntu4 releasing version 0.9.8k-7ubuntu4	Colin Watson	0.9.8k-7ubuntu4	14 years ago
38		Create libssl0.9.8-udeb, for the benefit of wget-udeb (LP: #... Create libssl0.9.8-udeb, for the benefit of wget-udeb (LP: #503339).	Colin Watson		14 years ago
37		* Use host compiler when cross-building (patch from Neil Wil... * Use host compiler when cross-building (patch from Neil Williams in   Debian #465248). * Don't run 'make test' when cross-building.	Colin Watson		14 years ago
36		debian/patches/disable-sslv2.patch: remove and apply inline ... debian/patches/disable-sslv2.patch: remove and apply inline to fix FTBFS when patch won't revert during the build process.	Marc Deslauriers	0.9.8k-7ubuntu3	15 years ago
35		debian/patches/{disable-sslv2,Bsymbolic-functions}.patch: ap... debian/patches/{disable-sslv2,Bsymbolic-functions}.patch: apply Makefile sections inline as once the package is configured during the build process, the patches wouldn't revert anymore, causing a FTBFS on anything other than amd64.	Marc Deslauriers	0.9.8k-7ubuntu2	15 years ago
34		* Merge from debian unstable, remaining changes (LP: #493392... * Merge from debian unstable, remaining changes (LP: #493392):   - Link using -Bsymbolic-functions   - Add support for lpia   - Disable SSLv2 during compile   - Ship documentation in openssl-doc, suggested by the package.   - Use a different priority for libssl0.9.8/restart-services     depending on whether a desktop, or server dist-upgrade is being     performed.   - Display a system restart required notification bubble on libssl0.9.8     upgrade.   - Replace duplicate files in the doc directory with symlinks.   - Move runtime libraries to /lib, for the benefit of wpasupplicant * Strip the patches out of the source into quilt patches * Disable CVE-2009-3555.patch	Nicolas Valcárcel Sc...	0.9.8k-7ubuntu1	15 years ago
33		* SECURITY UPDATE: certificate spoofing via hash collisions ... * SECURITY UPDATE: certificate spoofing via hash collisions from MD2   design flaws.   - crypto/evp/c_alld.c, ssl/ssl_algs.c: disable MD2 digest.   - crypto/x509/x509_vfy.c: skip signature check for self signed     certificates   - http://marc.info/?l=openssl-cvs&m=124508133203041&w=2   - http://marc.info/?l=openssl-cvs&m=124704528713852&w=2   - CVE-2009-2409	Marc Deslauriers	0.9.8g-16ubuntu3	15 years ago
32		* Patches forward ported from http://www.ubuntu.com/usn/USN-... * Patches forward ported from http://www.ubuntu.com/usn/USN-792-1 (by   Marc Deslauriers) * SECURITY UPDATE: denial of service via memory consumption from large   number of future epoch DTLS records.   - crypto/pqueue.*: add new pqueue_size counter function.   - ssl/d1_pkt.c: use pqueue_size to limit size of queue to 100.   - http://cvs.openssl.org/chngview?cn=18187   - CVE-2009-1377 * SECURITY UPDATE: denial of service via memory consumption from   duplicate or invalid sequence numbers in DTLS records.   - ssl/d1_both.c: discard message if it's a duplicate or too far in the     future.   - http://marc.info/?l=openssl-dev&m=124263491424212&w=2   - CVE-2009-1378 * SECURITY UPDATE: denial of service or other impact via use-after-free   in dtls1_retrieve_buffered_fragment.   - ssl/d1_both.c: use temp frag_len instead of freed frag.   - http://rt.openssl.org/Ticket/Display.html?id=1923&user=guest&pass=guest   - CVE-2009-1379 * SECURITY UPDATE: denial of service via DTLS ChangeCipherSpec packet   that occurs before ClientHello.   - ssl/s3_pkt.c: abort if s->session is NULL.   - ssl/{ssl.h,ssl_err.c}: add new error codes.   - http://cvs.openssl.org/chngview?cn=17369   - CVE-2009-1386 * SECURITY UPDATE: denial of service via an out-of-sequence DTLS   handshake message.   - ssl/d1_both.c: don't buffer fragments with no data.   - http://cvs.openssl.org/chngview?cn=17958   - CVE-2009-1387	Jamie Strandboge	0.9.8g-16ubuntu2	15 years ago
