[Technik] [SECURITY] [DSA 1379-2] New openssl packages fix arbitrary code execution

[Noèl Köthe]

Am Mittwoch, den 10.10.2007, 19:59 +0200 schrieb Noah Meyerhans:

> Debian Security Advisory DSA-1379-2                security at debian.org
> http://www.debian.org/security/                         Noah Meyerhans
> October 10, 2007
> 
> Package        : openssl097, openssl096
> Vulnerability  : off-by-one error/buffer overflow
> Problem type   : remote
> Debian-specific: no
> CVE Id(s)      : CVE-2007-5135
> Debian Bug     : 444435

openssl096|7 auf "allen":) Rechnern aktualisiert. Dies sind:
h01, h02, h03, h04, kiowa, karuk, kansa, cusa, accoma, iowa, ponka,
cherokee, cupa, wasco, pima, pomo, cree und yuma.
yuki, h51, h90 werden noch nachgeholt, sobald ich meine Zugangsdaten
korrekt habe.:)

> This update to DSA 1379 announces the availability of the libssl0.9.6
> and libssl0.9.7 compatibility libraries for sarge (oldstable) and etch
> (stable), respectively.

sarge:
openssl096 (0.9.6m-1sarge5) oldstable-security; urgency=low

  * CVE-2007-5135: Fix off by one error in SSL_get_shared_ciphers().
  * Call dh_fixperms before dh_strip so that stripping actually works.

 -- Kurt Roeckx <kurt at roeckx.be>  Sat, 29 Sep 2007 10:22:20 +0000

etch:
openssl097 (0.9.7k-3.1etch1) stable-security; urgency=low

  * CVE-2007-5135: Fix off by one error in SSL_get_shared_ciphers().
   (Closes: #444460)

 -- Kurt Roeckx <kurt at roeckx.be>  Sat, 29 Sep 2007 11:39:38 +0200

-- 
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
Url : /archiv/technik/attachments/20071020/9954079a/attachment.pgp