Stay Secure with the Latest Linux Advisories

security advisorymoderateOpenSSL

Scientific Linux 5 OpenSSL Moderate Alert SLSA-2014-1053-1 CVE-2014-0221

Moderate: openssl security update. Date: Thu, 14 Aug 2014 13:24:35 +0000 Reply-To: scientific-linux-users@ Sender: Security Errata for Scientific Linux From: Pat Riehecky Subject: Security ERRATA Moderate: openssl on SL5.x i386/x86_64 MIME-Version: 1.0 Synopsis: Moderate: openssl security update Advisory ID: SLSA-2014:1053-1 Issue Date: 2014-08-13 CVE Numbers: CVE-2014-0221 CVE-2014-3508 CVE-2014-3505 CVE-2014-3506 CVE-2014-3510 -- It was discovered that the OBJ_obj2txt() function could fail to properly NUL-terminate its output. This could possibly cause an application using OpenSSL functions to format fields of X.509 certificates to disclose portions of its memory. (CVE-2014-3508) Multiple flaws were discovered in the way OpenSSL handled DTLS packets. A remote attacker could use these flaws to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory. (CVE-2014-0221, CVE-2014-3505, CVE-2014-3506) A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman (DH) key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled. (CVE-2014-3510) For the update to take effect, all services linked to the OpenSSL library (such as httpd and other SSL-enabled services) must be restarted or the system rebooted. -- SL5 x86_64 openssl-0.9.8e-27.el5_10.4.i686.rpm openssl-0.9.8e-27.el5_10.4.x86_64.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i686.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.x86_64.rpm openssl-perl-0.9.8e-27.el5_10.4.x86_64.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i386.rpm openssl-devel-0.9.8e-27.el5_10.4.i386.rpm openssl-devel-0.9.8e-27.el5_10.4.x86_64.rpm i386 openssl-0.9.8e-27.el5_10.4.i386.rpm openssl-0.9.8e-27.el5_10.4.i686.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i386.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i686.rpm openssl-perl-0.9.8e-27.el5_10.4.i386.rpm openssl-devel-0.9.8e-27.el5_10.4.i386.rpm - Scientific LinuxDevelopment Team . The most recent software patch for OpenSSL fixes issues related to information leaks and operational failures.. OpenSSL Update, Scientific Linux Security, Security Patch. . Severity: moderate. LinuxSecurity.com Team

Aug 14, 2014 •moderate Scientific Linux