Ubuntu
openssl package

Change logs for openssl source package in Wily

Wily (15.10)
Change log

openssl (1.0.2d-0ubuntu1.5) wily-security; urgency=medium

  * SECURITY UPDATE: EVP_EncodeUpdate overflow
    - debian/patches/CVE-2016-2105.patch: properly check lengths in
      crypto/evp/encode.c, add documentation to
      doc/crypto/EVP_EncodeInit.pod, doc/crypto/evp.pod.
    - CVE-2016-2105
  * SECURITY UPDATE: EVP_EncryptUpdate overflow
    - debian/patches/CVE-2016-2106.patch: fix overflow in
      crypto/evp/evp_enc.c.
    - CVE-2016-2106
  * SECURITY UPDATE: Padding oracle in AES-NI CBC MAC check
    - debian/patches/CVE-2016-2107.patch: check that there are enough
      padding characters in crypto/evp/e_aes_cbc_hmac_sha1.c,
      crypto/evp/e_aes_cbc_hmac_sha256.c.
    - CVE-2016-2107
  * SECURITY UPDATE: Memory corruption in the ASN.1 encoder
    - debian/patches/CVE-2016-2108.patch: fix ASN1_INTEGER handling in
      crypto/asn1/a_type.c, crypto/asn1/asn1.h, crypto/asn1/tasn_dec.c,
      crypto/asn1/tasn_enc.c.
    - CVE-2016-2108
  * SECURITY UPDATE: ASN.1 BIO excessive memory allocation
    - debian/patches/CVE-2016-2109.patch: properly handle large amounts of
      data in crypto/asn1/a_d2i_fp.c.
    - CVE-2016-2109
  * debian/patches/min_1024_dh_size.patch: change minimum DH size from 768
    to 1024.

 -- Marc Deslauriers <email address hidden>  Thu, 28 Apr 2016 10:00:31 -0400

openssl (1.0.2d-0ubuntu1.4) wily-security; urgency=medium

  * SECURITY UPDATE: side channel attack on modular exponentiation
    - debian/patches/CVE-2016-0702.patch: use constant-time calculations in
      crypto/bn/asm/rsaz-avx2.pl, crypto/bn/asm/rsaz-x86_64.pl,
      crypto/bn/asm/x86_64-mont.pl, crypto/bn/asm/x86_64-mont5.pl,
      crypto/bn/bn_exp.c.
    - CVE-2016-0702
  * SECURITY UPDATE: double-free in DSA code
    - debian/patches/CVE-2016-0705.patch: fix double-free in
      crypto/dsa/dsa_ameth.c.
    - CVE-2016-0705
  * SECURITY UPDATE: BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
    - debian/patches/CVE-2016-0797.patch: prevent overflow in
      crypto/bn/bn_print.c, crypto/bn/bn.h.
    - CVE-2016-0797
  * SECURITY UPDATE: memory leak in SRP database lookups
    - debian/patches/CVE-2016-0798.patch: disable SRP fake user seed and
      introduce new SRP_VBASE_get1_by_user function that handled seed
      properly in apps/s_server.c, crypto/srp/srp.h, crypto/srp/srp_vfy.c,
      util/libeay.num, openssl.ld.
    - CVE-2016-0798
  * SECURITY UPDATE: memory issues in BIO_*printf functions
    - debian/patches/CVE-2016-0799.patch: prevent overflow in
      crypto/bio/b_print.c.
    - CVE-2016-0799

 -- Marc Deslauriers <email address hidden>  Mon, 29 Feb 2016 07:43:21 -0500

openssl (1.0.2d-0ubuntu1.3) wily-security; urgency=medium

  * SECURITY UPDATE: DH small subgroups issue
    - debian/patches/CVE-2016-0701.patch: add a test for small subgroup
      attacks in crypto/dh/dhtest.c, always generate DH keys for ephemeral
      DH cipher suites in doc/ssl/SSL_CTX_set_tmp_dh_callback.pod,
      ssl/s3_lib.c, ssl/s3_srvr.c, ssl/ssl.h, prevent small subgroup
      attacks on DH/DHE in crypto/dh/dh.h, crypto/dh/dh_check.c.
    - CVE-2016-0701

