lp:ubuntu/natty-security/openssl

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

58. By Steve Beattie on 2012-05-22

* SECURITY UPDATE: denial of service attack in DTLS implementation
  - debian/patches/CVE_2012-2333.patch: guard for integer overflow
    before skipping explicit IV
  - CVE-2012-2333
* SECURITY UPDATE: million message attack (MMA) in CMS and PKCS #7
  - debian/patches/CVE-2012-0884.patch: use a random key if RSA
    decryption fails to avoid leaking timing information
  - CVE-2012-0884
* debian/patches/CVE-2012-0884-extra.patch: detect symmetric crypto
  errors in PKCS7_decrypt and initialize tkeylen properly when
  encrypting CMS messages.

57. By Jamie Strandboge on 2012-04-24

* SECURITY UPDATE: incomplete fix for CVE-2012-2110
  - debian/patches/CVE-2012-2131.patch: also verify 'len' in BUF_MEM_grow
    and BUF_MEM_grow_clean is non-negative
  - CVE-2012-2131
* debian/patches/CVE-2012-2110b.patch: Use correct error code in
  BUF_MEM_grow_clean()

56. By Jamie Strandboge on 2012-04-19

* SECURITY UPDATE: NULL pointer dereference in S/MIME messages with broken
  headers
  - debian/patches/CVE-2006-7250+2012-1165.patch: adjust mime_hdr_cmp()
    and mime_param_cmp() to not dereference the compared strings if either
    is NULL
  - CVE-2006-7250
  - CVE-2012-1165
* SECURITY UPDATE: fix various overflows
  - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
    crypto/buffer.c and crypto/mem.c to verify size of lengths
  - CVE-2012-2110

55. By Steve Beattie on 2012-01-31

* SECURITY UPDATE: ECDSA private key timing attack
  - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
    length
  - CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
  - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
    safety
  - CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
  - debian/patches/CVE-2011-4108.patch: perform all computations
    before discarding messages
  - CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
  - debian/patches/CVE-2011-4019.patch: only free domain policyin
    one location
  - CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
  - debian/patches/CVE-2011-4576.patch: clear bytes used for block
    padding of SSL 3.0 records.
  - CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
  - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
    data from triggering an assertion failure
  - CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
  - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
    restart for SSL/TLS.
  - CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
  - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
  - CVE-2012-0050
* debian/libssl0.9.8.postinst: Only issue the reboot notification for
  servers by testing that the X server is not running (LP: #244250)

54. By Artur Rona on 2011-02-13

* Merge from debian unstable. Remaining changes: (LP: #718205)
  - d/libssl0.9.8.postinst:
    + Display a system restart required notification bubble
      on libssl0.9.8 upgrade.
    + Use a different priority for libssl0.9.8/restart-services
      depending on whether a desktop, or server dist-upgrade
      is being performed.
  - d/{libssl0.9.8-udeb.dirs, control, rules}: Create
    libssl0.9.8-udeb, for the benefit of wget-udeb (no wget-udeb
    package in Debian).
  - d/{libcrypto0.9.8-udeb.dirs, libssl0.9.8.dirs, libssl0.9.8.files,
    rules}: Move runtime libraries to /lib, for the benefit of wpasupplicant.
  - d/{control, openssl-doc.docs, openssl.docs, openssl.dirs}:
    + Ship documentation in openssl-doc, suggested by the package.
     (Closes: #470594)
  - d/p/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
  - d/p/Bsymbolic-functions.patch: Link using -Bsymbolic-functions.
  - d/p/perlpath-quilt.patch: Don't change perl #! paths under .pc.
  - d/p/no-sslv2.patch: Disable SSLv2 to match NSS and GnuTLS.
    The protocol is unsafe and extremely deprecated. (Closes: #589706)
  - d/rules:
    + Disable SSLv2 during compile. (Closes: #589706)
    + Don't run 'make test' when cross-building.
    + Use host compiler when cross-building. Patch from Neil Williams.
      (Closes: #465248)
    + Don't build for processors no longer supported: i486, i586
      (on i386), v8 (on sparc).
    + Fix Makefile to properly clean up libs/ dirs in clean target.
      (Closes: #611667)
    + Replace duplicate files in the doc directory with symlinks.
* This upload fixed CVE: (LP: #718208)
  - CVE-2011-0014

53. By Steve Langasek on 2011-01-31

[ Peter Pearse ]
Fix Makefile to properly clean up libs/ dirs in clean target

52. By Artur Rona on 2010-12-23

* Merge from debian unstable. Remaining changes: (LP: #693902)
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions.
  - Use a different priority for libssl0.9.8/restart-services
    depending on whether a desktop, or server dist-upgrade is being
    performed.
  - Display a system restart required notification bubble on libssl0.9.8
    upgrade.
  - Don't build for processors no longer supported: i486, i586
    (on i386), v8 (on sparc).
  - Create libssl0.9.8-udeb, for the benefit of wget-udeb (no
    wget-udeb package in Debian).
  - Replace duplicate files in the doc directory with symlinks.
  - Move runtime libraries to /lib, for the benefit of wpasupplicant.
  - Ship documentation in openssl-doc, suggested by the package.
    (Closes: #470594)
  - Use host compiler when cross-building. Patch from Neil Williams.
    (Closes: #465248).
  - Don't run 'make test' when cross-building.
  - debian/patches/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths
    under .pc.
  - debian/patches/no-sslv2.patch: disable SSLv2 to match NSS
    and GnuTLS. The protocol is unsafe and extremely deprecated.
    (Closes: #589706)

51. By Steve Beattie on 2010-11-18

* Merge from debian unstable (LP: #677756). Remaining changes:
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions (refreshed)
  - Use a different priority for libssl0.9.8/restart-services
    depending on whether a desktop, or server dist-upgrade is being
    performed.
  - Display a system restart required notification bubble on libssl0.9.8
    upgrade.
  - Don't build for processors no longer supported: i486, i586
    (on i386), v8 (on sparc).
  - Create libssl0.9.8-udeb, for the benefit of wget-udeb (no
    wget-udeb package in Debian)
  - Replace duplicate files in the doc directory with symlinks.
  - Move runtime libraries to /lib, for the benefit of wpasupplicant
  - Ship documentation in openssl-doc, suggested by the package.
    (Debian bug 470594)
  - Use host compiler when cross-building (patch from Neil Williams in
    Debian bug 465248).
  - Don't run 'make test' when cross-building.
  - debian/patches/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths
    under .pc.
  - debian/patches/no-sslv2.patch: disable SSLv2 to match NSS
    and GnuTLS. The protocol is unsafe and extremely deprecated.
    (Debian bug 589706)
* Dropped patches, now upstream:
  - debian/patches/CVE-2010-2939.patch (Debian patch is identically
    named)

50. By Steve Beattie on 2010-11-16

* SECURITY UPDATE: TLS race condition leading to a buffer overflow and
  possible code execution. (LP: #676243)
  - patches/debian/openssl-CVE-2010-3864-secadv_20101116-0.9.8.patch:
    stricter NULL/not-NULL checking in ssl/t1_lib.c
  - CVE-2010-3864

49. By Marc Deslauriers on 2010-10-06

* SECURITY UPDATE: denial of service and possible code execution via
  crafted private key with an invalid prime.
  - debian/patches/CVE-2010-2939.patch: set bn_ctx to NULL after freeing
    it in ssl/s3_clnt.c.
  - CVE-2010-2939