diff -Nru libcrypto++-5.6.1/debian/changelog libcrypto++-5.6.1/debian/changelog --- libcrypto++-5.6.1/debian/changelog 2012-04-14 18:43:41.000000000 +0000 +++ libcrypto++-5.6.1/debian/changelog 2015-06-30 05:37:20.000000000 +0000 @@ -1,3 +1,17 @@ +libcrypto++ (5.6.1-6+deb8u1build0.15.04.1) vivid-security; urgency=medium + + * fake sync from Debian + + -- Steve Beattie Mon, 29 Jun 2015 22:37:20 -0700 + +libcrypto++ (5.6.1-6+deb8u1) jessie-security; urgency=high + + * Fix CVE-2015-2141, misuse of blinding technique that is aimed at + preventing timing attacks. + * Update my email address. + + -- Laszlo Boszormenyi (GCS) Sun, 28 Jun 2015 13:35:45 +0000 + libcrypto++ (5.6.1-6) unstable; urgency=low * Fix build failure with gcc-4.7 (closes: #668700) by adding missing 'this' diff -Nru libcrypto++-5.6.1/debian/control libcrypto++-5.6.1/debian/control --- libcrypto++-5.6.1/debian/control 2012-04-14 18:38:03.000000000 +0000 +++ libcrypto++-5.6.1/debian/control 2015-06-28 13:37:04.000000000 +0000 @@ -1,7 +1,7 @@ Source: libcrypto++ Section: libs Priority: optional -Maintainer: Laszlo Boszormenyi (GCS) +Maintainer: Laszlo Boszormenyi (GCS) Standards-Version: 3.9.3 Build-Depends: debhelper (>= 8), dpkg (>= 1.15.5.6), automake, autoconf, libtool Build-Depends-Indep: doxygen diff -Nru libcrypto++-5.6.1/debian/patches/CVE-2015-2141.patch libcrypto++-5.6.1/debian/patches/CVE-2015-2141.patch --- libcrypto++-5.6.1/debian/patches/CVE-2015-2141.patch 1970-01-01 00:00:00.000000000 +0000 +++ libcrypto++-5.6.1/debian/patches/CVE-2015-2141.patch 2015-06-28 13:37:23.000000000 +0000 @@ -0,0 +1,32 @@ +From 9425e16437439e68c7d96abef922167d68fafaff Mon Sep 17 00:00:00 2001 +From: Jeffrey Walton +Date: Sat, 27 Jun 2015 17:56:01 -0400 +Subject: [PATCH] Fix for CVE-2015-2141. Thanks to Evgeny Sidorov for + reporting. Squaring to satisfy Jacobi requirements suggested by JPM. + +--- + rw.cpp | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/rw.cpp b/rw.cpp +index cdd9f2d..0b9318b 100644 +--- a/rw.cpp ++++ b/rw.cpp +@@ -126,10 +126,16 @@ Integer InvertibleRWFunction::CalculateInverse(RandomNumberGenerator &rng, const + DoQuickSanityCheck(); + ModularArithmetic modn(m_n); + Integer r, rInv; +- do { // do this in a loop for people using small numbers for testing ++ ++ // do this in a loop for people using small numbers for testing ++ do { + r.Randomize(rng, Integer::One(), m_n - Integer::One()); ++ // Fix for CVE-2015-2141. Thanks to Evgeny Sidorov for reporting. ++ // Squaring to satisfy Jacobi requirements suggested by JPM. ++ r = modn.Square(r); + rInv = modn.MultiplicativeInverse(r); + } while (rInv.IsZero()); ++ + Integer re = modn.Square(r); + re = modn.Multiply(re, x); // blind + diff -Nru libcrypto++-5.6.1/debian/patches/series libcrypto++-5.6.1/debian/patches/series --- libcrypto++-5.6.1/debian/patches/series 2012-04-14 18:20:45.000000000 +0000 +++ libcrypto++-5.6.1/debian/patches/series 2015-06-28 13:37:49.000000000 +0000 @@ -6,3 +6,4 @@ panama-armel.diff salsa.patch gcc-4.7-ftbfs.diff +CVE-2015-2141.patch