lp:ubuntu/maverick-security/openssl
- Get this branch:
- bzr branch lp:ubuntu/maverick-security/openssl
Branch merges
Branch information
Recent revisions
- 53. By Steve Beattie
-
* SECURITY UPDATE: ECDSA private key timing attack
- debian/patches/ CVE-2011- 1945.patch: compute with fixed scalar
length
- CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
- debian/patches/ CVE-2011- 3210.patch: fix memory usage for thread
safety
- CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
- debian/patches/ CVE-2011- 4108.patch: perform all computations
before discarding messages
- CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
- debian/patches/ CVE-2011- 4019.patch: only free domain policyin
one location
- CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
- debian/patches/ CVE-2011- 4576.patch: clear bytes used for block
padding of SSL 3.0 records.
- CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
- debian/patches/ CVE-2011- 4577.patch: prevent malformed RFC3779
data from triggering an assertion failure
- CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
- debian/patches/ CVE-2011- 4619.patch: Only allow one SGC handshake
restart for SSL/TLS.
- CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
- debian/patches/ CVE-2012- 0050.patch: improve handling of DTLS MAC
- CVE-2012-0050
* debian/patches/ openssl- fix_ECDSA_ tests.patch: fix ECDSA tests
* debian/libssl0. 9.8.postinst: Only issue the reboot notification for
servers by testing that the X server is not running (LP: #244250) - 52. By Steve Beattie
-
* SECURITY UPDATE: OCSP stapling vulnerability
- debian/patched/ openssl- CVE-2011- 0014-secadv_ 20110208. patch:
stricter parsing of ClientHello message in ssl/t1_lib.c
- CVE-2011-0014 - 51. By Steve Beattie
-
* SECURITY UPDATE: ciphersuite downgrade vulnerability
- openssl-CVE-2010- 4180-secadv_ 20101202- 0.9.8.patch:
disable workaround for Netscape cipher suite bug in ssl/s3_clnt.c
and ssl/s3_srvr.c
- CVE-2010-4180 - 50. By Steve Beattie
-
* SECURITY UPDATE: TLS race condition leading to a buffer overflow and
possible code execution. (LP: #676243)
- patches/debian/ openssl- CVE-2010- 3864-secadv_ 20101116- 0.9.8.patch:
stricter NULL/not-NULL checking in ssl/t1_lib.c
- CVE-2010-3864 - 49. By Marc Deslauriers
-
* SECURITY UPDATE: denial of service and possible code execution via
crafted private key with an invalid prime.
- debian/patches/ CVE-2010- 2939.patch: set bn_ctx to NULL after freeing
it in ssl/s3_clnt.c.
- CVE-2010-2939 - 47. By Colin Watson
-
Update AES-NI patch to openssl-
0.9.8-aesni- modes-perlasm- win32-v4. patch
from http://rt.openssl. org/Ticket/ Display. html?id= 2067, fixing segfault
on engine initialisation (LP: #590639). - 46. By Kees Cook
-
debian/
patches/ no-sslv2. patch: disable SSLv2 to match NSS and GnuTLS.
The protocol is unsafe and extremely deprecated. (Debian bug 589706) - 45. By Matthias Klose
-
* Don't build anymore for processors not supported anymore in maverick:
- i486, i586 (on i386).
- v8 (on sparc). - 44. By Marc Deslauriers
-
* Merge from debian unstable, remaining changes (LP: #581167):
- debian/patches/ Bsymbolic- functions. patch: Link using
-Bsymbolic-functions
- Ship documentation in openssl-doc, suggested by the package.
- Use a different priority for libssl0.9.8/restart- services
depending on whether a desktop, or server dist-upgrade is being
performed.
- Display a system restart required notification bubble on libssl0.9.8
upgrade.
- Replace duplicate files in the doc directory with symlinks.
- Move runtime libraries to /lib, for the benefit of wpasupplicant
- Use host compiler when cross-building (patch from Neil Williams in
Debian #465248).
- Don't run 'make test' when cross-building.
- Create libssl0.9.8-udeb, for the benefit of wget-udeb (LP: #503339).
- debian/patches/ aesni.patch: Backport Intel AES-NI support from
http://rt.openssl. org/Ticket/ Display. html?id= 2067 (LP: #485518).
- debian/patches/ perlpath- quilt.patch: Don't change perl #! paths
under .pc.
* Dropped patches, now upstream:
- debian/patches/ CVE-2009- 3245.patch
- debian/patches/ CVE-2010- 0740.patch
- debian/patches/ dtls-compatibil ity.patch
- debian/patches/ CVE-2009- 4355.patch
* Dropped "Add support for lpia".
* Dropped "Disable SSLv2 during compile" as this had never actually
disabled SSLv2.
* Don't disable CVE-2009-3555.patch for Maverick.
Branch metadata
- Branch format:
- Branch format 7
- Repository format:
- Bazaar repository format 2a (needs bzr 1.16 or later)
- Stacked on:
- lp:ubuntu/maverick/openssl