LibreSSL errata
11 June, 2015
•
by doug@acyclic.org
Patches are now available to fix a few issues in LibreSSL's libcrypto.
CVE-2015-1788 - Malformed ECParameters causes infinite loop
CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time
CVE-2015-1792 - CMS verify infinite loop with unknown hash function
Note that CMS was already disabled in LibreSSL.
Several other issues did not apply or were already fixed and one low
severity issue is under review. For more information, see
https://www.openssl.org/news/secadv_20150611.txt
Thanks to the OpenSSL team for providing patches.
5.7 patch:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/009_openssl.patch.sig
http://www.openbsd.org/errata57.html
5.6 patch:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/026_openssl.patch.sig
http://www.openbsd.org/errata56.html