~ubuntu-branches/ubuntu/utopic/openssl/utopic

From Revision 109 to 90

expand all

collapse all

Rev		Summary	Authors	Tags	Date	Diff	Files
109		* SECURITY UPDATE: denial of service via DTLS SRTP memory le... * SECURITY UPDATE: denial of service via DTLS SRTP memory leak   - debian/patches/CVE-2014-3513.patch: fix logic in ssl/d1_srtp.c,     ssl/srtp.h, ssl/t1_lib.c, util/mk1mf.pl, util/mkdef.pl,     util/ssleay.num.   - CVE-2014-3513 * SECURITY UPDATE: denial of service via session ticket integrity check   memory leak   - debian/patches/CVE-2014-3567.patch: perform cleanup in ssl/t1_lib.c.   - CVE-2014-3567 * SECURITY UPDATE: fix the no-ssl3 build option   - debian/patches/CVE-2014-3568.patch: fix conditional code in     ssl/s23_clnt.c, ssl/s23_srvr.c.   - CVE-2014-3568 * SECURITY IMPROVEMENT: Added TLS_FALLBACK_SCSV support to mitigate a   protocol downgrade attack to SSLv3 that exposes the POODLE attack.   - debian/patches/tls_fallback_scsv_support.patch: added support for     TLS_FALLBACK_SCSV in apps/s_client.c, crypto/err/openssl.ec,     ssl/d1_lib.c, ssl/dtls1.h, ssl/s23_clnt.c, ssl/s23_srvr.c,     ssl/s2_lib.c, ssl/s3_enc.c, ssl/s3_lib.c, ssl/ssl.h, ssl/ssl3.h,     ssl/ssl_err.c, ssl/ssl_lib.c, ssl/t1_enc.c, ssl/tls1.h,      doc/apps/s_client.pod, doc/ssl/SSL_CTX_set_mode.pod.	Marc Deslauriers	1.0.1f-1ubuntu9	9 years ago
108		Backport collected POWER8 optimisations from upstream (LP: #... Backport collected POWER8 optimisations from upstream (LP: #1290579).	Colin Watson	1.0.1f-1ubuntu8	9 years ago
107		* SECURITY UPDATE: double free when processing DTLS packets * SECURITY UPDATE: double free when processing DTLS packets   - debian/patches/CVE-2014-3505.patch: fix double free in ssl/d1_both.c.   - CVE-2014-3505 * SECURITY UPDATE: DTLS memory exhaustion   - debian/patches/CVE-2014-3506.patch: fix DTLS handshake message size     checks in ssl/d1_both.c.   - CVE-2014-3506 * SECURITY UPDATE: DTLS memory leak from zero-length fragments   - debian/patches/CVE-2014-3507.patch: fix memory leak and return codes     in ssl/d1_both.c.   - CVE-2014-3507 * SECURITY UPDATE: information leak in pretty printing functions   - debian/patches/CVE-2014-3508.patch: fix OID handling in     crypto/asn1/a_object.c, crypto/objects/obj_dat.c.   - CVE-2014-3508 * SECURITY UPDATE: race condition in ssl_parse_serverhello_tlsext   - debian/patches/CVE-2014-3509.patch: fix race in ssl/t1_lib.c.   - CVE-2014-3509 * SECURITY UPDATE: DTLS anonymous EC(DH) denial of service   - debian/patches/CVE-2014-3510.patch: check for server certs in     ssl/d1_clnt.c, ssl/s3_clnt.c.   - CVE-2014-3510 * SECURITY UPDATE: TLS protocol downgrade attack   - debian/patches/CVE-2014-3511.patch: properly handle fragments in     ssl/s23_srvr.c.   - CVE-2014-3511 * SECURITY UPDATE: SRP buffer overrun   - debian/patches/CVE-2014-3512.patch: check parameters in     crypto/srp/srp_lib.c.   - CVE-2014-3512 * SECURITY UPDATE: crash with SRP ciphersuite in Server Hello message   - debian/patches/CVE-2014-5139.patch: fix SRP authentication and make     sure ciphersuite is set up correctly in ssl/s3_clnt.c, ssl/ssl_lib.c,     ssl/s3_lib.c, ssl/ssl.h, ssl/ssl_ciph.c, ssl/ssl_locl.h.   - CVE-2014-5139	Marc Deslauriers	1.0.1f-1ubuntu7	9 years ago
106		* SECURITY UPDATE: regression with certain renegotiations (L... * SECURITY UPDATE: regression with certain renegotiations (LP: #1332643)   - debian/patches/CVE-2014-0224-regression2.patch: accept CCS after     sending finished ssl/s3_clnt.c.	Marc Deslauriers	1.0.1f-1ubuntu6	9 years ago
