Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 536
Alerts This Week
Warning Icon 1 536

Debian DSA-3413-1 Critical Alert: OpenSSL Denial of Service Vulnerabilities

debian
Calendar Grey December 4, 2015
Scroller Debian
Tackle various vulnerabilities in OpenSSL as outlined in Debian Advisory DSA-3413-1. It's essential to update your openssl packages immediately.
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit
Topics%20covered

Topics Covered

security advisory denial of service high severity debian memory leak openssl oldstable

Summary

CVE-2015-3194

Loic Jonas Etienne of Qnective AG discovered that the signature
verification routines will crash with a NULL pointer dereference if
presented with an ASN.1 signature using the RSA PSS algorithm and
absent mask generation function parameter. A remote attacker can
exploit this flaw to crash any certificate verification operation
and mount a denial of service attack.

CVE-2015-3195

Adam Langley of Google/BoringSSL discovered that OpenSSL will leak
memory when presented with a malformed X509_ATTRIBUTE structure.

CVE-2015-3196

A race condition flaw in the handling of PSK identify hints was
discovered, potentially leading to a double free of the identify
hint data.

For the oldstable distribution (wheezy), these problems have been fixed
in version 1.0.1e-2+deb7u18.

For the stable distribution (jessie), these problems have been fixed in
version 1.0.1k-3+deb8u2.

For the unstable distribution (sid), these problems have been fixed in
version 1.0.2e-1 or ea...

Read the Full Advisory

Severity
critical
Lowest
Low
Medium
High
Critical

Package: openssl
CVE ID: CVE-2015-3194 CVE-2015-3195 CVE-2015-3196

Topics%20covered

Topics Covered

security advisory denial of service high severity debian memory leak openssl oldstable

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.