-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 04 Mar 2017 16:23:15 +0100
Source: gnutls28
Binary: libgnutls28-dev libgnutls30 gnutls-bin gnutls-doc libgnutlsxx28 libgnutls-openssl27 libgnutls-dane0
Architecture: source
Version: 3.5.8-4
Distribution: unstable
Urgency: medium
Maintainer: Debian GnuTLS Maintainers <pkg-gnutls-maint@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Description:
gnutls-bin - GNU TLS library - commandline utilities
gnutls-doc - GNU TLS library - documentation and examples
libgnutls28-dev - GNU TLS library - development files
libgnutls30 - GNU TLS library - main runtime library
libgnutls-dane0 - GNU TLS library - DANE security support
libgnutls-openssl27 - GNU TLS library - OpenSSL wrapper
libgnutlsxx28 - GNU TLS library - C++ runtime library
Changes:
gnutls28 (3.5.8-4) unstable; urgency=medium
.
* More upstream fixes from gnutls_3_5_x branch:
+ 35_05_cdk_pkt_read-enforce-packet-limits.patch: Addressed integer
overflow resulting to invalid memory write in OpenPGP certificate
parsing. Issue found using oss-fuzz project:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420
+ 35_05_opencdk-read_attribute-account-buffer-size.patch Addressed read of
1 byte past the end of buffer in OpenPGP certificate parsing. Issue
found using oss-fuzz project:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391
+ 35_06_opencdk-do-not-parse-any-secret-keys-in-packet-when-.patch
Addressed crashes in OpenPGP certificate parsing, related to private key
parser. No longer allow OpenPGP certificates (public keys) to contain
private key sub-packets. Issue found using oss-fuzz project:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=354
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=360
Checksums-Sha1:
242a6f1a0ac4382d00d4d6a72c646ea6bf4fc806 3258 gnutls28_3.5.8-4.dsc
1d2cbac75f3bd7611ed15b670945bd699e01d45a 104368 gnutls28_3.5.8-4.debian.tar.xz
Checksums-Sha256:
2e49d6d2ff763163a756072f9a694330743acb5db7276a771410bf65788c237b 3258 gnutls28_3.5.8-4.dsc
93ca4be93487167b32aa0e0b973cdd2bd5a70711baa54baa429b41717cee304b 104368 gnutls28_3.5.8-4.debian.tar.xz
Files:
0a7bf525c9e04783a693f3e1ffc30e15 3258 libs optional gnutls28_3.5.8-4.dsc
48d66ae30e63211f45787e1a153a04ec 104368 libs optional gnutls28_3.5.8-4.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAli64KcACgkQpU8BhUOC
FIQgMBAAkxWCIsZe5tYQfSbO3+oVDy0xPrZRC/Gw6Jnz+08W+QnCSyINO+VbSQzd
nI7rpxbcToW+bpdghJIZnEfFq3papc6HNoQCLH2K3y7dONeCQBazXDKhA7gSb5VN
Yn/qxWHeVCQRhFK1UN0QJcMGTz9oiOOJQZ+jYDLGvgsaNSnpReBUdV/6AQmMCSJW
e++DTzojTAgoQzwqfn9ZaQ2GclwUI21g+NssUJayWx5/EgCIpU9UgLqO654ANaNh
38gI3gsY2HGufK/uP0Z0Xy6g6LNcF6EZU52ud/VJAgWrcUeOQT1PvU8nJA/nds/h
GmPq81Rh+a3zYhD+ZsGlFz5tzJbA1bzhDZcVehN+OnlnLuJKjyMzOLpH/Qwc0st+
LYNzV5M+d/wkYP4VU7jLPgPWtzNLshpvCfqdSQSw/NYe+e62FrmNKH+VJPWijk+U
RfUJO5Y6URzuf+mdvvhyyIM+wKwoPla7nwToqJeixDQVF4A8sYD0B9TV4bw4iTb7
E+8U65z/ppHRMSoGkGoMhS//v5E13Pp6Wqo6DBa8bKkZl7Zz3O53pP3r5IjPWmty
n8pW4IUDAIgNhW1BFsP+jLFlGJ83KXkTnnM67hEiUQroy0+gpFnVl0+MFRq0/G36
VG/CNNL2An9Id24m92WcxUVqaz4JHT3VDQ373yL7jqVkqjaTjeE=
=TXyI
-----END PGP SIGNATURE-----
