Format: 1.8 Date: Thu, 22 Sep 2016 13:38:15 -0400 Source: openssl Binary: openssl libssl1.0.0 libcrypto1.0.0-udeb libssl1.0.0-udeb libssl-dev libssl-doc libssl1.0.0-dbg Architecture: amd64 amd64_translations Version: 1.0.1f-1ubuntu2.20 Distribution: trusty Urgency: medium Maintainer: Launchpad Build Daemon Changed-By: Marc Deslauriers Description: libcrypto1.0.0-udeb - Secure Sockets Layer toolkit - libcrypto udeb (udeb) libssl-dev - Secure Sockets Layer toolkit - development files libssl-doc - Secure Sockets Layer toolkit - development documentation libssl1.0.0 - Secure Sockets Layer toolkit - shared libraries libssl1.0.0-dbg - Secure Sockets Layer toolkit - debug information libssl1.0.0-udeb - ssl shared library - udeb (udeb) openssl - Secure Sockets Layer toolkit - cryptographic utility Launchpad-Bugs-Fixed: 1622500 Changes: openssl (1.0.1f-1ubuntu2.20) trusty-security; urgency=medium . * SECURITY UPDATE: Constant time flag not preserved in DSA signing - debian/patches/CVE-2016-2178-*.patch: preserve BN_FLG_CONSTTIME in crypto/dsa/dsa_ossl.c. - CVE-2016-2178 * SECURITY UPDATE: DTLS buffered message DoS - debian/patches/CVE-2016-2179.patch: fix queue handling in ssl/d1_both.c, ssl/d1_clnt.c, ssl/d1_lib.c, ssl/d1_srvr.c, ssl/ssl_locl.h. - CVE-2016-2179 * SECURITY UPDATE: OOB read in TS_OBJ_print_bio() - debian/patches/CVE-2016-2180.patch: fix text handling in crypto/ts/ts_lib.c. - CVE-2016-2180 * SECURITY UPDATE: DTLS replay protection DoS - debian/patches/CVE-2016-2181-1.patch: properly handle unprocessed records in ssl/d1_pkt.c. - debian/patches/CVE-2016-2181-2.patch: protect against replay attacks in ssl/d1_pkt.c, ssl/ssl.h, ssl/ssl_err.c. - debian/patches/CVE-2016-2181-3.patch: update error code in ssl/ssl.h. - CVE-2016-2181 * SECURITY UPDATE: OOB write in BN_bn2dec() - debian/patches/CVE-2016-2182.patch: don't overflow buffer in crypto/bn/bn_print.c. - CVE-2016-2182 * SECURITY UPDATE: SWEET32 Mitigation - debian/patches/CVE-2016-2183.patch: move DES ciphersuites from HIGH to MEDIUM in ssl/s3_lib.c. - CVE-2016-2183 * SECURITY UPDATE: Malformed SHA512 ticket DoS - debian/patches/CVE-2016-6302.patch: sanity check ticket length in ssl/t1_lib.c. - CVE-2016-6302 * SECURITY UPDATE: OOB write in MDC2_Update() - debian/patches/CVE-2016-6303.patch: avoid overflow in crypto/mdc2/mdc2dgst.c. - CVE-2016-6303 * SECURITY UPDATE: OCSP Status Request extension unbounded memory growth - debian/patches/CVE-2016-6304.patch: remove OCSP_RESPIDs from previous handshake in ssl/t1_lib.c. - CVE-2016-6304 * SECURITY UPDATE: Certificate message OOB reads - debian/patches/CVE-2016-6306-1.patch: check lengths in ssl/s3_clnt.c, ssl/s3_srvr.c. - debian/patches/CVE-2016-6306-2.patch: make message buffer slightly larger in ssl/d1_both.c, ssl/s3_both.c. - CVE-2016-6306 * SECURITY REGRESSION: DTLS regression (LP: #1622500) - debian/patches/CVE-2014-3571-3.patch: make DTLS always act as if read_ahead is set in ssl/s3_pkt.c. * debian/patches/update-expired-smime-test-certs.patch: Update test certificates that have expired and caused build test failures. Checksums-Sha1: 9d5431e947ed2ed0a4f284518f4bf7a19337cd6b 489232 openssl_1.0.1f-1ubuntu2.20_amd64.deb c9fe0bb5ab436638ed8c175261f9835b822aa07c 830240 libssl1.0.0_1.0.1f-1ubuntu2.20_amd64.deb ec13fd4152adb9fbdd387f661e84ea155a1c8461 616654 libcrypto1.0.0-udeb_1.0.1f-1ubuntu2.20_amd64.udeb 29650847507b7caff31acf97ae608e1be2b3da8c 124606 libssl1.0.0-udeb_1.0.1f-1ubuntu2.20_amd64.udeb af012100dc8d78ce6a3462c69d5c36c016db55d5 1073832 libssl-dev_1.0.1f-1ubuntu2.20_amd64.deb f46e32f96dd2cd14f7e5a14b655d2df17dfcf198 