Testing performed by the OpenSSL group using the Codenomicon
TLS Test Tool uncovered a null-pointer assignment in the
do_change_cipher_spec() function in OpenSSL 0.9.6c-0.9.6k and
0.9.7a-0.9.7c.  A remote attacker could perform a carefully
crafted SSL/TLS handshake against a server that used the
OpenSSL library in such a way as to cause OpenSSL to crash.
Depending on the application this could lead to a denial of
service.  The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0079 to this
issue.

        CAN-2004-0079 Affects: 3AS 3ES 3WS

Stephen Henson discovered a flaw in SSL/TLS handshaking code
when using Kerberos ciphersuites in OpenSSL 0.9.7a-0.9.7c.  A
remote attacker could perform a carefully crafted SSL/TLS
handshake against a server configured to use Kerberos
ciphersuites in such a way as to cause OpenSSL to crash.  Most
applications have no ability to use Kerberos ciphersuites and
will therefore be unaffected by this issue.  The Common
Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0112 to this issue.

        CAN-2004-0112 Affects: 3AS 3ES 3WS

Testing performed by the OpenSSL group using the Codenomicon
TLS Test Tool uncovered a bug in older versions of OpenSSL
0.9.6 prior to 0.9.6d that can lead to a Denial of Service
attack (infinite loop).  The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0081 to this issue.

        CAN-2004-0081 Affects: 2.1AS 2.1AW 2.1ES 2.1WS (+095a)
        CAN-2004-0081 Affects: 3AS 3ES 3WS (096b packages)

Notified by NISCC
Embargoed until March 17th 1400UTC