105		* SECURITY UPDATE: regression with tls_session_secret_cb (LP... * SECURITY UPDATE: regression with tls_session_secret_cb (LP: #1329297)   - debian/patches/CVE-2014-0224.patch: set the CCS_OK flag when using     tls_session_secret_cb for session resumption in ssl/s3_clnt.c.	Marc Deslauriers	1.0.1f-1ubuntu5	9 years ago
104		* SECURITY UPDATE: arbitrary code execution via DTLS invalid... * SECURITY UPDATE: arbitrary code execution via DTLS invalid fragment   - debian/patches/CVE-2014-0195.patch: add consistency check for DTLS     fragments in ssl/d1_both.c.   - CVE-2014-0195 * SECURITY UPDATE: denial of service via DTLS recursion flaw   - debian/patches/CVE-2014-0221.patch: handle DTLS hello request without     recursion in ssl/d1_both.c.   - CVE-2014-0221 * SECURITY UPDATE: MITM via change cipher spec   - debian/patches/CVE-2014-0224-1.patch: only accept change cipher spec     when it is expected in ssl/s3_clnt.c, ssl/s3_pkt.c, ssl/s3_srvr.c,     ssl/ssl3.h.   - debian/patches/CVE-2014-0224-2.patch: don't accept zero length master     secrets in ssl/s3_pkt.c.   - debian/patches/CVE-2014-0224-3.patch: allow CCS after resumption in     ssl/s3_clnt.c.   - CVE-2014-0224 * SECURITY UPDATE: denial of service via ECDH null session cert   - debian/patches/CVE-2014-3470.patch: check session_cert is not NULL     before dereferencing it in ssl/s3_clnt.c.   - CVE-2014-3470	Marc Deslauriers	1.0.1f-1ubuntu4	9 years ago
103		* SECURITY UPDATE: denial of service via use after free * SECURITY UPDATE: denial of service via use after free   - debian/patches/CVE-2010-5298.patch: check s->s3->rbuf.left before     releasing buffers in ssl/s3_pkt.c.   - CVE-2010-5298 * SECURITY UPDATE: denial of service via null pointer dereference   - debian/patches/CVE-2014-0198.patch: if buffer was released, get a new     one in ssl/s3_pkt.c.   - CVE-2014-0198	Marc Deslauriers	1.0.1f-1ubuntu3	9 years ago
102		* SECURITY UPDATE: side-channel attack on Montgomery ladder ... * SECURITY UPDATE: side-channel attack on Montgomery ladder implementation   - debian/patches/CVE-2014-0076.patch: add and use constant time swap in     crypto/bn/bn.h, crypto/bn/bn_lib.c, crypto/ec/ec2_mult.c,     util/libeay.num.   - CVE-2014-0076 * SECURITY UPDATE: memory disclosure in TLS heartbeat extension   - debian/patches/CVE-2014-0160.patch: use correct lengths in     ssl/d1_both.c, ssl/t1_lib.c.   - CVE-2014-0160	Marc Deslauriers	1.0.1f-1ubuntu2	10 years ago
101		* Merge with Debian, remaining changes. * Merge with Debian, remaining changes.   - debian/libssl1.0.0.postinst:     + Display a system restart required notification on libssl1.0.0       upgrade on servers.     + Use a different priority for libssl1.0.0/restart-services depending       on whether a desktop, or server dist-upgrade is being performed.   - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create     libssl1.0.0-udeb, for the benefit of wget-udeb (no wget-udeb package     in Debian).   - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,     rules}: Move runtime libraries to /lib, for the benefit of     wpasupplicant.   - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under     .pc.   - debian/rules:     + Don't run 'make test' when cross-building.     + Use host compiler when cross-building.  Patch from Neil Williams.     + Don't build for processors no longer supported: i586 (on i386)     + Fix Makefile to properly clean up libs/ dirs in clean target.     + Replace duplicate files in the doc directory with symlinks.   - debian/control: Mark Debian Vcs-* as XS-Debian-Vcs-*   - debian/patches/ubuntu_deb676533_arm_asm.patch: Enable arm assembly     code.   - debian/rules: Enable optimized 64bit elliptic curve code contributed     by Google. * Dropped changes:   - debian/patches/arm64-support: included in debian-targets.patch   - debian/patches/no_default_rdrand.patch: upstream   - debian/patches/openssl-1.0.1e-env-zlib.patch: zlib is now completely     disabled in debian/rules	Marc Deslauriers	1.0.1f-1ubuntu1	10 years ago
