Skip to content
  1. Dec 12, 2014
  2. Dec 08, 2014
  3. Dec 05, 2014
    • Emilia Kasper's avatar
      Reject elliptic curve lists of odd lengths. · 321ba858
      Emilia Kasper authored
      
      
      The Supported Elliptic Curves extension contains a vector of NamedCurves
      of 2 bytes each, so the total length must be even. Accepting odd-length
      lists was observed to lead to a non-exploitable one-byte out-of-bounds
      read in the latest development branches (1.0.2 and master). Released
      versions of OpenSSL are not affected.
      
      Thanks to Felix Groebert of the Google Security Team for reporting this issue.
      
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      (cherry picked from commit 33d5ba86)
      321ba858
  4. Dec 04, 2014
  5. Dec 03, 2014
  6. Dec 02, 2014
  7. Nov 28, 2014
  8. Nov 27, 2014
  9. Nov 26, 2014
  10. Nov 25, 2014
  11. Nov 20, 2014