Format: 1.8 Date: Thu, 22 Sep 2016 13:38:15 -0400 Source: openssl Binary: openssl libssl1.0.0 libcrypto1.0.0-udeb libssl1.0.0-udeb libssl-dev libssl-doc libssl1.0.0-dbg Architecture: all i386_translations i386 Version: 1.0.1f-1ubuntu2.20 Distribution: trusty Urgency: medium Maintainer: Launchpad Build Daemon Changed-By: Marc Deslauriers Description: libcrypto1.0.0-udeb - Secure Sockets Layer toolkit - libcrypto udeb (udeb) libssl-dev - Secure Sockets Layer toolkit - development files libssl-doc - Secure Sockets Layer toolkit - development documentation libssl1.0.0 - Secure Sockets Layer toolkit - shared libraries libssl1.0.0-dbg - Secure Sockets Layer toolkit - debug information libssl1.0.0-udeb - ssl shared library - udeb (udeb) openssl - Secure Sockets Layer toolkit - cryptographic utility Launchpad-Bugs-Fixed: 1622500 Changes: openssl (1.0.1f-1ubuntu2.20) trusty-security; urgency=medium . * SECURITY UPDATE: Constant time flag not preserved in DSA signing - debian/patches/CVE-2016-2178-*.patch: preserve BN_FLG_CONSTTIME in crypto/dsa/dsa_ossl.c. - CVE-2016-2178 * SECURITY UPDATE: DTLS buffered message DoS - debian/patches/CVE-2016-2179.patch: fix queue handling in ssl/d1_both.c, ssl/d1_clnt.c, ssl/d1_lib.c, ssl/d1_srvr.c, ssl/ssl_locl.h. - CVE-2016-2179 * SECURITY UPDATE: OOB read in TS_OBJ_print_bio() - debian/patches/CVE-2016-2180.patch: fix text handling in crypto/ts/ts_lib.c. - CVE-2016-2180 * SECURITY UPDATE: DTLS replay protection DoS - debian/patches/CVE-2016-2181-1.patch: properly handle unprocessed records in ssl/d1_pkt.c. - debian/patches/CVE-2016-2181-2.patch: protect against replay attacks in ssl/d1_pkt.c, ssl/ssl.h, ssl/ssl_err.c. - debian/patches/CVE-2016-2181-3.patch: update error code in ssl/ssl.h. - CVE-2016-2181 * SECURITY UPDATE: OOB write in BN_bn2dec() - debian/patches/CVE-2016-2182.patch: don't overflow buffer in crypto/bn/bn_print.c. - CVE-2016-2182 * SECURITY UPDATE: SWEET32 Mitigation - debian/patches/CVE-2016-2183.patch: move DES ciphersuites from HIGH to MEDIUM in ssl/s3_lib.c. - CVE-2016-2183 * SECURITY UPDATE: Malformed SHA512 ticket DoS - debian/patches/CVE-2016-6302.patch: sanity check ticket length in ssl/t1_lib.c. - CVE-2016-6302 * SECURITY UPDATE: OOB write in MDC2_Update() - debian/patches/CVE-2016-6303.patch: avoid overflow in crypto/mdc2/mdc2dgst.c. - CVE-2016-6303 * SECURITY UPDATE: OCSP Status Request extension unbounded memory growth - debian/patches/CVE-2016-6304.patch: remove OCSP_RESPIDs from previous handshake in ssl/t1_lib.c. - CVE-2016-6304 * SECURITY UPDATE: Certificate message OOB reads - debian/patches/CVE-2016-6306-1.patch: check lengths in ssl/s3_clnt.c, ssl/s3_srvr.c. - debian/patches/CVE-2016-6306-2.patch: make message buffer slightly larger in ssl/d1_both.c, ssl/s3_both.c. - CVE-2016-6306 * SECURITY REGRESSION: DTLS regression (LP: #1622500) - debian/patches/CVE-2014-3571-3.patch: make DTLS always act as if read_ahead is set in ssl/s3_pkt.c. * debian/patches/update-expired-smime-test-certs.patch: Update test certificates that have expired and caused build test failures. Checksums-Sha1: c54bf92fdebd4a08662f0a9e3f6bbe0d835d660e 971136 libssl-doc_1.0.1f-1ubuntu2.20_all.deb 29a33f34ef743bbe4f28f0c0f257e379d88158be 20401 openssl_1.0.1f-1ubuntu2.20_i386_translations.tar.gz a645aa053c9b8cc702c333950b474e6649701aac 480248 openssl_1.0.1f-1ubuntu2.20_i386.deb 87081e690da40714670e81d528947b648584e009 784164 libssl1.0.0_1.0.1f-1ubuntu2.20_i386.deb 3aaa448748c60422ffae37dd8c2fe83648512320 570770 libcrypto1.0.0-udeb_1.0.1f-1ubuntu2.20_i386.udeb 060c4666c5d3c1695ef5aca3615405d5ef41b9f5 123046 libssl1.0.0-udeb_1.0.1f-1ubuntu2.20_i386.udeb 6fc3c64ef0e390849deaa3fb25857a954ff73bbc 993022 libssl-dev_1.0.1f-1ubuntu2.20_i386.deb 