lp:ubuntu/natty-security/openssl

Created by Ubuntu Package Importer and last modified
Get this branch:
bzr branch lp:ubuntu/natty-security/openssl
Members of Ubuntu branches can upload to this branch. Log in for directions.

Branch merges

Related bugs

Related blueprints

Branch information

Owner:
Ubuntu branches
Review team:
Ubuntu Development Team
Status:
Mature

Recent revisions

58. By Steve Beattie

* SECURITY UPDATE: denial of service attack in DTLS implementation
  - debian/patches/CVE_2012-2333.patch: guard for integer overflow
    before skipping explicit IV
  - CVE-2012-2333
* SECURITY UPDATE: million message attack (MMA) in CMS and PKCS #7
  - debian/patches/CVE-2012-0884.patch: use a random key if RSA
    decryption fails to avoid leaking timing information
  - CVE-2012-0884
* debian/patches/CVE-2012-0884-extra.patch: detect symmetric crypto
  errors in PKCS7_decrypt and initialize tkeylen properly when
  encrypting CMS messages.

57. By Jamie Strandboge

* SECURITY UPDATE: incomplete fix for CVE-2012-2110
  - debian/patches/CVE-2012-2131.patch: also verify 'len' in BUF_MEM_grow
    and BUF_MEM_grow_clean is non-negative
  - CVE-2012-2131
* debian/patches/CVE-2012-2110b.patch: Use correct error code in
  BUF_MEM_grow_clean()

56. By Jamie Strandboge

* SECURITY UPDATE: NULL pointer dereference in S/MIME messages with broken
  headers
  - debian/patches/CVE-2006-7250+2012-1165.patch: adjust mime_hdr_cmp()
    and mime_param_cmp() to not dereference the compared strings if either
    is NULL
  - CVE-2006-7250
  - CVE-2012-1165
* SECURITY UPDATE: fix various overflows
  - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
    crypto/buffer.c and crypto/mem.c to verify size of lengths
  - CVE-2012-2110

55. By Steve Beattie

* SECURITY UPDATE: ECDSA private key timing attack
  - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
    length
  - CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
  - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
    safety
  - CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
  - debian/patches/CVE-2011-4108.patch: perform all computations
    before discarding messages
  - CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
  - debian/patches/CVE-2011-4019.patch: only free domain policyin
    one location
  - CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
  - debian/patches/CVE-2011-4576.patch: clear bytes used for block
    padding of SSL 3.0 records.
  - CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
  - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
    data from triggering an assertion failure
  - CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
  - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
    restart for SSL/TLS.
  - CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
  - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
  - CVE-2012-0050
* debian/libssl0.9.8.postinst: Only issue the reboot notification for
  servers by testing that the X server is not running (LP: #244250)

54. By Artur Rona

* Merge from debian unstable. Remaining changes: (LP: #718205)
  - d/libssl0.9.8.postinst:
    + Display a system restart required notification bubble
      on libssl0.9.8 upgrade.
    + Use a different priority for libssl0.9.8/restart-services
      depending on whether a desktop, or server dist-upgrade
      is being performed.
  - d/{libssl0.9.8-udeb.dirs, control, rules}: Create
    libssl0.9.8-udeb, for the benefit of wget-udeb (no wget-udeb
    package in Debian).
  - d/{libcrypto0.9.8-udeb.dirs, libssl0.9.8.dirs, libssl0.9.8.files,
    rules}: Move runtime libraries to /lib, for the benefit of wpasupplicant.
  - d/{control, openssl-doc.docs, openssl.docs, openssl.dirs}:
    + Ship documentation in openssl-doc, suggested by the package.
     (Closes: #470594)
  - d/p/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
  - d/p/Bsymbolic-functions.patch: Link using -Bsymbolic-functions.
  - d/p/perlpath-quilt.patch: Don't change perl #! paths under .pc.
  - d/p/no-sslv2.patch: Disable SSLv2 to match NSS and GnuTLS.
    The protocol is unsafe and extremely deprecated. (Closes: #589706)
  - d/rules:
    + Disable SSLv2 during compile. (Closes: #589706)
    + Don't run 'make test' when cross-building.
    + Use host compiler when cross-building. Patch from Neil Williams.
      (Closes: #465248)
    + Don't build for processors no longer supported: i486, i586
      (on i386), v8 (on sparc).
    + Fix Makefile to properly clean up libs/ dirs in clean target.
      (Closes: #611667)
    + Replace duplicate files in the doc directory with symlinks.
* This upload fixed CVE: (LP: #718208)
  - CVE-2011-0014

