diff options
| -rw-r--r-- | ChangeLog | 16 | ||||
| -rw-r--r-- | VERSION | 2 |
2 files changed, 17 insertions, 1 deletions
| @@ -31,6 +31,22 @@ LibreSSL Portable Release Notes: | |||
| 31 | This release primarily addresses a number of security issues in coordination | 31 | This release primarily addresses a number of security issues in coordination |
| 32 | with the OpenSSL project. | 32 | with the OpenSSL project. |
| 33 | 33 | ||
| 34 | 2.1.7 - Security Update | ||
| 35 | |||
| 36 | * Fixes for the following issues are integrated into LibreSSL 2.1.7: | ||
| 37 | - CVE-2015-1788 - Malformed ECParameters causes infinite loop | ||
| 38 | - CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time | ||
| 39 | - CVE-2015-1792 - CMS verify infinite loop with unknown hash function | ||
| 40 | |||
| 41 | * The following CVEs did not apply to LibreSSL or were fixed in | ||
| 42 | earlier releases: | ||
| 43 | - CVE-2015-4000 - DHE man-in-the-middle protection (Logjam) | ||
| 44 | - CVE-2015-1790 - PKCS7 crash with missing EnvelopedContent | ||
| 45 | - CVE-2014-8176 - Invalid free in DTLS | ||
| 46 | |||
| 47 | * Fixes for the following CVEs are still in review for LibreSSL | ||
| 48 | - CVE-2015-1791 - Race condition handling NewSessionTicket | ||
| 49 | |||
| 34 | 2.1.6 - Security update | 50 | 2.1.6 - Security update |
| 35 | 51 | ||
| 36 | * Fixes for the following issues are integrated into LibreSSL 2.1.6: | 52 | * Fixes for the following issues are integrated into LibreSSL 2.1.6: |
| @@ -1 +1 @@ | |||
| 2.1.6 | 2.1.7 | ||