2661216 libssl1.0.0-dbg_1.0.1f-1ubuntu2.20_amd64.deb 48de4624a8e7715b526a0d4f066de78b427786ce 1062 openssl-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 60038289191ab1df5663eb8df2792503f6ba89f5 900 libssl1.0.0-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 0d62e681add2119aca4f93220cc52d04593b1145 932 libcrypto1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 1b2c8b89097344f92f4ce461f472e764551419ca 818 libssl1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 1626751832875956ff899a45fd46c1b98c5979fd 922 libssl-dev-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 6ab1db8b91668e19071bb2daab88b566cd7336c0 20399 openssl_1.0.1f-1ubuntu2.20_amd64_translations.tar.gz Checksums-Sha256: 48b85b2deed4b8dd38bb2247c49a14a03d36c0ea8f70b8620cad7a0076a06094 489232 openssl_1.0.1f-1ubuntu2.20_amd64.deb 1097c42e9184fe61c24f4c973a6bb5f8cae0bcb2ec3c4ecd936342f647ac8a73 830240 libssl1.0.0_1.0.1f-1ubuntu2.20_amd64.deb 307556ee82ca3a22aac0e6682630fb6aa54a61f70b8267c21183b12dea3013a3 616654 libcrypto1.0.0-udeb_1.0.1f-1ubuntu2.20_amd64.udeb 06f7fd997cdb2dc6d9e04882f027e94fea9ea1cb39f1c2af0e65aec36720cdfb 124606 libssl1.0.0-udeb_1.0.1f-1ubuntu2.20_amd64.udeb e585059f602713355abb9cde3ccd8bd1df6b7ef722749ad6c2731d43ce335c70 1073832 libssl-dev_1.0.1f-1ubuntu2.20_amd64.deb 430b1cc3649f88f014933c0e0ea12c4819670b1b562356dd611ce2a40ba75aa5 2661216 libssl1.0.0-dbg_1.0.1f-1ubuntu2.20_amd64.deb 4e74e7fd8a84b27d1cd25309320c2e29a6e649ad8a06015d50c9a5ee281dd07a 1062 openssl-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 1ec88ebaf4b5b8f9be5318c8e7209c918e6880e8dafb6bf63ec1f27b847b91f2 900 libssl1.0.0-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 3e734d56a69f456d1fee38890fe3501379a05a2d26b82feae95a85c014a288fa 932 libcrypto1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb c7de7a3e5c4888be9bd6343fdd0f00ca72c03dcb86eaee276078eab25cce8750 818 libssl1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb f24ffda377de1a5bae4854c82aa07e9663296c407e1391574e1c7c5aab306ecb 922 libssl-dev-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 61f259a3cf0763411be835bdd60e7117d0f84cc0b28bb7ba108abddb66a6bb10 20399 openssl_1.0.1f-1ubuntu2.20_amd64_translations.tar.gz Files: 9938dea30afad43991c8665a16833169 489232 utils optional openssl_1.0.1f-1ubuntu2.20_amd64.deb bd19616672a6f3e17f914976dfcf71df 830240 libs important libssl1.0.0_1.0.1f-1ubuntu2.20_amd64.deb f16eb358079e02347b4c34e3a14bf62a 616654 debian-installer optional libcrypto1.0.0-udeb_1.0.1f-1ubuntu2.20_amd64.udeb 62bf0c903cebec4140c67f1ba30c3047 124606 debian-installer optional libssl1.0.0-udeb_1.0.1f-1ubuntu2.20_amd64.udeb e5513f53a2982ef8dca5d67721af8eaf 1073832 libdevel optional libssl-dev_1.0.1f-1ubuntu2.20_amd64.deb 75e5116f801cf9fac30c9d6e3491eec6 2661216 debug extra libssl1.0.0-dbg_1.0.1f-1ubuntu2.20_amd64.deb af97b1387effced8cfa51198990b5a49 1062 utils extra openssl-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 8b73e22d55ca63a35b15e697ac1a8a0f 900 libs extra libssl1.0.0-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 995341f538e06685c23d166d1ceeb392 932 debian-installer extra libcrypto1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb c70ce2b0e26d8b94b560945b1b576c4f 818 debian-installer extra libssl1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb ac3a05e06c6d08e9aceba173c8f02379 922 libdevel extra libssl-dev-dbgsym_1.0.1f-1ubuntu2.20_amd64.ddeb 5e29683f19b028c5ac6f5a050060c7ea 20399 raw-translations - openssl_1.0.1f-1ubuntu2.20_amd64_translations.tar.gz Original-Maintainer: Debian OpenSSL Team Package-Type: udeb