Skip to content
  1. Jan 04, 2015
  2. Jan 02, 2015
  3. Dec 31, 2014
  4. Dec 30, 2014
  5. Dec 22, 2014
  6. Dec 20, 2014
  7. Dec 19, 2014
  8. Dec 18, 2014
  9. Dec 17, 2014
  10. Dec 16, 2014
  11. Dec 15, 2014
  12. Dec 13, 2014
  13. Dec 12, 2014
  14. Dec 08, 2014
  15. Dec 05, 2014
    • Emilia Kasper's avatar
      Reject elliptic curve lists of odd lengths. · 321ba858
      Emilia Kasper authored
      
      
      The Supported Elliptic Curves extension contains a vector of NamedCurves
      of 2 bytes each, so the total length must be even. Accepting odd-length
      lists was observed to lead to a non-exploitable one-byte out-of-bounds
      read in the latest development branches (1.0.2 and master). Released
      versions of OpenSSL are not affected.
      
      Thanks to Felix Groebert of the Google Security Team for reporting this issue.
      
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      (cherry picked from commit 33d5ba86)
      321ba858
  16. Dec 04, 2014
  17. Dec 03, 2014