Ubuntu 16.04 LTS: USN-3087-2 Moderate OpenSSL Regression Issues

ubuntu

September 23, 2016

USN-3087-1 introduced a regression in OpenSSL.

Summary

USN-3087-1 introduced a regression in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was

incomplete and caused a regression when parsing certificates. This update

fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request

extension. A remote attacker could possibly use this issue to cause memory

consumption, resulting in a denial of service. (CVE-2016-6304)

Guido Vranken discovered that OpenSSL used undefined behaviour when

performing pointer arithmetic. A remote attacker could possibly use this

issue to cause OpenSSL to crash, resulting in a denial of service. This

issue has only been addressed in Ubuntu 16.04 LTS in this update.

(CVE-2016-2177)

César Pereida, Billy Brumley, and Yuval Yarom discovered that OpenS...

Read the Full Advisory

Topics Covered

security advisory denial of service Ubuntu OpenSSL moderate threat update instructions OpenSSL regression

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libssl1.0.0                     1.0.2g-1ubuntu4.5

Ubuntu 14.04 LTS:
  libssl1.0.0                     1.0.1f-1ubuntu2.21

Ubuntu 12.04 LTS:
  libssl1.0.0                     1.0.1-4ubuntu5.38

After a standard system update you need to reboot your computer to make
all the necessary changes.