-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Thu, 22 Jun 2017 17:25:13 +0200 Source: openvpn Binary: openvpn Architecture: source amd64 Version: 2.3.4-5+deb8u2 Distribution: jessie-security Urgency: high Maintainer: Alberto Gonzalez Iniesta <agi@inittab.org> Changed-By: Alberto Gonzalez Iniesta <agi@inittab.org> Description: openvpn - virtual private network daemon Closes: 865480 Changes: openvpn (2.3.4-5+deb8u2) jessie-security; urgency=high . * SECURITY UPDATE: authenticated remote DoS vulnerability due to packet ID rollover. CVE-2017-7479. Kudos to Steve Beattie <sbeattie@ubuntu.com> for doing all the backporting work for this patch. - debian/patches/CVE-2017-7479-prereq.patch: merge packet_id_alloc_outgoing() into packet_id_write() - debian/patches/CVE-2017-7479.patch: do not assert when packet ID rollover occurs * SECURITY UPDATE: (Closes: #865480) - CVE-2017-7508.patch. Fix remotely-triggerable ASSERT() on malformed IPv6 packet. - CVE-2017-7520.patch. Prevent two kinds of stack buffer OOB reads and a crash for invalid input data. - CVE-2017-7521.patch. Fix potential double-free in --x509-alt-username. - CVE-2017-7521bis.patch. Fix remote-triggerable memory leaks. Checksums-Sha1: 138a81d4ed1c15680bed97c73bce65789671937b 2072 openvpn_2.3.4-5+deb8u2.dsc 71e1840311a4067a6166360f71c956888638b95e 1191101 openvpn_2.3.4.orig.tar.gz 6646888b71f5200d43f592e083f03d706444a341 130596 openvpn_2.3.4-5+deb8u2.debian.tar.xz 89c2a5acbafc9a9ce57b09f6830762d0cc699c48 477340 openvpn_2.3.4-5+deb8u2_amd64.deb Checksums-Sha256: 2987e8b53bde4f1b6853ea66a07f995ba3f7aa34b0a30b2a6edca907578b803d 2072 openvpn_2.3.4-5+deb8u2.dsc af506d5f48568fa8d2f2435cb3fad35f9a9a8f263999ea6df3ba296960cec85a 1191101 openvpn_2.3.4.orig.tar.gz a4d4fd8fde0441b0ddc44a87bd4c4ab262519e684660a307d9995774e25d53c2 130596 openvpn_2.3.4-5+deb8u2.debian.tar.xz b19c3656f6a04babf64c5d9279f3a1f7978a8bc13fe5d7baff8f81c07de235df 477340 openvpn_2.3.4-5+deb8u2_amd64.deb Files: ad445bca715a8feff9c62f1d1b3e23ee 2072 net optional openvpn_2.3.4-5+deb8u2.dsc 04d47237907faabe9d046970ffe44b2e 1191101 net optional openvpn_2.3.4.orig.tar.gz b7bb04530285ec110513602660f711e9 130596 net optional openvpn_2.3.4-5+deb8u2.debian.tar.xz a1851924fdc5db8f22e2f9e41f041f37 477340 net optional openvpn_2.3.4-5+deb8u2_amd64.deb -----BEGIN PGP SIGNATURE----- iQJEBAEBCAAuFiEEU0fL2D4wqetNfUvyAJszdWuaqlUFAllRILkQHGFnaUBpbml0 dGFiLm9yZwAKCRAAmzN1a5qqVT+hD/9KfTrXtH2ai/Rvs1mCE7dDHqHkZpaE/ugi NCpHQDqZD0fvUghpuS51QdPWkNtBbai+XFRj/XJiQOI4BqZJErTfYcGdkSOex8Aj Os1RUTEia91gNA3HtMtH0veCdPmbpsVHpZOlxef3UJa655DLVWFffRkQZg+baBwQ CS6rnnmJb2DPm/SRDx4a7zS1afI7jY5lG18FGVPg5vt/u+dMzB4aE0hKydKLyZ2+ Ovb2WtUTgchrXEPWuG46bYxoZmLuyHnbdo4sQf8M8bOMdPEIJOP+0ceCtaAusEkA 7MWFp+SnhP6YTufLUteqb+BLRBjtuGY7Xt9Et3x6LFkIcucqVxWzUMNNwKJAYa+1 0BV1O2TSMn5cnNC8JwFceTViT8ajSJS+clYsPyxMpqrtcXyievHCgO+BPnAv/yIx 3SFgwRayGbwQ8Hj7tjDycWH8Bb4XrP3vVZzqp5adNPpUTPCHfmsAmz8IWCFai/8k xwMHxdmGRTFhEM7dZ+BGZOsr8H/w6ug2mTWdI8I5PZcykwBKMBuV1Rja/W2w+04T CLK9z7q7S+RtaPCaGzijybSVxGR4ITg782BDJhwJe9gojvnDSSuBMvsdzDqa8QG7 XS1OtyKL+dNHj7yaExY6/ddhBVbFJ8B/KyhOXbKW5HcX3i8uUqxVSbfjgBG5xQKB LUn+ze30EQ== =A4Ji -----END PGP SIGNATURE-----