 -- Marc Deslauriers <email address hidden>  Mon, 25 Jan 2016 13:32:19 -0500

openssl (1.0.2d-0ubuntu1.2) wily-security; urgency=medium

  * SECURITY UPDATE: BN_mod_exp may produce incorrect results on x86_64
    - debian/patches/CVE-2015-3193.patch: fix carry propagating bug in
      crypto/bn/asm/x86_64-mont5.pl, added test to crypto/bn/bntest.c.
    - CVE-2015-3193
  * SECURITY UPDATE: Certificate verify crash with missing PSS parameter
    - debian/patches/CVE-2015-3194.patch: add PSS parameter check to
      crypto/rsa/rsa_ameth.c.
    - CVE-2015-3194
  * SECURITY UPDATE: X509_ATTRIBUTE memory leak
    - debian/patches/CVE-2015-3195.patch: fix leak in
      crypto/asn1/tasn_dec.c.
    - CVE-2015-3195
  * SECURITY UPDATE: Anon DH ServerKeyExchange with 0 p parameter
    - debian/patches/CVE-2015-1794.patch: fix segfault with 0 p val and
      check for 0 modulus in crypto/bn/bn_mont.c, ssl/s3_clnt.c.
    - CVE-2015-1794

 -- Marc Deslauriers <email address hidden>  Fri, 04 Dec 2015 11:14:44 -0500

openssl (1.0.2d-0ubuntu1) wily; urgency=medium

  * SECURITY UPDATE: alternative chains certificate forgery
    - Updated to new upstream version
    - CVE-2015-1793

 -- Marc Deslauriers <email address hidden>  Thu, 09 Jul 2015 09:27:48 -0400

openssl (1.0.2c-1ubuntu1) wily; urgency=medium

  * Merge with Debian, remaining changes.
    - debian/libssl1.0.0.postinst:
      + Display a system restart required notification on libssl1.0.0
        upgrade on servers.
      + Use a different priority for libssl1.0.0/restart-services depending
        on whether a desktop, or server dist-upgrade is being performed.
    - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create
      libssl1.0.0-udeb, for the benefit of wget-udeb (no wget-udeb package
      in Debian).
    - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,
      rules}: Move runtime libraries to /lib, for the benefit of
      wpasupplicant.
    - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under
      .pc.
    - debian/rules:
      + Don't run 'make test' when cross-building.
      + Use host compiler when cross-building.  Patch from Neil Williams.
      + Don't build for processors no longer supported: i586 (on i386)
      + Fix Makefile to properly clean up libs/ dirs in clean target.
      + Replace duplicate files in the doc directory with symlinks.
    - debian/control: Mark Debian Vcs-* as XS-Debian-Vcs-*
    - debian/rules: Enable optimized 64bit elliptic curve code contributed
      by Google.

openssl (1.0.2c-1) unstable; urgency=medium

  * New upstream version
    - Fixes ABI (Closes: #788511)

openssl (1.0.2b-1) unstable; urgency=high

  * New upstream version
    - Fix CVE-2015-4000
    - Fix CVE-2015-1788
    - Fix CVE-2015-1789
    - Fix CVE-2015-1790
    - Fix CVE-2015-1792
    - Fix CVE-2015-1791
  * Update c_rehash-compat.patch to make it apply to the new version.
  * Remove openssl-pod-misspell.patch applied upstream