100		debian/patches/no_default_rdrand.patch: Don't use rdrand eng... debian/patches/no_default_rdrand.patch: Don't use rdrand engine as default unless explicitly requested.	Marc Deslauriers	1.0.1e-4ubuntu4	10 years ago
99		Update debian configuration. Update debian configuration.	Matthias Klose	1.0.1e-4ubuntu3	10 years ago
98		* Re-enable full TLSv1.2 support (LP: #1257877) * Re-enable full TLSv1.2 support (LP: #1257877)   - debian/patches/tls12_workarounds.patch: disable patch to re-enable     full TLSv1.2 support. Most problematic sites have been fixed now, and     we really want proper TLSv1.2 support in an LTS.	Marc Deslauriers	1.0.1e-4ubuntu2	10 years ago
97		Merge with Debian; remaining changes same as in 1.0.1e-3ubun... Merge with Debian; remaining changes same as in 1.0.1e-3ubuntu1.	Matthias Klose	1.0.1e-4ubuntu1	10 years ago
96		* Merge with Debian, remaining changes. * Merge with Debian, remaining changes.   - debian/libssl1.0.0.postinst:     + Display a system restart required notification on libssl1.0.0       upgrade on servers.     + Use a different priority for libssl1.0.0/restart-services depending       on whether a desktop, or server dist-upgrade is being performed.   - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create     libssl1.0.0-udeb, for the benefit of wget-udeb (no wget-udeb package     in Debian).   - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,     rules}: Move runtime libraries to /lib, for the benefit of     wpasupplicant.   - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under     .pc.   - debian/rules:     + Don't run 'make test' when cross-building.     + Use host compiler when cross-building.  Patch from Neil Williams.     + Don't build for processors no longer supported: i586 (on i386)     + Fix Makefile to properly clean up libs/ dirs in clean target.     + Replace duplicate files in the doc directory with symlinks.   - Unapply patch c_rehash-multi and comment it out in the series as it     breaks parsing of certificates with CRLF line endings and other cases     (see Debian #642314 for discussion), it also changes the semantics of     c_rehash directories by requiring applications to parse hash link     targets as files containing potentially *multiple* certificates rather     than exactly one.   - debian/patches/tls12_workarounds.patch: Workaround large client hello     issues when TLS 1.1 and lower is in use   - debian/control: Mark Debian Vcs-* as XS-Debian-Vcs-*   - debian/patches/ubuntu_deb676533_arm_asm.patch: Enable arm assembly     code.   - debian/patches/arm64-support: Add basic arm64 support (no assembler)   - debian/rules: Enable optimized 64bit elliptic curve code contributed     by Google. * debian/patches/tls12_workarounds.patch: updated to also disable TLS 1.2   in test suite since we disable it in the client. * Disable compression to avoid CRIME systemwide (CVE-2012-4929). * Dropped changes:   - debian/patches/ubuntu_deb676533_arm_asm.patch, applied in Debian.	Matthias Klose	1.0.1e-3ubuntu1	10 years ago
95		* SECURITY UPDATE: Disable compression to avoid CRIME system... * SECURITY UPDATE: Disable compression to avoid CRIME systemwide   (LP: #1187195)   - CVE-2012-4929   - debian/patches/openssl-1.0.1e-env-zlib.patch: disable default use of     zlib to compress SSL/TLS unless the environment variable     OPENSSL_DEFAULT_ZLIB is set in the environment during library     initialization.   - Introduced to assist with programs not yet updated to provide their own     controls on compression, such as Postfix   - http://pkgs.fedoraproject.org/cgit/openssl.git/plain/openssl-1.0.1e-env-zlib.patch	Seth Arnold	1.0.1e-2ubuntu1.1	10 years ago
