[Technik] [SECURITY] [DSA 1379-1] New openssl packages fix arbitrary code execution

[Noèl Köthe]

Am Dienstag, den 02.10.2007, 22:06 +0200 schrieb Noah Meyerhans:

> Debian Security Advisory DSA-1379                  security at debian.org
> http://www.debian.org/security/                         Noah Meyerhans
> October 02, 2007
> 
> Package        : openssl
> Vulnerability  : off-by-one error/buffer overflow
> Problem type   : remote
> Debian-specific: no
> CVE Id(s)      : CVE-2007-5135
> Debian Bug     : 444435

openssl auf h01, h02, h03, h04, kiowa, karuk, kansa, cusa, acoma, yuma,
cree, cupa, wasco, pima und pomo aktualisiert.

> For the stable distribution (etch), this problem has been fixed in
> version 0.9.8c-4etch1.

changelog:
openssl (0.9.8c-4etch1) stable-security; urgency=low

  * CVE-2007-5135: Fix off by one error in SSL_get_shared_ciphers().
    (Closes: #444435)
  * Add nagios-nrpe-server, clamav-freshclam and clamav-daemon
    to the list of services to check for restart.

 -- Kurt Roeckx <kurt at roeckx.be>  Fri, 28 Sep 2007 19:57:00 +0200

> For the old stable distribution (sarge), this
> problem has been fixed in version 0.9.7e-3sarge5.

changelog:
openssl (0.9.7e-3sarge5) oldstable-security; urgency=low

  * CVE-2007-5135: Fix off by one error in SSL_get_shared_ciphers().
    (Closes: #444435)
  * Call dh_fixperms before dh_strip so that stripping actually works.

 -- Kurt Roeckx <kurt at roeckx.be>  Sat, 29 Sep 2007 11:21:18 +0200

-- 
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
Url : /archiv/technik/attachments/20071004/4a0d14ab/attachment.pgp