 -- Marc Deslauriers <email address hidden>  Mon, 15 Jun 2015 08:17:16 -0400

openssl (1.0.2a-1ubuntu1) wily; urgency=medium

  * Merge with Debian, remaining changes.
    - debian/libssl1.0.0.postinst:
      + Display a system restart required notification on libssl1.0.0
        upgrade on servers.
      + Use a different priority for libssl1.0.0/restart-services depending
        on whether a desktop, or server dist-upgrade is being performed.
    - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create
      libssl1.0.0-udeb, for the benefit of wget-udeb (no wget-udeb package
      in Debian).
    - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,
      rules}: Move runtime libraries to /lib, for the benefit of
      wpasupplicant.
    - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under
      .pc.
    - debian/rules:
      + Don't run 'make test' when cross-building.
      + Use host compiler when cross-building.  Patch from Neil Williams.
      + Don't build for processors no longer supported: i586 (on i386)
      + Fix Makefile to properly clean up libs/ dirs in clean target.
      + Replace duplicate files in the doc directory with symlinks.
    - debian/control: Mark Debian Vcs-* as XS-Debian-Vcs-*
    - debian/rules: Enable optimized 64bit elliptic curve code contributed
      by Google.
  * Dropped patches included in new version:
    - ppc64-support.patch, CVE-2014-0076.patch, CVE-2014-0160.patch,
      CVE-2010-5298.patch, CVE-2014-0198.patch, CVE-2014-0195.patch,
      CVE-2014-0221.patch, CVE-2014-0224-1.patch, CVE-2014-0224-2.patch,
      CVE-2014-3470.patch, CVE-2014-0224-3.patch,
      CVE-2014-0224-regression.patch, CVE-2014-0224-regression2.patch,
      CVE-2014-3505.patch, CVE-2014-3506.patch, CVE-2014-3507.patch,
      CVE-2014-3508.patch, CVE-2014-3509.patch, CVE-2014-3510.patch,
      CVE-2014-3511.patch, CVE-2014-3512.patch, CVE-2014-5139.patch,
      power8-optimisations.patch, tls_fallback_scsv_support.patch,
      CVE-2014-3513.patch, CVE-2014-3567.patch, CVE-2014-3568.patch,
      CVE-2014-3569.patch, CVE-2014-3570.patch, CVE-2014-3571-1.patch,
      CVE-2014-3571-2.patch, CVE-2014-3572.patch, CVE-2014-8275.patch,
      CVE-2015-0204.patch, CVE-2015-0205.patch, CVE-2015-0206.patch,
      CVE-2015-0209.patch, CVE-2015-0286.patch, CVE-2015-0287.patch,
      CVE-2015-0288.patch, CVE-2015-0289.patch, CVE-2015-0292.patch,
      CVE-2015-0293.patch, CVE-2015-0209-2.patch, CVE-2015-0293-2.patch

openssl (1.0.2a-1) unstable; urgency=medium

  * New upstrema version
    - Fix CVE-2015-0286
    - Fix CVE-2015-0287
    - Fix CVE-2015-0289
    - Fix CVE-2015-0293 (not affected, SSLv2 disabled)
    - Fix CVE-2015-0209
    - Fix CVE-2015-0288
    - Fix CVE-2015-0291
    - Fix CVE-2015-0290
    - Fix CVE-2015-0207
    - Fix CVE-2015-0208
    - Fix CVE-2015-1787
    - Fix CVE-2015-0285
  * Temporary enable SSLv3 methods again, but they will go away.
  * Don't set TERMIO anymore, use the default TERMIOS instead.

openssl (1.0.2-1) experimental; urgency=medium

  * New upstream release
    - Fixes CVE-2014-3571
    - Fixes CVE-2015-0206
    - Fixes CVE-2014-3569
    - Fixes CVE-2014-3572
    - Fixes CVE-2015-0204
    - Fixes CVE-2015-0205
    - Fixes CVE-2014-8275
    - Fixes CVE-2014-3570
    - Drop git_snapshot.patch
  * Drop gnu_source.patch, dgst_hmac.patch, stddef.patch,
    no_ssl3_method.patch: applied upstream
  * Update patches to apply

openssl (1.0.2~beta3-1) experimental; urgency=low

  * New usptream beta version
  * Add git snapshot
  * Merge changes between 1.0.1h-3 and 1.0.1j-1:
    - Disables SSLv3 because of CVE-2014-3566
  * Drop patch rehash-crt.patch: partially applied upstream.
    c_rehash now doesn't support files in DER format anymore.
  * Drop patch rehash_pod.patch: applied upstream
  * Update c_rehash-compat.patch to apply to new upstream version.  This
    undoes upstream's "-old" option and creates both the new and old again.
    It now also does it for CRLs.
  * Drop defaults.patch, applied upstream
  * dgst_hmac.patch updated to apply to upstream version.
  * engines-path.patch updated to apply to upstream version.
  * Update list of exported symbols
  * Update symbols files to require beta3
  * Enable unit tests
  * Add patch to add support for the no-ssl3-method option that completly
    disable SSLv3 and pass the option.  This drops the following functions
    from the library: SSLv3_method, SSLv3_server_method and
    SSLv3_client_method
  * Build using OPENSSL_NO_BUF_FREELISTS

