Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

openSUSE Leap 42.1: 2016:1242-1 Critical Libopenssl Patch

opensuse
Calendar Grey May 5, 2016
Scroller Opensuse
An important patch for libopenssl1_1_1 in Fedora addresses serious security flaws that may affect devices.
An update that solves 5 vulnerabilities and has one errata An update that solves 5 vulnerabilities and has one errata An update that solves 5 vulnerabilities and has one errata is ...

Description

This update for libopenssl0_9_8 fixes the following issues:

- CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614)

- CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615)

- CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617)

- CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942)

- CVE-2016-0702: Side channel attack on modular exponentiation

"CacheBleed" (bsc#968050)

- bsc#976943: Buffer overrun in ASN1_parse

Topics%20covered

Topics Covered

security advisory critical buffer overrun memory overflow openSUSE libopenssl patch

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.1:

zypper in -t patch openSUSE-2016-565=1

- openSUSE 13.2:

zypper in -t patch openSUSE-2016-565=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE Leap 42.1 (i586 x86_64):

libopenssl0_9_8-0.9.8zh-17.1

libopenssl0_9_8-debuginfo-0.9.8zh-17.1

libopenssl0_9_8-debugsource-0.9.8zh-17.1

- openSUSE Leap 42.1 (x86_64):

libopenssl0_9_8-32bit-0.9.8zh-17.1

libopenssl0_9_8-debuginfo-32bit-0.9.8zh-17.1

- openSUSE 13.2 (i586 x86_64):

libopenssl0_9_8-0.9.8zh-9.6.1

libopenssl0_9_8-debuginfo-0.9.8zh-9.6.1

libopenssl0_9_8-debugsource-0.9.8zh-9.6.1

- openSUSE 13.2 (x86_64):

libopenssl0_9_8-32bit-0.9.8zh-9.6.1

libopenssl0_9_8-debuginfo-32bit-0.9.8zh-9.6.1

References

https://www.suse.com/security/cve/CVE-2016-0702.html

https://www.suse.com/security/cve/CVE-2016-2105.html

https://www.suse.com/security/cve/CVE-2016-2106.html

https://www.suse.com/security/cve/CVE-2016-2108.html

https://www.suse.com/security/cve/CVE-2016-2109.html

https://bugzilla.suse.com/968050

https://bugzilla.suse.com/976942

https://bugzilla.suse.com/976943

https://bugzilla.suse.com/977614

https://bugzilla.suse.com/977615

https://bugzilla.suse.com/977617

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2016:1242-1
Rating: important
Affected Products: openSUSE Leap 42.1 openSUSE 13.2

Topics%20covered

Topics Covered

security advisory critical buffer overrun memory overflow openSUSE libopenssl patch

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.