From owner-freebsd-questions@FreeBSD.ORG  Wed Apr  9 19:14:37 2014
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 3F312E3A
 for <freebsd-questions@freebsd.org>; Wed,  9 Apr 2014 19:14:37 +0000 (UTC)
Received: from smarthost1.sentex.ca (smarthost1.sentex.ca
 [IPv6:2607:f3e0:0:1::12])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client CN "smarthost.sentex.ca", Issuer "smarthost.sentex.ca" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id 04A62131B
 for <freebsd-questions@freebsd.org>; Wed,  9 Apr 2014 19:14:36 +0000 (UTC)
Received: from [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a] (saphire3.sentex.ca
 [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a])
 by smarthost1.sentex.ca (8.14.8/8.14.8) with ESMTP id s39JEWqp033580;
 Wed, 9 Apr 2014 15:14:33 -0400 (EDT) (envelope-from mike@sentex.net)
Message-ID: <53459C19.8030000@sentex.net>
Date: Wed, 09 Apr 2014 15:14:33 -0400
From: Mike Tancsa <mike@sentex.net>
Organization: Sentex Communications
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: Per olof Ljungmark <peo@intersonic.se>,
 "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org>
Subject: Re: [FreeBSD-Announce] FreeBSD Security Advisory
 FreeBSD-SA-14:06.openssl [REVISED]
References: <201404090106.s3916VRm035425@freefall.freebsd.org>
 <5345955D.5080209@intersonic.se>
In-Reply-To: <5345955D.5080209@intersonic.se>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.74
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Apr 2014 19:14:37 -0000

On 4/9/2014 2:45 PM, Per olof Ljungmark wrote:
> Can someone please shed a little light why this advisory says STABLE/9
> is affected, but
> https://heartbleed.com/
> says it is not?

There are 2 different issues [CVE-2014-0160] and [CVE-2014-0076] in the 
FreeBSD advisory.

"OpenSSL multiple vulnerabilities"
          ^^^^^^^^

The one that impacts 8 and 9 is

A local attacker might be able to snoop a signing process and might recover
the signing key from it.  [CVE-2014-0076]


	---Mike


-- 
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike@sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/