openssl (1.0.2~beta2-1) experimental; urgency=medium

  * New usptream beta version
    - Fix CVE-2014-0224
    - Fix CVE-2014-0221
    - Fix CVE-2014-0195
    - Fix CVE-2014-3470
    - Fix CVE-2014-0198
    - Fix CVE-2010-5298
    - Fix CVE-2014-0160
    - Fix CVE-2014-0076
  * Merge changes between 1.0.1f-1 and 1.0.1h-3:
    - postinst: Updated check for restarting services
  * libdoc-manpgs-pod-spell.patch and openssl-pod-misspell.patch
    partially applied upstream
  * Drop fix-pod-errors.patch, applied upstream.
  * Add support for ppc64le (Closes: #745657)
  * Add support for OpenRISC (Closes: #736772)

openssl (1.0.2~beta1-1) experimental; urgency=medium

  * New upstream beta version
    - Update list of symbols that should be exported and adjust the symbols
      file.  This also removes a bunch of duplicate symbols in the linker
      file.
    - Fix additional pod errors
    - Following patches have been applied upstream and are removed:
      libssl-misspell.patch, pod_req_misspell2.patch,
      pod_pksc12.misspell.patch, pod_s_server.misspell.patch,
      pod_x509setflags.misspell.patch, pod_ec.misspell.patch,
      pkcs12-doc.patch, req_bits.patch
    - Following patches have been partially applied upstream:
      libdoc-manpgs-pod-spell.patch, openssl-pod-misspell.patch
    - Remove openssl_fix_for_x32.patch, different patch applied upstream.
  * Add support for cross compiling (Closes: #465248)

 -- Marc Deslauriers <email address hidden>  Tue, 12 May 2015 11:36:12 -0400

openssl (1.0.1f-1ubuntu11) vivid; urgency=medium

  * SECURITY UPDATE: denial of service and possible memory corruption via
    malformed EC private key
    - debian/patches/CVE-2015-0209.patch: fix use after free in
      crypto/ec/ec_asn1.c.
    - debian/patches/CVE-2015-0209-2.patch: fix a failure to NULL a pointer
      freed on error in crypto/asn1/x_x509.c, crypto/ec/ec_asn1.c.
    - CVE-2015-0209
  * SECURITY UPDATE: denial of service via cert verification
    - debian/patches/CVE-2015-0286.patch: handle boolean types in
      crypto/asn1/a_type.c.
    - CVE-2015-0286
  * SECURITY UPDATE: ASN.1 structure reuse memory corruption
    - debian/patches/CVE-2015-0287.patch: free up structures in
      crypto/asn1/tasn_dec.c.
    - CVE-2015-0287
  * SECURITY UPDATE: denial of service via invalid certificate key
    - debian/patches/CVE-2015-0288.patch: check public key isn't NULL in
      crypto/x509/x509_req.c.
    - CVE-2015-0288
  * SECURITY UPDATE: denial of service and possible code execution via
    PKCS#7 parsing
    - debian/patches/CVE-2015-0289.patch: handle missing content in
      crypto/pkcs7/pk7_doit.c, crypto/pkcs7/pk7_lib.c.
    - CVE-2015-0289
  * SECURITY UPDATE: denial of service or memory corruption via base64
    decoding
    - debian/patches/CVE-2015-0292.patch: prevent underflow in
      crypto/evp/encode.c.
    - CVE-2015-0292
  * SECURITY UPDATE: denial of service via assert in SSLv2 servers
    - debian/patches/CVE-2015-0293.patch: check key lengths in
      ssl/s2_lib.c, ssl/s2_srvr.c.
    - debian/patches/CVE-2015-0293-2.patch: fix unsigned/signed warnings in
      ssl/s2_srvr.c.
    - CVE-2015-0293
 -- Marc Deslauriers <email address hidden>   Thu, 19 Mar 2015 10:07:13 -0400

Ubuntuopenssl package

Change logs for openssl source package in Wily

Ubuntu
openssl package