From 0cedaa6c89235ed396068f2ebf546c9a909439e1 Mon Sep 17 00:00:00 2001 From: "Simon L. B. Nielsen" Date: Thu, 1 Apr 2010 12:25:40 +0000 Subject: Import OpenSSL 0.9.8n. --- CHANGES | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'CHANGES') diff --git a/CHANGES b/CHANGES index 97b3810f40a8..b350da79f66b 100644 --- a/CHANGES +++ b/CHANGES @@ -2,6 +2,21 @@ OpenSSL CHANGES _______________ + Changes between 0.9.8m and 0.9.8n [24 Mar 2010] + + *) When rejecting SSL/TLS records due to an incorrect version number, never + update s->server with a new major version number. As of + - OpenSSL 0.9.8m if 'short' is a 16-bit type, + - OpenSSL 0.9.8f if 'short' is longer than 16 bits, + the previous behavior could result in a read attempt at NULL when + receiving specific incorrect SSL/TLS records once record payload + protection is active. (CVE-2010-0740) + [Bodo Moeller, Adam Langley ] + + *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL + could be crashed if the relevant tables were not present (e.g. chrooted). + [Tomas Hoger ] + Changes between 0.9.8l and 0.9.8m [25 Feb 2010] *) Always check bn_wexpend() return values for failure. (CVE-2009-3245) -- cgit v1.2.3