Alerts This Week
Warning Icon 1 560
Alerts This Week
Warning Icon 1 560

UBUNTU: 2019:3923-1 Critical: OpenSSL-Crypto1 Service Interruption

suse
Calendar Grey September 14, 2018
Dist Suse Esm H88
SUSE has released a security update for openssh-openssl1, addressing four vulnerabilities that pose significant risks. Users are urged to apply this update without delay
An update that solves four vulnerabilities and has three fixes is now available

Summary

This update for openssh-openssl1 fixes the following issues: These security issues were fixed: - CVE-2016-10708: Prevent NULL pointer dereference via an out-of-sequence NEWKEYS message allowed remote attackers to cause a denial of service (bsc#1076957). - CVE-2017-15906: The process_open function did not properly prevent write operations in readonly mode, which allowed attackers to create zero-length files (bsc#1065000). - CVE-2016-10012: The shared memory manager (associated with pre-authentication compression) did not ensure that a bounds check is enforced by all compilers, which might have allowed local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures (bsc#1016370).

References

#1016370 #1017099 #1023275 #1053972 #1065000

#1069509 #1076957

Cross- CVE-2008-1483 CVE-2016-10012 CVE-2016-10708

CVE-2017-15906

Affected Products:

SUSE Linux Enterprise Server 11-SECURITY

https://www.suse.com/security/cve/CVE-2008-1483.html

https://www.suse.com/security/cve/CVE-2016-10012.html

https://www.suse.com/security/cve/CVE-2016-10708.html

https://www.suse.com/security/cve/CVE-2017-15906.html

https://bugzilla.suse.com/1016370

https://bugzilla.suse.com/1017099

https://bugzilla.suse.com/1023275

https://bugzilla.suse.com/1053972

https://bugzilla.suse.com/1065000

https://bugzilla.suse.com/1069509

https://bugzilla.suse.com/1076957

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2018:2719-1
Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here