[Secure-testing-team] Bug#865480: openvpn: CVE-2017-7508 CVE-2017-7520 CVE-2017-7521

[Salvatore Bonaccorso]

Source: openvpn
Version: 2.3.4-1
Severity: grave
Tags: security upstream

Hi,

the following vulnerabilities were published for openvpn.

CVE-2017-7508[0]:
Remotely-triggerable ASSERT() on malformed IPv6 packet

CVE-2017-7520[1]:
Pre-authentication remote crash/information disclosure for clients

CVE-2017-7521[2]:
Potential double-free in --x509-alt-username and memory leaks

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-7508
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7508
[1] https://security-tracker.debian.org/tracker/CVE-2017-7520
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7520
[2] https://security-tracker.debian.org/tracker/CVE-2017-7521
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7521
[3] https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243
[4] http://www.openwall.com/lists/oss-security/2017/06/21/6

Regards,
Salvatore