|
openvpn (2.3.4-5+deb8u2) jessie-security; urgency=high
* SECURITY UPDATE: authenticated remote DoS vulnerability due to
packet ID rollover. CVE-2017-7479.
Kudos to Steve Beattie <sbeattie@ubuntu.com> for doing all the backporting
work for this patch.
- debian/patches/CVE-2017-7479-prereq.patch: merge
packet_id_alloc_outgoing() into packet_id_write()
- debian/patches/CVE-2017-7479.patch: do not assert when packet ID
rollover occurs
* SECURITY UPDATE: (Closes: #865480)
- CVE-2017-7508.patch. Fix remotely-triggerable ASSERT() on malformed IPv6
packet.
- CVE-2017-7520.patch. Prevent two kinds of stack buffer OOB reads and a
crash for invalid input data.
- CVE-2017-7521.patch. Fix potential double-free in --x509-alt-username.
- CVE-2017-7521bis.patch. Fix remote-triggerable memory leaks.
|
