openssl, branch OpenSSL_0_9_8w TLS/SSL and crypto library. http://git.bktus.com/gpgfrontend/openssl/atom?h=OpenSSL_0_9_8w 2012-04-23T21:03:04Z update STATUS 2012-04-23T21:03:04Z Dr. Stephen Henson steve@openssl.org 2012-04-23T21:03:04Z urn:sha1:e0c020334100e17adf1640c9b4ee27457e077633 correct STATUS 2012-04-23T20:51:18Z Dr. Stephen Henson steve@openssl.org 2012-04-23T20:51:18Z urn:sha1:e1eec61e26b12c9a1e2d5340885c8038d60571a8 correct NEWS 2012-04-23T20:49:21Z Dr. Stephen Henson steve@openssl.org 2012-04-23T20:49:21Z urn:sha1:296fa128c9d2a9eb3ba2db68b1fef1b95f90ac53 prepare form 0.9.8w release 2012-04-23T20:45:29Z Dr. Stephen Henson steve@openssl.org 2012-04-23T20:45:29Z urn:sha1:6dde222aaed732533282a42cd60854796d42d79b update NEWS 2012-04-23T20:43:35Z Dr. Stephen Henson steve@openssl.org 2012-04-23T20:43:35Z urn:sha1:391ac37018d8de8d26bcb69153722e07d56cbb63 The fix for CVE-2012-2110 did not take into account that the 2012-04-23T20:35:55Z Dr. Stephen Henson steve@openssl.org 2012-04-23T20:35:55Z urn:sha1:8d038a08fbd3eb4b2f0a5bf1987bb6689a2a943c 'len' argument to BUF_MEM_grow and BUF_MEM_grow_clean is an int in OpenSSL 0.9.8, making it still vulnerable. Fix by rejecting negative len parameter. Thanks to the many people who reported this bug and to Tomas Hoger <thoger@redhat.com> for supplying the fix. correct error code 2012-04-22T13:31:46Z Dr. Stephen Henson steve@openssl.org 2012-04-22T13:31:46Z urn:sha1:747c6ffda45c00d0bf5ec0d375b68896c02ee770 correct old FAQ answers, sync with HEAD 2012-04-22T13:22:38Z Dr. Stephen Henson steve@openssl.org 2012-04-22T13:22:38Z urn:sha1:d4cddc54f0606c6b3f7016b9ba588dc528f2aa43 prepare for next version 2012-04-19T17:03:28Z Dr. Stephen Henson steve@openssl.org 2012-04-19T17:03:28Z urn:sha1:eb7112c18e893bf31bc90eff8fe8d97fcdd34a39 update FAQ 2012-04-19T12:05:18Z Dr. Stephen Henson steve@openssl.org 2012-04-19T12:05:18Z urn:sha1:fef9e0793071cc0e6f2fd5942760e206d354adad