Security update for libcryptopp SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:3301-1 Final 1 1 2021-10-06T14:58:44Z current 2021-10-06T14:58:44Z 2021-10-06T14:58:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libcryptopp This update for libcryptopp fixes the following issues: - CVE-2016-9939: Fixed potential DoS in Crypto++ (libcryptopp) ASN.1 parser (bsc#1015243). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2021-3301 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OT7AMKZYZG3NMSSJK4GVQCGFPLIGSKD5/ E-Mail link for openSUSE-SU-2021:3301-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1015243 SUSE Bug 1015243 https://www.suse.com/security/cve/CVE-2016-9939/ SUSE CVE CVE-2016-9939 page openSUSE Leap 15.3 libcryptopp-devel-5.6.5-1.6.1 libcryptopp5_6_5-5.6.5-1.6.1 libcryptopp5_6_5-32bit-5.6.5-1.6.1 libcryptopp-devel-5.6.5-1.6.1 as a component of openSUSE Leap 15.3 libcryptopp5_6_5-5.6.5-1.6.1 as a component of openSUSE Leap 15.3 libcryptopp5_6_5-32bit-5.6.5-1.6.1 as a component of openSUSE Leap 15.3 Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation. CVE-2016-9939 openSUSE Leap 15.3:libcryptopp-devel-5.6.5-1.6.1 openSUSE Leap 15.3:libcryptopp5_6_5-32bit-5.6.5-1.6.1 openSUSE Leap 15.3:libcryptopp5_6_5-5.6.5-1.6.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OT7AMKZYZG3NMSSJK4GVQCGFPLIGSKD5/ https://www.suse.com/security/cve/CVE-2016-9939.html CVE-2016-9939 https://bugzilla.suse.com/1015243 SUSE Bug 1015243