Stay Secure with the Latest Linux Advisories

security advisorydenial of servicedebian

Debian: DSA-2454-1 Moderate: OpenSSL Remote Threats and Issues

Multiple vulnerabilities have been found in OpenSSL. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2012-0884 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2454-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Raphael Geissert April 19, 2012 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : openssl Vulnerability : multiple Problem type : remote Debian-specific: no CVE ID : CVE-2012-0884 CVE-2012-1165 CVE-2012-2110 Multiple vulnerabilities have been found in OpenSSL. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2012-0884 Ivan Nestlerode discovered a weakness in the CMS and PKCS #7 implementations that could allow an attacker to decrypt data via a Million Message Attack (MMA). CVE-2012-1165 It was discovered that a NULL pointer could be dereferenced when parsing certain S/MIME messages, leading to denial of service. CVE-2012-2110 Tavis Ormandy, Google Security Team, discovered a vulnerability in the way DER-encoded ASN.1 data is parsed that can result in a heap overflow. Additionally, the fix for CVE-2011-4619 has been updated to address an issue with SGC handshakes. For the stable distribution (squeeze), these problems have been fixed in version 0.9.8o-4squeeze11. For the testing distribution (wheezy), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 1.0.1a-1. We recommend that you upgrade your openssl packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Recent findings show OpenSSL hasserious security flaws that could allow unauthorized remote data decryption and possible Denial of Service attacks, especially on Debian systems. Openssl Security Update, Debian Vulnerabilities, Remote Threats. . LinuxSecurity.com Team

Apr 19, 2012 Debian