We have released LibreSSL 2.0.5, which should be arriving in the LibreSSL directory of an OpenBSD mirror near you. This version forward-ports security fixes from OpenSSL 1.0.1i, including fixes for the following CVEs: CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 (partially vulnerable) CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 LibreSSL 2.0.4 was not found vulnerable to the following CVEs: CVE-2014-5139 CVE-2014-3512 CVE-2014-3505 We welcome feedback and support from the community as we continue to work on LibreSSL. Thank you, Brent
Our question is: Why wasn't LibreSSL affected by the CVE-2014-5139, CVE-2014-3512, CVE-2014-3505 and only partially vulnerable for: CVE-2014-3508? Can someone please explain in short?
The OpenSSL Security Advisory Link: https://www.openssl.org/news/secadv_20140806.txt