Ubuntu 14.10: USN-2537-1 Moderate OpenSSL Denial Of Service Threat

ubuntu

March 19, 2015

Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

It was discovered that OpenSSL incorrectly handled malformed EC private key

files. A remote attacker could possibly use this issue to cause OpenSSL to

crash, resulting in a denial of service, or execute arbitrary code.

(CVE-2015-0209)

Stephen Henson discovered that OpenSSL incorrectly handled comparing ASN.1

boolean types. A remote attacker could possibly use this issue to cause

OpenSSL to crash, resulting in a denial of service. (CVE-2015-0286)

Emilia Käsper discovered that OpenSSL incorrectly handled ASN.1 structure

reuse. A remote attacker could possibly use this issue to cause OpenSSL to

crash, resulting in a denial of service, or execute arbitrary code.

(CVE-2015-0287)

Brian Carpenter discovered that OpenSSL incorrectly handled invalid

certificate keys. A remote attacker could possibly use this issue to...

Read the Full Advisory

Topics Covered

security advisory denial of service security issue security fix Ubuntu OpenSSL update instructions

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libssl1.0.0                     1.0.1f-1ubuntu9.4

Ubuntu 14.04 LTS:
  libssl1.0.0                     1.0.1f-1ubuntu2.11

Ubuntu 12.04 LTS:
  libssl1.0.0                     1.0.1-4ubuntu5.25

Ubuntu 10.04 LTS:
  libssl0.9.8                     0.9.8k-7ubuntu8.27

After a standard system update you need to reboot your computer to make
all the necessary changes.