Alerts This Week
Warning Icon 1 659
Alerts This Week
Warning Icon 1 659

openSUSE: 2016:1239-1 Important: Libopenssl Buffer Overrun

opensuse
Calendar Grey May 5, 2016
Dist Opensuse Esm H88
Address various vulnerabilities in libopenssl0_9_8 through the recent openSUSE upgrade to bolster overall system security.
An update that solves 9 vulnerabilities and has one errata An update that solves 9 vulnerabilities and has one errata An update that solves 9 vulnerabilities and has one errata is ...

Description

This update for libopenssl0_9_8 fixes the following issues:

- CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614)

- CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615)

- CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617)

- CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942)

- CVE-2016-0702: Side channel attack on modular exponentiation

"CacheBleed" (bsc#968050)

- bsc#976943: Buffer overrun in ASN1_parse

and updates the package to version 0.9.8zh which collects many other

fixes, including security ones.

Topics%20covered

Topics Covered

security advisory buffer overrun security fix important system update openSUSE libopenssl

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE Evergreen 11.4:

zypper in -t patch 2016-563=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE Evergreen 11.4 (i586 x86_64):

libopenssl0_9_8-0.9.8zh-14.1

libopenssl0_9_8-debuginfo-0.9.8zh-14.1

libopenssl0_9_8-debugsource-0.9.8zh-14.1

- openSUSE Evergreen 11.4 (x86_64):

libopenssl0_9_8-32bit-0.9.8zh-14.1

libopenssl0_9_8-debuginfo-32bit-0.9.8zh-14.1

- openSUSE Evergreen 11.4 (ia64):

libopenssl0_9_8-debuginfo-x86-0.9.8zh-14.1

libopenssl0_9_8-x86-0.9.8zh-14.1

References

https://www.suse.com/security/cve/CVE-2015-3197.html

https://www.suse.com/security/cve/CVE-2016-0702.html

https://www.suse.com/security/cve/CVE-2016-0797.html

https://www.suse.com/security/cve/CVE-2016-0799.html

https://www.suse.com/security/cve/CVE-2016-0800.html

https://www.suse.com/security/cve/CVE-2016-2105.html

https://www.suse.com/security/cve/CVE-2016-2106.html

https://www.suse.com/security/cve/CVE-2016-2108.html

https://www.suse.com/security/cve/CVE-2016-2109.html

https://bugzilla.suse.com/963415

https://bugzilla.suse.com/968046

https://bugzilla.suse.com/968048

https://bugzilla.suse.com/968050

https://bugzilla.suse.com/968374

https://bugzilla.suse.com/976942

https://bugzilla.suse.com/976943

https://bugzilla.suse.com/977614

https://bugzilla.suse.com/977615

https://bugzilla.suse.com/977617

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2016:1239-1
Rating: important
Affected Products: openSUSE Evergreen 11.4

Topics%20covered

Topics Covered

security advisory buffer overrun security fix important system update openSUSE libopenssl

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here