Skip to content
  1. Dec 19, 2014
  2. Dec 18, 2014
  3. Dec 17, 2014
  4. Dec 16, 2014
  5. Dec 15, 2014
  6. Dec 13, 2014
  7. Dec 12, 2014
  8. Dec 08, 2014
  9. Dec 05, 2014
    • Emilia Kasper's avatar
      Reject elliptic curve lists of odd lengths. · 321ba858
      Emilia Kasper authored
      
      
      The Supported Elliptic Curves extension contains a vector of NamedCurves
      of 2 bytes each, so the total length must be even. Accepting odd-length
      lists was observed to lead to a non-exploitable one-byte out-of-bounds
      read in the latest development branches (1.0.2 and master). Released
      versions of OpenSSL are not affected.
      
      Thanks to Felix Groebert of the Google Security Team for reporting this issue.
      
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      (cherry picked from commit 33d5ba86)
      321ba858
  10. Dec 04, 2014
  11. Dec 03, 2014
  12. Dec 02, 2014
  13. Nov 28, 2014