Format: 1.8 Date: Thu, 11 Jun 2015 07:12:10 -0400 Source: openssl Binary: openssl libssl1.0.0 libcrypto1.0.0-udeb libssl1.0.0-udeb libssl-dev libssl-doc libssl1.0.0-dbg Architecture: amd64 amd64_translations Version: 1.0.1f-1ubuntu9.8 Distribution: utopic Urgency: medium Maintainer: Ubuntu/amd64 Build Daemon Changed-By: Marc Deslauriers Description: libcrypto1.0.0-udeb - Secure Sockets Layer toolkit - libcrypto udeb (udeb) libssl-dev - Secure Sockets Layer toolkit - development files libssl-doc - Secure Sockets Layer toolkit - development documentation libssl1.0.0 - Secure Sockets Layer toolkit - shared libraries libssl1.0.0-dbg - Secure Sockets Layer toolkit - debug information libssl1.0.0-udeb - ssl shared library - udeb (udeb) openssl - Secure Sockets Layer toolkit - cryptographic utility Changes: openssl (1.0.1f-1ubuntu9.8) utopic-security; urgency=medium . * SECURITY IMPROVEMENT: reject dh keys smaller than 768 bits - debian/patches/reject_small_dh.patch: reject small dh keys in ssl/s3_clnt.c, ssl/ssl.h, ssl/ssl_err.c, update documentation in doc/ssl/SSL_CTX_set_tmp_dh_callback.pod, make s_server use 2048-bit dh in apps/s_server.c, clarify docs in doc/apps/dhparam.pod. * SECURITY UPDATE: denial of service and possible code execution via invalid free in DTLS - debian/patches/CVE-2014-8176.patch: fix invalid free in ssl/d1_lib.c. - CVE-2014-8176 * SECURITY UPDATE: denial of service via malformed ECParameters - debian/patches/CVE-2015-1788.patch: improve logic in crypto/bn/bn_gf2m.c. - CVE-2015-1788 * SECURITY UPDATE: denial of service via out-of-bounds read in X509_cmp_time - debian/patches/CVE-2015-1789.patch: properly parse time format in crypto/x509/x509_vfy.c. - CVE-2015-1789 * SECURITY UPDATE: denial of service via missing EnvelopedContent - debian/patches/CVE-2015-1790.patch: handle NULL data_body in crypto/pkcs7/pk7_doit.c. - CVE-2015-1790 * SECURITY UPDATE: race condition in NewSessionTicket - debian/patches/CVE-2015-1791.patch: create a new session in ssl/s3_clnt.c, ssl/ssl.h, ssl/ssl_err.c, ssl/ssl_locl.h, ssl/ssl_sess.c. - debian/patches/CVE-2015-1791-2.patch: fix kerberos issue in ssl/ssl_sess.c. - debian/patches/CVE-2015-1791-3.patch: more ssl_session_dup fixes in ssl/ssl_sess.c. - CVE-2015-1791 * SECURITY UPDATE: CMS verify infinite loop with unknown hash function - debian/patches/CVE-2015-1792.patch: fix infinite loop in crypto/cms/cms_smime.c. - CVE-2015-1792 Checksums-Sha1: 5f27daaeb5813af53cf441acde750386eab5400c 492444 openssl_1.0.1f-1ubuntu9.8_amd64.deb ae3bfefedb665ba5cb85c94a3afe8df71cba915b 849512 libssl1.0.0_1.0.1f-1ubuntu9.8_amd64.deb a2ac205a3d5f73f8e7edb16203aedc88b904462f 627626 libcrypto1.0.0-udeb_1.0.1f-1ubuntu9.8_amd64.udeb 686bff606384eba81a0136fa7f3aaf8eb5330bf5 127374 libssl1.0.0-udeb_1.0.1f-1ubuntu9.8_amd64.udeb 4b62ec292ed5a066b9661a755fca60b4ec9e25a7 1090728 libssl-dev_1.0.1f-1ubuntu9.8_amd64.deb 408aee5b43d2d95956bbbe29ece7539a064a0d8c 2612140 libssl1.0.0-dbg_1.0.1f-1ubuntu9.8_amd64.deb c8c1999f866ea746eacdb9d3f23305b0283a8897 1116 openssl-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb 3814fa6e0392650eaa64d72f759bb7a7b9856c3d 952 libssl1.0.0-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb ff4aca7c9c2b9b115252f35fbc8904f64a461d3b 990 