53. By Steve Langasek

[ Peter Pearse ]
Fix Makefile to properly clean up libs/ dirs in clean target

52. By Artur Rona

* Merge from debian unstable. Remaining changes: (LP: #693902)
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions.
  - Use a different priority for libssl0.9.8/restart-services
    depending on whether a desktop, or server dist-upgrade is being
    performed.
  - Display a system restart required notification bubble on libssl0.9.8
    upgrade.
  - Don't build for processors no longer supported: i486, i586
    (on i386), v8 (on sparc).
  - Create libssl0.9.8-udeb, for the benefit of wget-udeb (no
    wget-udeb package in Debian).
  - Replace duplicate files in the doc directory with symlinks.
  - Move runtime libraries to /lib, for the benefit of wpasupplicant.
  - Ship documentation in openssl-doc, suggested by the package.
    (Closes: #470594)
  - Use host compiler when cross-building. Patch from Neil Williams.
    (Closes: #465248).
  - Don't run 'make test' when cross-building.
  - debian/patches/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths
    under .pc.
  - debian/patches/no-sslv2.patch: disable SSLv2 to match NSS
    and GnuTLS. The protocol is unsafe and extremely deprecated.
    (Closes: #589706)

51. By Steve Beattie

* Merge from debian unstable (LP: #677756). Remaining changes:
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions (refreshed)
  - Use a different priority for libssl0.9.8/restart-services
    depending on whether a desktop, or server dist-upgrade is being
    performed.
  - Display a system restart required notification bubble on libssl0.9.8
    upgrade.
  - Don't build for processors no longer supported: i486, i586
    (on i386), v8 (on sparc).
  - Create libssl0.9.8-udeb, for the benefit of wget-udeb (no
    wget-udeb package in Debian)
  - Replace duplicate files in the doc directory with symlinks.
  - Move runtime libraries to /lib, for the benefit of wpasupplicant
  - Ship documentation in openssl-doc, suggested by the package.
    (Debian bug 470594)
  - Use host compiler when cross-building (patch from Neil Williams in
    Debian bug 465248).
  - Don't run 'make test' when cross-building.
  - debian/patches/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths
    under .pc.
  - debian/patches/no-sslv2.patch: disable SSLv2 to match NSS
    and GnuTLS. The protocol is unsafe and extremely deprecated.
    (Debian bug 589706)
* Dropped patches, now upstream:
  - debian/patches/CVE-2010-2939.patch (Debian patch is identically
    named)

50. By Steve Beattie

* SECURITY UPDATE: TLS race condition leading to a buffer overflow and
  possible code execution. (LP: #676243)
  - patches/debian/openssl-CVE-2010-3864-secadv_20101116-0.9.8.patch:
    stricter NULL/not-NULL checking in ssl/t1_lib.c
  - CVE-2010-3864

49. By Marc Deslauriers

* SECURITY UPDATE: denial of service and possible code execution via
  crafted private key with an invalid prime.
  - debian/patches/CVE-2010-2939.patch: set bn_ctx to NULL after freeing
    it in ssl/s3_clnt.c.
  - CVE-2010-2939

Branch metadata

Branch format:
Branch format 7
Repository format:
Bazaar repository format 2a (needs bzr 1.16 or later)
Stacked on:
lp:ubuntu/precise/openssl
This branch contains Public information 
Everyone can see this information.

Subscribers