diff options
-rw-r--r-- | ChangeLog | 16 | ||||
-rw-r--r-- | VERSION | 2 |
2 files changed, 17 insertions, 1 deletions
@@ -31,6 +31,22 @@ LibreSSL Portable Release Notes: | |||
31 | This release primarily addresses a number of security issues in coordination | 31 | This release primarily addresses a number of security issues in coordination |
32 | with the OpenSSL project. | 32 | with the OpenSSL project. |
33 | 33 | ||
34 | 2.1.7 - Security Update | ||
35 | |||
36 | * Fixes for the following issues are integrated into LibreSSL 2.1.7: | ||
37 | - CVE-2015-1788 - Malformed ECParameters causes infinite loop | ||
38 | - CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time | ||
39 | - CVE-2015-1792 - CMS verify infinite loop with unknown hash function | ||
40 | |||
41 | * The following CVEs did not apply to LibreSSL or were fixed in | ||
42 | earlier releases: | ||
43 | - CVE-2015-4000 - DHE man-in-the-middle protection (Logjam) | ||
44 | - CVE-2015-1790 - PKCS7 crash with missing EnvelopedContent | ||
45 | - CVE-2014-8176 - Invalid free in DTLS | ||
46 | |||
47 | * Fixes for the following CVEs are still in review for LibreSSL | ||
48 | - CVE-2015-1791 - Race condition handling NewSessionTicket | ||
49 | |||
34 | 2.1.6 - Security update | 50 | 2.1.6 - Security update |
35 | 51 | ||
36 | * Fixes for the following issues are integrated into LibreSSL 2.1.6: | 52 | * Fixes for the following issues are integrated into LibreSSL 2.1.6: |
@@ -1 +1 @@ | |||
2.1.6 | 2.1.7 | ||