31		* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes:   - Link using -Bsymbolic-functions   - Add support for lpia   - Disable SSLv2 during compile   - Ship documentation in openssl-doc, suggested by the package.   - Use a different priority for libssl0.9.8/restart-services     depending on whether a desktop, or server dist-upgrade is being     performed.   - Display a system restart required notification bubble on libssl0.9.8     upgrade.   - Replace duplicate files in the doc directory with symlinks.	Jamie Strandboge	0.9.8g-16ubuntu1	15 years ago
30		* SECURITY UPDATE: crash via invalid memory access when prin... * SECURITY UPDATE: crash via invalid memory access when printing BMPString   or UniversalString with invalid length   - crypto/asn1/tasn_dec.c, crypto/asn1/asn1_err.c and crypto/asn1/asn1.h:     return error if invalid length   - CVE-2009-0590   - http://www.openssl.org/news/secadv_20090325.txt   - patch from upstream CVS:     crypto/asn1/asn1.h:1.128.2.11->1.128.2.12     crypto/asn1/asn1_err.c:1.54.2.4->1.54.2.5     crypto/asn1/tasn_dec.c:1.26.2.10->1.26.2.11	Jamie Strandboge	0.9.8g-15ubuntu3	15 years ago
29		Move runtime libraries to /lib, for the benefit of wpasuppli... Move runtime libraries to /lib, for the benefit of wpasupplicant (LP: #44194). Leave symlinks behind in /usr/lib (except on the Hurd) since we used to set an rpath there.	Colin Watson	0.9.8g-15ubuntu2	15 years ago
28		* Merge from debian unstable, remaining changes: LP: #314984 * Merge from debian unstable, remaining changes: LP: #314984   - Link using -Bsymbolic-functions   - Add support for lpia   - Disable SSLv2 during compile   - Ship documentation in openssl-doc, suggested by the package.   - Use a different priority for libssl0.9.8/restart-services     depending on whether a desktop, or server dist-upgrade is being     performed.   - Display a system restart required notification bubble on libssl0.9.8     upgrade.   - Replace duplicate files in the doc directory with symlinks.	Bhavani Shankar	0.9.8g-15ubuntu1	15 years ago
27		* SECURITY UPDATE: clients treat malformed signatures as goo... * SECURITY UPDATE: clients treat malformed signatures as good when verifying   server DSA and ECDSA certificates   - update apps/speed.c, apps/spkac.c, apps/verify.c, apps/x509.c,     ssl/s2_clnt.c, ssl/s2_srvr.c, ssl/s3_clnt.c, s3_srvr.c, and     ssl/ssltest.c to properly check the return code of EVP_VerifyFinal()   - patch based on upstream patch for #2008-016   - CVE-2008-5077	Jamie Strandboge	0.9.8g-14ubuntu2	15 years ago
26		* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes:   - Link using -Bsymbolic-functions   - Add support for lpia   - Disable SSLv2 during compile   - Ship documentation in openssl-doc, suggested by the package.   - Use a different priority for libssl0.9.8/restart-services     depending on whether a desktop, or server dist-upgrade is being     performed.   - Display a system restart required notification bubble on libssl0.9.8     upgrade.   - Replace duplicate files in the doc directory with symlinks.	Scott James Remnant	0.9.8g-14ubuntu1	16 years ago
25		* debian/rules: * debian/rules:   - disable SSLv2 during compile * debian/README.debian   - add note about disabled SSLv2 in Ubuntu	Ante Karamatic	0.9.8g-10.1ubuntu2	16 years ago

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1