~ubuntu-branches/ubuntu/quantal/openssl/quantal-updates

• Changes
• Files

~ubuntu-branches/ubuntu/quantal/openssl/quantal-updates » Changes from revision 92

From Revision 92 to 73

expand all

collapse all

Rev		Summary	Authors	Tags	Date	Diff	Files
92		* SECURITY UPDATE: denial of service via use after free * SECURITY UPDATE: denial of service via use after free   - debian/patches/CVE-2010-5298.patch: check s->s3->rbuf.left before     releasing buffers in ssl/s3_pkt.c.   - CVE-2010-5298 * SECURITY UPDATE: denial of service via null pointer dereference   - debian/patches/CVE-2014-0198.patch: if buffer was released, get a new     one in ssl/s3_pkt.c.   - CVE-2014-0198	Marc Deslauriers	1.0.1c-3ubuntu2.8	9 years ago
91		* SECURITY UPDATE: side-channel attack on Montgomery ladder ... * SECURITY UPDATE: side-channel attack on Montgomery ladder implementation   - debian/patches/CVE-2014-0076.patch: add and use constant time swap in     crypto/bn/bn.h, crypto/bn/bn_lib.c, crypto/ec/ec2_mult.c,     util/libeay.num.   - CVE-2014-0076 * SECURITY UPDATE: memory disclosure in TLS heartbeat extension   - debian/patches/CVE-2014-0160.patch: use correct lengths in     ssl/d1_both.c, ssl/t1_lib.c.   - CVE-2014-0160	Marc Deslauriers	1.0.1c-3ubuntu2.7	10 years ago
90		* SECURITY UPDATE: denial of service via invalid TLS handsha... * SECURITY UPDATE: denial of service via invalid TLS handshake   - debian/patches/CVE-2013-4353.patch: handle no new cipher setup in     ssl/s3_both.c.   - CVE-2013-4353 * SECURITY UPDATE: denial of service via incorrect data structure   - debian/patches/CVE-2013-6449.patch: check for handshake digests in     ssl/s3_both.c,ssl/s3_pkt.c,ssl/t1_enc.c, use proper version in     ssl/s3_lib.c.   - CVE-2013-6449 * SECURITY UPDATE: denial of service via DTLS retransmission   - debian/patches/CVE-2013-6450.patch: fix DTLS retransmission in     crypto/evp/digest.c,ssl/d1_both.c,ssl/s3_pkt.c,ssl/s3_srvr.c,     ssl/ssl_locl.h,ssl/t1_enc.c.   - CVE-2013-6450 * debian/patches/no_default_rdrand.patch: Don't use rdrand engine as   default unless explicitly requested.	Marc Deslauriers	1.0.1c-3ubuntu2.6	10 years ago
89		* SECURITY UPDATE: Disable compression to avoid CRIME system... * SECURITY UPDATE: Disable compression to avoid CRIME systemwide   (LP: #1187195)   - CVE-2012-4929   - debian/patches/openssl-1.0.1e-env-zlib.patch: disable default use of     zlib to compress SSL/TLS unless the environment variable     OPENSSL_DEFAULT_ZLIB is set in the environment during library     initialization.   - Introduced to assist with programs not yet updated to provide their own     controls on compression, such as Postfix   - http://pkgs.fedoraproject.org/cgit/openssl.git/plain/openssl-1.0.1e-env-zlib.patch	Seth Arnold	1.0.1c-3ubuntu2.5	10 years ago
88		* SECURITY UPDATE: "Lucky Thirteen" timing side-channel TLS ... * SECURITY UPDATE: "Lucky Thirteen" timing side-channel TLS attack   - debian/patches/CVE-2013-0169.patch: re-enabled patch and added extra     commit from upstream to fix regression.   - CVE-2013-0169	Marc Deslauriers	1.0.1c-3ubuntu2.3	11 years ago
87		* REGRESSION FIX: decryption errors on AES-NI hardware (LP: ... * REGRESSION FIX: decryption errors on AES-NI hardware (LP: #1134873,   LP: #1133333)   - debian/patches/CVE-2013-0169.patch: disabled for now until fix is     available from upstream.	Marc Deslauriers	1.0.1c-3ubuntu2.2	11 years ago
86		* SECURITY UPDATE: denial of service via invalid OCSP key * SECURITY UPDATE: denial of service via invalid OCSP key   - debian/patches/CVE-2013-0166.patch: properly handle NULL key in     crypto/asn1/a_verify.c, crypto/ocsp/ocsp_vfy.c.   - CVE-2013-0166 * SECURITY UPDATE: "Lucky Thirteen" timing side-channel TLS attack   - debian/patches/CVE-2013-0169.patch: massive code changes   - CVE-2013-0169 * SECURITY UPDATE: denial of service via AES-NI and crafted CBC data   - Fix included in CVE-2013-0169 patch   - CVE-2012-2686	Marc Deslauriers	1.0.1c-3ubuntu2.1	11 years ago
85		[ Tyler Hicks <tyhicks@canonical.com> ] [ Tyler Hicks <tyhicks@canonical.com> ] * debian/patches/tls12_workarounds.patch: Readd the change to check   TLS1_get_client_version rather than TLS1_get_version to fix incorrect   client hello cipher list truncation when TLS 1.1 and lower is in use.   (LP: #1051892) [ Micah Gersten <micahg@ubuntu.com> ] * Mark Debian Vcs-* as XS-Debian-Vcs-*   - update debian/control	Tyler Hicks	1.0.1c-3ubuntu2	11 years ago
