openssl098 0.9.8o-7ubuntu3.1 source package in Ubuntu


openssl098 (0.9.8o-7ubuntu3.1) precise-security; urgency=low

  * Bring up to date with latest security patches from Ubuntu 11.04:
    * SECURITY UPDATE: ECDSA private key timing attack
    - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
    - CVE-2011-1945
  * SECURITY UPDATE: ECDH ciphersuite denial of service
    - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
    - CVE-2011-3210
  * SECURITY UPDATE: DTLS plaintext recovery attack
    - debian/patches/CVE-2011-4108.patch: perform all computations
      before discarding messages
    - CVE-2011-4108
  * SECURITY UPDATE: policy check double free vulnerability
    - debian/patches/CVE-2011-4019.patch: only free domain policyin
      one location
    - CVE-2011-4019
  * SECURITY UPDATE: SSL 3.0 block padding exposure
    - debian/patches/CVE-2011-4576.patch: clear bytes used for block
      padding of SSL 3.0 records.
    - CVE-2011-4576
  * SECURITY UPDATE: malformed RFC 3779 data denial of service attack
    - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
      data from triggering an assertion failure
    - CVE-2011-4577
  * SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
    - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
      restart for SSL/TLS.
    - CVE-2011-4619
  * SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
    - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
    - CVE-2012-0050
  * SECURITY UPDATE: NULL pointer dereference in S/MIME messages with broken
    - debian/patches/CVE-2006-7250+2012-1165.patch: adjust mime_hdr_cmp()
      and mime_param_cmp() to not dereference the compared strings if either
      is NULL
    - CVE-2006-7250
    - CVE-2012-1165
  * SECURITY UPDATE: fix various overflows
    - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
      crypto/buffer.c and crypto/mem.c to verify size of lengths
    - CVE-2012-2110
  * SECURITY UPDATE: incomplete fix for CVE-2012-2110
    - debian/patches/CVE-2012-2131.patch: also verify 'len' in BUF_MEM_grow
      and BUF_MEM_grow_clean is non-negative
    - CVE-2012-2131
  * debian/patches/CVE-2012-2110b.patch: Use correct error code in
 -- Jamie Strandboge <email address hidden>   Tue, 24 Apr 2012 10:06:47 -0500

Upload details

Uploaded by:
Jamie Strandboge on 2012-04-24
Uploaded to:
Original maintainer:
Ubuntu Developers
Low Urgency

See full publishing history Publishing

Series Pocket Published Component Section
Trusty release on 2013-10-18 universe utils
Saucy release on 2013-04-25 universe utils
Quantal updates on 2012-11-07 universe utils
Quantal security on 2012-11-07 universe utils
Raring release on 2012-11-06 universe utils


File Size MD5 Checksum
openssl098_0.9.8o.orig.tar.gz 3.6 MiB 63ddc5116488985e820075e65fbe6aa4
openssl098_0.9.8o-7ubuntu3.1.debian.tar.gz 98.5 KiB 48b6261ab924673d73e16fb963c3628d
openssl098_0.9.8o-7ubuntu3.1.dsc 2.2 KiB 0df4c348f111a568538658c8bccb45e9

View changes file

Binary packages built by this source

libcrypto0.9.8-udeb: crypto shared library - udeb

 libcrypto shared library.
 Do not install it on a normal system.

libssl0.9.8: SSL shared libraries

 libssl and libcrypto shared libraries needed by programs like
 apache-ssl, telnet-ssl and openssh.
 It is part of the OpenSSL implementation of SSL.

libssl0.9.8-dbg: Symbol tables for libssl and libcrypto

 This package is part of the OpenSSL implementation of SSL.