openssl 0.9.8o-1ubuntu4.6 source package in Ubuntu


openssl (0.9.8o-1ubuntu4.6) maverick-security; urgency=low

  * SECURITY UPDATE: ECDSA private key timing attack
    - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
    - CVE-2011-1945
  * SECURITY UPDATE: ECDH ciphersuite denial of service
    - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
    - CVE-2011-3210
  * SECURITY UPDATE: DTLS plaintext recovery attack
    - debian/patches/CVE-2011-4108.patch: perform all computations
      before discarding messages
    - CVE-2011-4108
  * SECURITY UPDATE: policy check double free vulnerability
    - debian/patches/CVE-2011-4019.patch: only free domain policyin
      one location
    - CVE-2011-4019
  * SECURITY UPDATE: SSL 3.0 block padding exposure
    - debian/patches/CVE-2011-4576.patch: clear bytes used for block
      padding of SSL 3.0 records.
    - CVE-2011-4576
  * SECURITY UPDATE: malformed RFC 3779 data denial of service attack
    - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
      data from triggering an assertion failure
    - CVE-2011-4577
  * SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
    - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
      restart for SSL/TLS.
    - CVE-2011-4619
  * SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
    - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
    - CVE-2012-0050
  * debian/patches/openssl-fix_ECDSA_tests.patch: fix ECDSA tests
  * debian/libssl0.9.8.postinst: Only issue the reboot notification for
    servers by testing that the X server is not running (LP: #244250)
 -- Steve Beattie <email address hidden>   Tue, 31 Jan 2012 01:37:33 -0800

Upload details

Uploaded by:
Steve Beattie on 2012-01-31
Uploaded to:
Original maintainer:
Ubuntu Developers
Low Urgency

See full publishing history Publishing

Series Pocket Published Component Section


File Size MD5 Checksum
openssl_0.9.8o.orig.tar.gz 3.6 MiB 63ddc5116488985e820075e65fbe6aa4
openssl_0.9.8o-1ubuntu4.6.debian.tar.gz 99.2 KiB 04704de6f164eca11dbb7f5f0a312699
openssl_0.9.8o-1ubuntu4.6.dsc 2.1 KiB 7cefbd198bfdf1abeb158a70e24f31a4

View changes file

Binary packages built by this source

libcrypto0.9.8-udeb: crypto shared library - udeb

 libcrypto shared library.
 Do not install it on a normal system.

libssl-dev: SSL development libraries, header files and documentation

 libssl and libcrypto development libraries, header files and manpages.
 It is part of the OpenSSL implementation of SSL.

libssl0.9.8: SSL shared libraries

 libssl and libcrypto shared libraries needed by programs like
 apache-ssl, telnet-ssl and openssh.
 It is part of the OpenSSL implementation of SSL.

libssl0.9.8-dbg: Symbol tables for libssl and libcrypto

 This package is part of the OpenSSL implementation of SSL.

libssl0.9.8-udeb: ssl shared library - udeb

 libssl shared library.
 Do not install it on a normal system.

openssl: Secure Socket Layer (SSL) binary and related cryptographic tools

 This package contains the openssl binary and related tools.
 It is part of the OpenSSL implementation of SSL.
 You need it to perform certain cryptographic actions like:
  - Creation of RSA, DH and DSA key parameters;
  - Creation of X.509 certificates, CSRs and CRLs;
  - Calculation of message digests;
  - Encryption and decryption with ciphers;
  - SSL/TLS client and server tests;
  - Handling of S/MIME signed or encrypted mail.

openssl-doc: Secure Socket Layer (SSL) documentation

 This package contains the OpenSSL documentation.
 It is part of the OpenSSL implementation of SSL.