84		* Resynchronise with Debian. Remaining changes: * Resynchronise with Debian. Remaining changes:   - debian/libssl1.0.0.postinst:     + Display a system restart required notification on libssl1.0.0       upgrade on servers.     + Use a different priority for libssl1.0.0/restart-services depending       on whether a desktop, or server dist-upgrade is being performed.   - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create     libssl1.0.0-udeb, for the benefit of wget-udeb (no wget-udeb package     in Debian).   - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,     rules}: Move runtime libraries to /lib, for the benefit of     wpasupplicant.   - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under     .pc.   - debian/rules:     + Don't run 'make test' when cross-building.     + Use host compiler when cross-building.  Patch from Neil Williams.     + Don't build for processors no longer supported: i586 (on i386)     + Fix Makefile to properly clean up libs/ dirs in clean target.     + Replace duplicate files in the doc directory with symlinks.   - Unapply patch c_rehash-multi and comment it out in the series as it     breaks parsing of certificates with CRLF line endings and other cases     (see Debian #642314 for discussion), it also changes the semantics of     c_rehash directories by requiring applications to parse hash link     targets as files containing potentially *multiple* certificates rather     than exactly one.   - Bump version passed to dh_makeshlibs to 1.0.1 for new symbols.   - debian/patches/tls12_workarounds.patch: workaround large client hello     issue: Compile with -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 and     with -DOPENSSL_NO_TLS1_2_CLIENT. * Dropped upstreamed patches:   - debian/patches/CVE-2012-2110.patch   - debian/patches/CVE-2012-2110b.patch   - debian/patches/CVE-2012-2333.patch   - debian/patches/CVE-2012-0884-extra.patch   - most of debian/patches/tls12_workarounds.patch	Marc Deslauriers	1.0.1c-3ubuntu1	11 years ago
83		* SECURITY UPDATE: denial of service attack in DTLS, TLS v1.... * SECURITY UPDATE: denial of service attack in DTLS, TLS v1.1 and   TLS v1.2 implementation   - debian/patches/CVE_2012-2333.patch: guard for integer overflow     before skipping explicit IV   - CVE-2012-2333 * debian/patches/CVE-2012-0884-extra.patch: initialize tkeylen   properly when encrypting CMS messages.	Steve Beattie	1.0.1-4ubuntu6	11 years ago
82		debian/patches/CVE-2012-2110b.patch: Use correct error code ... debian/patches/CVE-2012-2110b.patch: Use correct error code in BUF_MEM_grow_clean()	Jamie Strandboge	1.0.1-4ubuntu5	11 years ago
81		* SECURITY UPDATE: fix various overflows * SECURITY UPDATE: fix various overflows   - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,     crypto/buffer.c and crypto/mem.c to verify size of lengths   - CVE-2012-2110	Jamie Strandboge	1.0.1-4ubuntu3	12 years ago
80		releasing version 1.0.1-4ubuntu4 releasing version 1.0.1-4ubuntu4	Colin Watson	1.0.1-4ubuntu4	11 years ago
79		merge 1.0.1-4ubuntu3 merge 1.0.1-4ubuntu3	Colin Watson		11 years ago
78		Check TLS1_get_client_version rather than TLS1_get_version f... Check TLS1_get_client_version rather than TLS1_get_version for client hello cipher list truncation, in a further attempt to get things working again for everyone (LP: #986147).	Colin Watson		11 years ago
77		releasing version 1.0.1-4ubuntu2 releasing version 1.0.1-4ubuntu2	Colin Watson	1.0.1-4ubuntu2	12 years ago
76		* Backport more upstream patches to work around TLS 1.2 fail... * Backport more upstream patches to work around TLS 1.2 failures   (LP #965371):   - Do not use record version number > TLS 1.0 in initial client hello:     some (but not all) hanging servers will now work.   - Truncate the number of ciphers sent in the client hello to 50.  Most     broken servers should now work.   - Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections. * Don't re-enable TLS 1.2 client support by default yet, since more of the   sites listed in the above bug and its duplicates still fail if I do that   versus leaving it disabled.	Colin Watson		12 years ago
75		releasing version 1.0.1-4ubuntu1 releasing version 1.0.1-4ubuntu1	Colin Watson	1.0.1-4ubuntu1	12 years ago
74		merge fixes LP: #968753 merge fixes LP: #968753	Colin Watson		12 years ago
73		merge from Debian 1.0.1-4 merge from Debian 1.0.1-4	Colin Watson		12 years ago

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1