openssl098 0.9.8o-7ubuntu3.1 source package in Ubuntu

Changelog

openssl098 (0.9.8o-7ubuntu3.1) precise-security; urgency=low

  * Bring up to date with latest security patches from Ubuntu 11.04:
    * SECURITY UPDATE: ECDSA private key timing attack
    - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
      length
    - CVE-2011-1945
  * SECURITY UPDATE: ECDH ciphersuite denial of service
    - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
      safety
    - CVE-2011-3210
  * SECURITY UPDATE: DTLS plaintext recovery attack
    - debian/patches/CVE-2011-4108.patch: perform all computations
      before discarding messages
    - CVE-2011-4108
  * SECURITY UPDATE: policy check double free vulnerability
    - debian/patches/CVE-2011-4019.patch: only free domain policyin
      one location
    - CVE-2011-4019
  * SECURITY UPDATE: SSL 3.0 block padding exposure
    - debian/patches/CVE-2011-4576.patch: clear bytes used for block
      padding of SSL 3.0 records.
    - CVE-2011-4576
  * SECURITY UPDATE: malformed RFC 3779 data denial of service attack
    - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
      data from triggering an assertion failure
    - CVE-2011-4577
  * SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
    - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
      restart for SSL/TLS.
    - CVE-2011-4619
  * SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
    - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
    - CVE-2012-0050
  * SECURITY UPDATE: NULL pointer dereference in S/MIME messages with broken
    headers
    - debian/patches/CVE-2006-7250+2012-1165.patch: adjust mime_hdr_cmp()
      and mime_param_cmp() to not dereference the compared strings if either
      is NULL
    - CVE-2006-7250
    - CVE-2012-1165
  * SECURITY UPDATE: fix various overflows
    - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
      crypto/buffer.c and crypto/mem.c to verify size of lengths
    - CVE-2012-2110
  * SECURITY UPDATE: incomplete fix for CVE-2012-2110
    - debian/patches/CVE-2012-2131.patch: also verify 'len' in BUF_MEM_grow
      and BUF_MEM_grow_clean is non-negative
    - CVE-2012-2131
  * debian/patches/CVE-2012-2110b.patch: Use correct error code in
    BUF_MEM_grow_clean()
 -- Jamie Strandboge <email address hidden>   Tue, 24 Apr 2012 10:06:47 -0500

Upload details

Uploaded by:
Jamie Strandboge
Uploaded to:
Precise
Original maintainer:
Ubuntu Developers
Architectures:
any
Section:
utils
Urgency:
Low Urgency

See full publishing history Publishing

Series Pocket Published Component Section
Trusty release universe utils

Downloads

File Size SHA-256 Checksum
openssl098_0.9.8o.orig.tar.gz 3.6 MiB befada1ac3819b1d317df8197b5e82ec768b39d250fcbef81e2b1cb7f165d448
openssl098_0.9.8o-7ubuntu3.1.debian.tar.gz 98.5 KiB a2b8061e2924b414dd5fa9ecd572c94b3269657f8b9c3e029491f25100a27f0b
openssl098_0.9.8o-7ubuntu3.1.dsc 2.2 KiB e58b4e2c5712fa5a529ee0368a069a8a1afb25bdd7491fbe634c1baf32541578

View changes file

Binary packages built by this source

libcrypto0.9.8-udeb: No summary available for libcrypto0.9.8-udeb in ubuntu raring.

No description available for libcrypto0.9.8-udeb in ubuntu raring.

libssl0.9.8: No summary available for libssl0.9.8 in ubuntu utopic.

No description available for libssl0.9.8 in ubuntu utopic.

libssl0.9.8-dbg: No summary available for libssl0.9.8-dbg in ubuntu quantal.

No description available for libssl0.9.8-dbg in ubuntu quantal.