Slackwarearm-current ChangeLog (2014-10-17)

Fri Oct 17 11:21:19 UTC 2014

  • a/openssl-solibs-1.0.1j-arm-1.txz
    (* Security fix *)
  • n/openssl-1.0.1j-arm-1.txz
    This update fixes several security issues:
    SRTP Memory Leak (CVE-2014-3513):
    A flaw in the DTLS SRTP extension parsing code allows an attacker, who
    sends a carefully crafted handshake message, to cause OpenSSL to fail
    to free up to 64k of memory causing a memory leak. This could be
    exploited in a Denial Of Service attack.
    Session Ticket Memory Leak (CVE-2014-3567):
    When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
    integrity of that ticket is first verified. In the event of a session
    ticket integrity check failing, OpenSSL will fail to free memory
    causing a memory leak. By sending a large number of invalid session
    tickets an attacker could exploit this issue in a Denial Of Service
    SSL 3.0 Fallback protection:
    OpenSSL has added support for TLS_FALLBACK_SCSV to allow applications
    to block the ability for a MITM attacker to force a protocol
    Some client applications (such as browsers) will reconnect using a
    downgraded protocol to work around interoperability bugs in older
    servers. This could be exploited by an active man-in-the-middle to
    downgrade connections to SSL 3.0 even if both sides of the connection
    support higher protocols. SSL 3.0 contains a number of weaknesses
    including POODLE (CVE-2014-3566).
    Build option no-ssl3 is incomplete (CVE-2014-3568):
    When OpenSSL is configured with “no-ssl3” as a build option, servers
    could accept and complete a SSL 3.0 handshake, and clients could be
    configured to send them.
    For more information, see:
    (* Security fix *)
  • n/nn-6.7.3-arm-4.txz
    Fixed incorrect directory ownerships.
  • news/2014/10/17/slackwarearm-current-changelog.txt
  • Last modified: 6 years ago
  • by Giuseppe Di Terlizzi