Module Name: src
Committed By: msaitoh
Date: Wed Aug 27 13:35:30 UTC 2014
Modified Files:
src/doc [netbsd-5-2]: CHANGES-5.2.3
Log Message:
Ticket 1918.
To generate a diff of this commit:
cvs rdiff -u -r1.1.2.17 -r1.1.2.18 src/doc/CHANGES-5.2.3
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/doc/CHANGES-5.2.3
diff -u src/doc/CHANGES-5.2.3:1.1.2.17 src/doc/CHANGES-5.2.3:1.1.2.18
--- src/doc/CHANGES-5.2.3:1.1.2.17 Wed Aug 27 07:39:22 2014
+++ src/doc/CHANGES-5.2.3 Wed Aug 27 13:35:30 2014
@@ -1,4 +1,4 @@
-# $NetBSD: CHANGES-5.2.3,v 1.1.2.17 2014/08/27 07:39:22 msaitoh Exp $
+# $NetBSD: CHANGES-5.2.3,v 1.1.2.18 2014/08/27 13:35:30 msaitoh Exp $
A complete list of changes from the NetBSD 5.2.2 release to the NetBSD 5.2.3
release:
@@ -242,3 +242,23 @@ sys/dev/pci/pci_usrreq.c 1.26 via patc
writes before feeding them to a kassert in pci_conf_read/write or to a
trap in the hardware itself.
[riastradh, ticket #1922]
+
+crypto/dist/openssl/crypto/asn1/a_object.c patch
+crypto/dist/openssl/crypto/asn1/asn1.h patch
+crypto/dist/openssl/crypto/asn1/asn1_err.c patch
+crypto/dist/openssl/crypto/objects/obj_dat.c patch
+crypto/dist/openssl/ssl/d1_both.c patch
+crypto/dist/openssl/ssl/s23_srvr.c patch
+crypto/dist/openssl/ssl/s3_clnt.c patch
+crypto/dist/openssl/ssl/t1_lib.c patch
+
+ Patches for the following vulnerabilities:
+ - Information leak in pretty printing functions (CVE-2014-3508)
+ - Double Free when processing DTLS packets (CVE-2014-3505)
+ - DTLS memory exhaustion (CVE-2014-3506)
+ - DTLS memory leak from zero-length fragments (CVE-2014-3507)
+ - OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510)
+ - Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509)
+ - OpenSSL TLS protocol downgrade attack (CVE-2014-3511)
+ Backported from the recent 1.0.1i OpenSSL release.
+ [spz, ticket #1918]
