← Back to branch summary

~ubuntu-branches/ubuntu/lucid/openssl/lucid-security

« back to all changes in this revision

Viewing changes to debian/changelog

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2014-08-07 08:48:43 UTC
  • Revision ID: package-import@ubuntu.com-20140807084843-tdiyho5w4ps784yx
Tags: 0.9.8k-7ubuntu8.20
* SECURITY UPDATE: double free when processing DTLS packets
  - debian/patches/CVE-2014-3505.patch: fix double free in ssl/d1_both.c.
  - CVE-2014-3505
* SECURITY UPDATE: DTLS memory exhaustion
  - debian/patches/CVE-2014-3506.patch: fix DTLS handshake message size
    checks in ssl/d1_both.c.
  - CVE-2014-3506
* SECURITY UPDATE: information leak in pretty printing functions
  - debian/patches/CVE-2014-3508.patch: fix OID handling in
    crypto/asn1/a_object.c, crypto/objects/obj_dat.c, crypto/asn1/asn1.h,
    crypto/asn1/asn1_err.c.
  - CVE-2014-3508
* SECURITY UPDATE: DTLS anonymous EC(DH) denial of service
  - debian/patches/CVE-2014-3510.patch: check for server certs in
    ssl/d1_clnt.c, ssl/s3_clnt.c.
  - CVE-2014-3510
* SECURITY UPDATE: TLS protocol downgrade attack
  - debian/patches/CVE-2014-3511.patch: properly handle fragments in
    ssl/s23_srvr.c.
  - CVE-2014-3511

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/changelog
 
1
openssl (0.9.8k-7ubuntu8.20) lucid-security; urgency=medium
 
2
 
 
3
  * SECURITY UPDATE: double free when processing DTLS packets
 
4
    - debian/patches/CVE-2014-3505.patch: fix double free in ssl/d1_both.c.
 
5
    - CVE-2014-3505
 
6
  * SECURITY UPDATE: DTLS memory exhaustion
 
7
    - debian/patches/CVE-2014-3506.patch: fix DTLS handshake message size
 
8
      checks in ssl/d1_both.c.
 
9
    - CVE-2014-3506
 
10
  * SECURITY UPDATE: information leak in pretty printing functions
 
11
    - debian/patches/CVE-2014-3508.patch: fix OID handling in
 
12
      crypto/asn1/a_object.c, crypto/objects/obj_dat.c, crypto/asn1/asn1.h,
 
13
      crypto/asn1/asn1_err.c.
 
14
    - CVE-2014-3508
 
15
  * SECURITY UPDATE: DTLS anonymous EC(DH) denial of service
 
16
    - debian/patches/CVE-2014-3510.patch: check for server certs in
 
17
      ssl/d1_clnt.c, ssl/s3_clnt.c.
 
18
    - CVE-2014-3510
 
19
  * SECURITY UPDATE: TLS protocol downgrade attack
 
20
    - debian/patches/CVE-2014-3511.patch: properly handle fragments in
 
21
      ssl/s23_srvr.c.
 
22
    - CVE-2014-3511
 
23
 
 
24
 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 07 Aug 2014 08:48:43 -0400
 
25
 
1
26
openssl (0.9.8k-7ubuntu8.19) lucid-security; urgency=medium
2
27
 
3
28
  * SECURITY UPDATE: regression with certain renegotiations (LP: #1332643)