| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
CVE-2014-3508 Information leak in pretty printing functions
CVE-2014-5139 Crash with SRP ciphersuite in Server Hello message
CVE-2014-3509 Race condition in ssl_parse_serverhello_tlsext
CVE-2014-3505 Double Free when processing DTLS packets
CVE-2014-3506 DTLS memory exhaustion
CVE-2014-3507 DTLS memory leak from zero-length fragments
CVE-2014-3510 OpenSSL DTLS anonymous EC(DH) denial of service
CVE-2014-3511 OpenSSL TLS protocol downgrade attack
CVE-2014-3512 SRP buffer overrun
(cherry picked from commit 9b2d3aa0289fc6e6f5fddca823337631d49cadf5)
(cherry picked from commit d4f5d980c75fd5b13a60637aafa549f1407a85c8)
(cherry picked from commit 7c34cd9c948a7bd20f05a136eaa9bec33c479849)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Newly fixed CVEs:
CVE-2014-0224 SSL/TLS MITM vulnerability
CVE-2014-0221 DTLS recursion flaw
CVE-2014-0195 DTLS invalid fragment vulnerability
Previously fixed in Alpine by cherry picks:
CVE-2014-0198 SSL_MODE_RELEASE_BUFFERS NULL pointer dereference
(cherry picked from commit c7c8818b7203c5ff58dd5f7d03f7e47cb681348d)
fixes #2999
|
|
and introduce libssl1.0 and libcrypto1.0 packages
|