43a025de1a0ecefd81f86abf6471076ce3a88fc4 2346560 libssl1.0.0-dbg_1.0.1f-1ubuntu2.20_i386.deb bdddd73a3cb90272e82168b16bb896fbe879625d 1060 openssl-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb f9f59aef73dcbdbd5393ceb6b5f2f98a720cf7ef 900 libssl1.0.0-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb 3a8d45d9444fe3b066a09a22d57b4a42217856ec 932 libcrypto1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb e3c7c9505b1d72aa5f11e3d701ced1485daab227 818 libssl1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb 7cfc2a7b97c27dc650acb3bb8d6502ea4ef18f16 924 libssl-dev-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb Checksums-Sha256: 6c238dfb48130764a7e712b804700b37ec37cae963886a46bd57ad2ce295516d 971136 libssl-doc_1.0.1f-1ubuntu2.20_all.deb 61fa46c4d8bc1deafd27d782f07722b08bda8a63f4d1ddcc93bb68f79a192ac6 20401 openssl_1.0.1f-1ubuntu2.20_i386_translations.tar.gz a5cca3a37082292c6a9ab7c24918bd135f4537c7c135b7569545847a41bced78 480248 openssl_1.0.1f-1ubuntu2.20_i386.deb 97db0ea30d2d25caf094cb8824792bd32af285f5c2b4f8693558d250fbb1ff60 784164 libssl1.0.0_1.0.1f-1ubuntu2.20_i386.deb 5537c92e3a5faa9ea7242f4880d8e3decb665c383cf85995133d95d4ba6338b9 570770 libcrypto1.0.0-udeb_1.0.1f-1ubuntu2.20_i386.udeb c2cd753982f30f7ab6a51cde39a841bf18f719ba5bf3970e5e2b0d625e6d43cd 123046 libssl1.0.0-udeb_1.0.1f-1ubuntu2.20_i386.udeb a307917b5fea5a7d3d8f372cfa87f5a1b71448992e0717ce334cc88ac1548273 993022 libssl-dev_1.0.1f-1ubuntu2.20_i386.deb 6106152c814ae40612978bd7249e562f9b2ce928c76d7bbac09f739f9e7e3a1d 2346560 libssl1.0.0-dbg_1.0.1f-1ubuntu2.20_i386.deb 1457e63a6896d915a6e0653ae93e4650e531ae8d5016d4be223d9afdfc85dcd6 1060 openssl-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb 2be24b5dbe70395aee05980bbd5b9e31c7bd253506600d66d7ca84c5c1baf3cd 900 libssl1.0.0-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb 380334873d2a3ab2113fccd0442fef4411c620246367ee1a6d385d9131691e06 932 libcrypto1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb 4bf0ff45e6a1f60ce902565994c61f099b282bbe9c96f5680c595d251af2e588 818 libssl1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb be117a1b7ead5f8f7962686f2ba9f7d360d48d0621398cb3f8029093af7210a4 924 libssl-dev-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb Files: 15e23a5337649585688a13cf5e66c6eb 971136 doc optional libssl-doc_1.0.1f-1ubuntu2.20_all.deb d6e2863c682dc00917e15f2b50ea83cf 20401 raw-translations - openssl_1.0.1f-1ubuntu2.20_i386_translations.tar.gz 041f5e624f398ac6ade4228b02e3fab8 480248 utils optional openssl_1.0.1f-1ubuntu2.20_i386.deb 0c3a891d76f08abcfbdbd16ce2c61890 784164 libs important libssl1.0.0_1.0.1f-1ubuntu2.20_i386.deb 524f1823cb5a407ca13d12c03d6f03c5 570770 debian-installer optional libcrypto1.0.0-udeb_1.0.1f-1ubuntu2.20_i386.udeb 5e32db9f1aab51ed92608ee24a3dedf9 123046 debian-installer optional libssl1.0.0-udeb_1.0.1f-1ubuntu2.20_i386.udeb 04566651db9e8d09d5d75df444fb8124 993022 libdevel optional libssl-dev_1.0.1f-1ubuntu2.20_i386.deb d1841f070d73b4e725daf3112dadb770 2346560 debug extra libssl1.0.0-dbg_1.0.1f-1ubuntu2.20_i386.deb 545c4d30e5e80b4de9e7fc5a1cd2b72b 1060 utils extra openssl-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb fb37e6c9800a1366234cf066579979fd 900 libs extra libssl1.0.0-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb 848b77a15546580c7606a2f3d39a6334 932 debian-installer extra libcrypto1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb 1923408549f7784577dd23feb5b19248 818 debian-installer extra libssl1.0.0-udeb-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb b1f04d3d9142d40c958be5c0c9dce0e8 924 libdevel extra libssl-dev-dbgsym_1.0.1f-1ubuntu2.20_i386.ddeb Original-Maintainer: Debian OpenSSL Team Package-Type: udeb