Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

openSUSE 13.2: 2015:0130-1 Important: OpenSSL Security Fix

opensuse
Calendar Grey January 23, 2015
Scroller Opensuse
Update addresses several security vulnerabilities in openssl: Important advisory openSUSE-SU-2023:0567-1 offers relevant information.
An update that fixes 8 vulnerabilities is now available

Description

openssl was updated to 1.0.1k to fix various security issues and bugs.

More information can be found in the openssl advisory:

Following issues were fixed:

* CVE-2014-3570 (bsc#912296): Bignum squaring (BN_sqr) may have produced

incorrect results on some platforms, including x86_64.

* CVE-2014-3571 (bsc#912294): Fixed crash in dtls1_get_record whilst in

the listen state where you get two separate reads performed - one for

the header and one for the body of the handshake record.

* CVE-2014-3572 (bsc#912015): Don't accept a handshake using an ephemeral

ECDH ciphersuites with the server key exchange message omitted.

* CVE-2014-8275 (bsc#912018): Fixed various certificate fingerprint issues.

* CVE-2015-0204 (bsc#912014): Only allow ephemeral RSA keys in export

ciphersuites

* CVE-2015-0205 (bsc#912293): A fixwas added to prevent use of DH client

certificates without sending certificate verify message.

* CVE-2015-0206...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory security issue threat patch important openssl openSUSE

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE 13.2:

zypper in -t patch openSUSE-2015-67

- openSUSE 13.1:

zypper in -t patch openSUSE-2015-67

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE 13.2 (i586 x86_64):

libopenssl-devel-1.0.1k-2.16.2

libopenssl1_0_0-1.0.1k-2.16.2

libopenssl1_0_0-debuginfo-1.0.1k-2.16.2

libopenssl1_0_0-hmac-1.0.1k-2.16.2

openssl-1.0.1k-2.16.2

openssl-debuginfo-1.0.1k-2.16.2

openssl-debugsource-1.0.1k-2.16.2

- openSUSE 13.2 (x86_64):

libopenssl-devel-32bit-1.0.1k-2.16.2

libopenssl1_0_0-32bit-1.0.1k-2.16.2

libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.16.2

libopenssl1_0_0-hmac-32bit-1.0.1k-2.16.2

- openSUSE 13.2 (noarch):

openssl-doc-1.0.1k-2.16.2

- openSUSE 13.1 (i586 x86_64):

libopenssl-devel-1.0.1k-11.64.2

libopenssl1_0_0-1.0.1k-11.64.2

libopenssl1_0_0-debuginfo-1.0.1k-11.64.2

openssl-1.0.1k-11.64.2

openssl-debuginfo-1.0.1k-11.64.2

openssl-debugsource-1.0.1k-11.64.2

- openSUSE 13.1 (x86_64):

libopenssl-devel-32bit-1.0.1k-11.64.2

libopenssl1_0_0-32bit-1.0.1k-11.64.2

libopenssl1_0_0-debuginfo-32bit-1.0.1k-11.64.2

- openSUSE 13.1 (noarch):

openssl-doc-1.0.1k-11.64.2

References

https://www.suse.com/security/cve/CVE-2014-3569.html

https://www.suse.com/security/cve/CVE-2014-3570.html

https://www.suse.com/security/cve/CVE-2014-3571.html

https://www.suse.com/security/cve/CVE-2014-3572.html

https://www.suse.com/security/cve/CVE-2014-8275.html

https://www.suse.com/security/cve/CVE-2015-0204.html

https://www.suse.com/security/cve/CVE-2015-0205.html

https://www.suse.com/security/cve/CVE-2015-0206.html

https://bugzilla.suse.com/show_bug.cgi?id=911399

https://bugzilla.suse.com/show_bug.cgi?id=912014

https://bugzilla.suse.com/show_bug.cgi?id=912015

https://bugzilla.suse.com/show_bug.cgi?id=912018

https://bugzilla.suse.com/show_bug.cgi?id=912292

https://bugzilla.suse.com/show_bug.cgi?id=912293

https://bugzilla.suse.com/show_bug.cgi?id=912294

https://bugzilla.suse.com/show_bug.cgi?id=912296

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2015:0130-1
Rating: important
Affected Products: openSUSE 13.2 openSUSE 13.1 .

Topics%20covered

Topics Covered

security advisory security issue threat patch important openssl openSUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.