Security update for openssl SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:1237-1 Final 1 1 2016-05-05T07:43:11Z current 2016-05-05T07:43:11Z 2016-05-05T07:43:11Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl This update for openssl fixes the following issues: - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (bsc#977616) - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - bsc#976943: Buffer overrun in ASN1_parse The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html E-Mail link for openSUSE-SU-2016:1237-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings libopenssl-devel-1.0.1k-11.87.1 libopenssl-devel-32bit-1.0.1k-11.87.1 libopenssl1_0_0-1.0.1k-11.87.1 libopenssl1_0_0-32bit-1.0.1k-11.87.1 openssl-1.0.1k-11.87.1 openssl-doc-1.0.1k-11.87.1 Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data. CVE-2016-2105 low 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html https://www.suse.com/security/cve/CVE-2016-2105.html CVE-2016-2105 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977614 SUSE Bug 977614 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989902 SUSE Bug 989902 https://bugzilla.suse.com/990369 SUSE Bug 990369 https://bugzilla.suse.com/990370 SUSE Bug 990370 Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data. CVE-2016-2106 low 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html https://www.suse.com/security/cve/CVE-2016-2106.html CVE-2016-2106 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977615 SUSE Bug 977615 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/990369 SUSE Bug 990369 The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169. CVE-2016-2107 important 7.1 AV:N/AC:M/Au:N/C:C/I:N/A:N 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html https://www.suse.com/security/cve/CVE-2016-2107.html CVE-2016-2107 https://bugzilla.suse.com/976942 SUSE Bug 976942 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977616 SUSE Bug 977616 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/990369 SUSE Bug 990369 https://bugzilla.suse.com/990370 SUSE Bug 990370 The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. CVE-2016-2108 important 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html https://www.suse.com/security/cve/CVE-2016-2108.html CVE-2016-2108 https://bugzilla.suse.com/1001502 SUSE Bug 1001502 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977617 SUSE Bug 977617 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989345 SUSE Bug 989345 https://bugzilla.suse.com/996067 SUSE Bug 996067 The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding. CVE-2016-2109 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html https://www.suse.com/security/cve/CVE-2016-2109.html CVE-2016-2109 https://bugzilla.suse.com/976942 SUSE Bug 976942 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/990369 SUSE Bug 990369