Ubuntu 15.04 LTS USN-2639-1 Critical: OpenSSL Denial of Service

ubuntu

June 11, 2015

Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that

OpenSSL incorrectly handled memory when buffering DTLS data. A remote

attacker could use this issue to cause OpenSSL to crash, resulting in a

denial of service, or possibly execute arbitrary code. (CVE-2014-8176)

Joseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed

ECParameters structures. A remote attacker could use this issue to cause

OpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)

Robert Swiecki and Hanno Böck discovered that OpenSSL incorrectly handled

certain ASN1_TIME strings. A remote attacker could use this issue to cause

OpenSSL to crash, resulting in a denial of service. (CVE-2015-1789)

Michal Zalewski discovered that OpenSSL incorrectly handled missing content

when parsing ASN.1-encoded PKC...

Read the Full Advisory

Topics Covered

security advisory denial of service security update remote exploit critical flaw ubuntu openssl

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  libssl1.0.0                     1.0.1f-1ubuntu11.4

Ubuntu 14.10:
  libssl1.0.0                     1.0.1f-1ubuntu9.8

Ubuntu 14.04 LTS:
  libssl1.0.0                     1.0.1f-1ubuntu2.15

Ubuntu 12.04 LTS:
  libssl1.0.0                     1.0.1-4ubuntu5.31

After a standard system update you need to reboot your computer to make
all the necessary changes.