openssl 0.9.8a-7ubuntu0.9 source package in Ubuntu

Changelog

openssl (0.9.8a-7ubuntu0.9) dapper-security; urgency=low

  * SECURITY UPDATE: denial of service via memory consumption from large
    number of future epoch DTLS records.
    - crypto/pqueue.*: add new pqueue_size counter function.
    - ssl/d1_pkt.c: use pqueue_size to limit size of queue to 100.
    - http://cvs.openssl.org/chngview?cn=18187
    - CVE-2009-1377
  * SECURITY UPDATE: denial of service via memory consumption from
    duplicate or invalid sequence numbers in DTLS records.
    - ssl/d1_both.c: discard message if it's a duplicate or too far in the
      future.
    - http://marc.info/?l=openssl-dev&m=124263491424212&w=2
    - CVE-2009-1378
  * SECURITY UPDATE: denial of service or other impact via use-after-free
    in dtls1_retrieve_buffered_fragment.
    - ssl/d1_both.c: use temp frag_len instead of freed frag.
    - http://rt.openssl.org/Ticket/Display.html?id=1923
    - CVE-2009-1379
  * SECURITY UPDATE: denial of service via DTLS ChangeCipherSpec packet
    that occurs before ClientHello.
    - ssl/s3_pkt.c: abort if s->session is NULL.
    - ssl/{ssl.h,ssl_err.c}: add new error codes.
    - http://cvs.openssl.org/chngview?cn=17369
    - CVE-2009-1386
  * SECURITY UPDATE: denial of service via an out-of-sequence DTLS
    handshake message.
    - ssl/d1_both.c: don't buffer fragments with no data.
    - http://cvs.openssl.org/chngview?cn=17958
    - CVE-2009-1387

 -- Marc Deslauriers <email address hidden>   Thu, 11 Jun 2009 10:31:47 -0400

Upload details

Uploaded by:
Marc Deslauriers on 2009-06-11
Uploaded to:
Dapper
Original maintainer:
Debian OpenSSL Team
Architectures:
any
Section:
utils
Urgency:
Low Urgency

See full publishing history Publishing

Series Pocket Published Component Section

Downloads

File Size SHA-256 Checksum
openssl_0.9.8a.orig.tar.gz 3.1 MiB 30f8f61fb1316f4fb51410c740b4879b8e26b417c8d870e486144b10b8041c73
openssl_0.9.8a-7ubuntu0.9.diff.gz 52.0 KiB c7f1b398d4d4874efcbdab11c46df98f96948e97bafd5c922ec49e8bbe0f6d6d
openssl_0.9.8a-7ubuntu0.9.dsc 822 bytes b1d74c8aca814a36fec82a53433173962d5835c54bd82b36a7f2d7fdb4490a56

View changes file

Binary packages built by this source

libcrypto0.9.8-udeb: No summary available for libcrypto0.9.8-udeb in ubuntu dapper.

No description available for libcrypto0.9.8-udeb in ubuntu dapper.

libssl-dev: No summary available for libssl-dev in ubuntu dapper.

No description available for libssl-dev in ubuntu dapper.

libssl0.9.8: No summary available for libssl0.9.8 in ubuntu dapper.

No description available for libssl0.9.8 in ubuntu dapper.

libssl0.9.8-dbg: No summary available for libssl0.9.8-dbg in ubuntu dapper.

No description available for libssl0.9.8-dbg in ubuntu dapper.

openssl: No summary available for openssl in ubuntu dapper.

No description available for openssl in ubuntu dapper.