libcrypto1.0.0-udeb-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb c9f00d586ebda0fdb3b4bd9ee5cf77265d0dd76b 874 libssl1.0.0-udeb-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb da0bb87ac29f31a1f8fa6257720d40942a5a0824 976 libssl-dev-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb aab88b98a73838201ef2b67dbfb41d7de94faf71 20455 openssl_1.0.1f-1ubuntu9.8_amd64_translations.tar.gz Checksums-Sha256: 9c324c41a27eb8fe6faa44371e1a337c69708e37db4271589f5bf579e7e726e9 492444 openssl_1.0.1f-1ubuntu9.8_amd64.deb c195d50c8fe452ef986667ffcb1aaafd089635bae51d5e3613a687d3689799be 849512 libssl1.0.0_1.0.1f-1ubuntu9.8_amd64.deb 3d21e59a1c25ba619dd33c323984e41efd6aed315c4ed570e04c48d863189d89 627626 libcrypto1.0.0-udeb_1.0.1f-1ubuntu9.8_amd64.udeb ca973ae28a936e7fcead4a255a8a464f3d909dc6716699e766f868a111737605 127374 libssl1.0.0-udeb_1.0.1f-1ubuntu9.8_amd64.udeb 232b0fd8049572ce78ccee48a6dbb7a6ca55bf3683f27507aa89f34d73be660c 1090728 libssl-dev_1.0.1f-1ubuntu9.8_amd64.deb 893e0159ea23e8356c57defa21aca4ecf4eb859d5588e81cae4041efd3b05a66 2612140 libssl1.0.0-dbg_1.0.1f-1ubuntu9.8_amd64.deb a241a768c0122488aeef5d0b440f58c7d23a103c28433213271c431fea9b9e05 1116 openssl-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb b1661b4896a033f1f976341a79ccd0afd5bce93641f2ed4292a3e824ddd1c0b4 952 libssl1.0.0-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb ce504e098cc8ab325429a4b9908637bd765a86990560237b5134e89bc7fff110 990 libcrypto1.0.0-udeb-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb b57838d7eac347ffb6049a7b03147ec8b476ecffda474a1c23126918d5f46143 874 libssl1.0.0-udeb-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb 173631b882ee16f1c0080ace19977291858f06c2cb551ae9b780872dc9984ce9 976 libssl-dev-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb 88e10db66cf79979576c122384dfe3618036c6767411ecc57424951e3193baaa 20455 openssl_1.0.1f-1ubuntu9.8_amd64_translations.tar.gz Files: c271e308a832f57cd7be7ec7dfe7914f 492444 utils optional openssl_1.0.1f-1ubuntu9.8_amd64.deb 7c887419754848c3c53fe18cd9a4483a 849512 libs important libssl1.0.0_1.0.1f-1ubuntu9.8_amd64.deb ecf7ab9805709c19f156cc11a60563c8 627626 debian-installer optional libcrypto1.0.0-udeb_1.0.1f-1ubuntu9.8_amd64.udeb 035a42d0c2af428cf064f67fef530a17 127374 debian-installer optional libssl1.0.0-udeb_1.0.1f-1ubuntu9.8_amd64.udeb 1952696c9fc431bc4bf9586eede0e031 1090728 libdevel optional libssl-dev_1.0.1f-1ubuntu9.8_amd64.deb 6fa034d8655870df1025d8dac87c38b3 2612140 debug extra libssl1.0.0-dbg_1.0.1f-1ubuntu9.8_amd64.deb c3159f45e09843527b7c7ba49691811e 1116 utils extra openssl-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb cde35e019301758cc4f796f21349ef76 952 libs extra libssl1.0.0-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb 58ced95bf8f23111a4492b94ada1e729 990 debian-installer extra libcrypto1.0.0-udeb-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb 001021209fb51b68d46f204759bc36f4 874 debian-installer extra libssl1.0.0-udeb-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb 80fff22f9c334c2c2b80266ae5eae442 976 libdevel extra libssl-dev-dbgsym_1.0.1f-1ubuntu9.8_amd64.ddeb 2f00d5d63ea8961cd17f7d60d9682839 20455 raw-translations - openssl_1.0.1f-1ubuntu9.8_amd64_translations.tar.gz Original-Maintainer: Debian OpenSSL Team Package-Type: udeb