OpenSSL 0.9.8k

OpenSSL is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.
The OpenSSL project is managed and maintained by a worldwide community of volunteers that use the Internet to plan, communicate, and develop the OpenSSL toolkit and its related documentation.
OpenSSL is based on the excellent SSLeay library developed from Eric A. Young and Tim J. Hudson.
NOTE: The OpenSSL toolkit is licensed under an Apache-style licence, which basically means that you are free to get and use it for commercial and non-commercial purposes subject to some simple license conditions.

Enhancements
- Dont set val to NULL when freeing up structures, it is freed up by underlying code. If sizeof(void *) > sizeof(long) this can result in zeroing past the valid field. (CVE-2009-0789) [Paolo Ganci ]
- Fix bug where return value of CMS_SignerInfo_verify_content() was not checked correctly. This would allow some invalid signed attributes to appear to verify correctly. (CVE-2009-0591) [Ivan Nestlerode ]
- Reject UniversalString and BMPString types with invalid lengths. This prevents a crash in ASN1_STRING_print_ex() which assumes the strings have a legal length. (CVE-2009-0590) [Steve Henson]
- Set S/MIME signing as the default purpose rather than setting it unconditionally. This allows applications to override it at the store level. [Steve Henson]
- Permit restricted recursion of ASN1 strings. This is needed in practice to handle some structures. [Steve Henson]
- Improve efficiency of mem_gets: dont search whole buffer each time for a
- [Jeremy Shapiro ]
- New -hex option for openssl rand. [Matthieu Herrb]
- Print out UTF8String and NumericString when parsing ASN1. [Steve Henson]
- Support NumericString type for name components. [Steve Henson]
- Allow CC in the environment to override the automatically chosen compiler. Note that nothing is done to ensure flags work with the chosen compiler. [Ben Laurie]