94		* Resynchronise with Debian unstable. Remaining changes: * Resynchronise with Debian unstable.  Remaining changes:   - debian/libssl1.0.0.postinst:     + Display a system restart required notification on libssl1.0.0       upgrade on servers.     + Use a different priority for libssl1.0.0/restart-services depending       on whether a desktop, or server dist-upgrade is being performed.   - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create     libssl1.0.0-udeb, for the benefit of wget-udeb (no wget-udeb package     in Debian).   - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,     rules}: Move runtime libraries to /lib, for the benefit of     wpasupplicant.   - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under     .pc.   - debian/rules:     + Don't run 'make test' when cross-building.     + Use host compiler when cross-building.  Patch from Neil Williams.     + Don't build for processors no longer supported: i586 (on i386)     + Fix Makefile to properly clean up libs/ dirs in clean target.     + Replace duplicate files in the doc directory with symlinks.   - Unapply patch c_rehash-multi and comment it out in the series as it     breaks parsing of certificates with CRLF line endings and other cases     (see Debian #642314 for discussion), it also changes the semantics of     c_rehash directories by requiring applications to parse hash link     targets as files containing potentially *multiple* certificates rather     than exactly one.   - debian/patches/tls12_workarounds.patch: Workaround large client hello     issues when TLS 1.1 and lower is in use   - debian/control: Mark Debian Vcs-* as XS-Debian-Vcs-*   - debian/patches/ubuntu_deb676533_arm_asm.patch: Enable arm assembly     code.   - debian/patches/arm64-support: Add basic arm64 support (no assembler)   - debian/rules: Enable optimized 64bit elliptic curve code contributed     by Google. * debian/patches/tls12_workarounds.patch: updated to also disable TLS 1.2   in test suite since we disable it in the client. * Dropped changes:   - debian/patches/CVE-2013-0169.patch: upstream.   - debian/patches/fix_key_decoding_deadlock.patch: upstream.   - debian/patches/CVE-2013-0166.patch: upstream.	Marc Deslauriers	1.0.1e-2ubuntu1	10 years ago
93		* SECURITY UPDATE: "Lucky Thirteen" timing side-channel TLS ... * SECURITY UPDATE: "Lucky Thirteen" timing side-channel TLS attack   - debian/patches/CVE-2013-0169.patch: re-enabled patch and added extra     commit from upstream to fix regression.   - CVE-2013-0169	Marc Deslauriers	1.0.1c-4ubuntu8	11 years ago
92		Enable optimized 64bit elliptic curve code contributed by Go... Enable optimized 64bit elliptic curve code contributed by Google. (LP: #1018522)	Dmitrijs Ledkovs	1.0.1c-4ubuntu7	11 years ago
91		debian/patches/fix_key_decoding_deadlock.patch: Fix possible... debian/patches/fix_key_decoding_deadlock.patch: Fix possible deadlock when decoding public keys. (LP: #1066032)	Marc Deslauriers	1.0.1c-4ubuntu6	11 years ago
90		* REGRESSION FIX: decryption errors on AES-NI hardware (LP: ... * REGRESSION FIX: decryption errors on AES-NI hardware (LP: #1134873,   LP: #1133333)   - debian/patches/CVE-2013-0169.patch: disabled for now until fix is     available from upstream.	Marc Deslauriers	1.0.1c-4ubuntu5	11 years ago

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1