[SECURITY] [DLA 358-1] openssl security update

2015-12-0322:20:02

lists.debian.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.016 Low

EPSS

Percentile

87.2%

JSON

Package : openssl
Version : 0.9.8o-4squeeze22
CVE ID : CVE-2015-3195

When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak
memory. This structure is used by the PKCS#7 and CMS routines so any
application which reads PKCS#7 or CMS data from untrusted sources is affected.
SSL/TLS is not affected.

Kurt

Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian7mipsellibssl-dev< 1.0.1e-2+deb7u18libssl-dev_1.0.1e-2+deb7u18_mipsel.deb
Debian7s390xlibcrypto1.0.0-udeb< 1.0.1e-2+deb7u18libcrypto1.0.0-udeb_1.0.1e-2+deb7u18_s390x.deb
Debian7kfreebsd-amd64libssl1.0.0< 1.0.1e-2+deb7u18libssl1.0.0_1.0.1e-2+deb7u18_kfreebsd-amd64.deb
Debian8kfreebsd-i386openssl< 1.0.1k-3+deb8u2openssl_1.0.1k-3+deb8u2_kfreebsd-i386.deb
Debian7sparclibssl1.0.0-dbg< 1.0.1e-2+deb7u18libssl1.0.0-dbg_1.0.1e-2+deb7u18_sparc.deb
Debian7kfreebsd-i386libssl1.0.0-dbg< 1.0.1e-2+deb7u18libssl1.0.0-dbg_1.0.1e-2+deb7u18_kfreebsd-i386.deb
Debian6amd64libssl0.9.8-dbg< 0.9.8o-4squeeze22libssl0.9.8-dbg_0.9.8o-4squeeze22_amd64.deb
Debian6i386libssl0.9.8-dbg< 0.9.8o-4squeeze22libssl0.9.8-dbg_0.9.8o-4squeeze22_i386.deb
Debian7mipsopenssl< 1.0.1e-2+deb7u18openssl_1.0.1e-2+deb7u18_mips.deb
Debian8mipslibssl-dev< 1.0.1k-3+deb8u2libssl-dev_1.0.1k-3+deb8u2_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	mipsel	libssl-dev	< 1.0.1e-2+deb7u18	libssl-dev_1.0.1e-2+deb7u18_mipsel.deb
Debian	7	s390x	libcrypto1.0.0-udeb	< 1.0.1e-2+deb7u18	libcrypto1.0.0-udeb_1.0.1e-2+deb7u18_s390x.deb
Debian	7	kfreebsd-amd64	libssl1.0.0	< 1.0.1e-2+deb7u18	libssl1.0.0_1.0.1e-2+deb7u18_kfreebsd-amd64.deb
Debian	8	kfreebsd-i386	openssl	< 1.0.1k-3+deb8u2	openssl_1.0.1k-3+deb8u2_kfreebsd-i386.deb
Debian	7	sparc	libssl1.0.0-dbg	< 1.0.1e-2+deb7u18	libssl1.0.0-dbg_1.0.1e-2+deb7u18_sparc.deb
Debian	7	kfreebsd-i386	libssl1.0.0-dbg	< 1.0.1e-2+deb7u18	libssl1.0.0-dbg_1.0.1e-2+deb7u18_kfreebsd-i386.deb
Debian	6	amd64	libssl0.9.8-dbg	< 0.9.8o-4squeeze22	libssl0.9.8-dbg_0.9.8o-4squeeze22_amd64.deb
Debian	6	i386	libssl0.9.8-dbg	< 0.9.8o-4squeeze22	libssl0.9.8-dbg_0.9.8o-4squeeze22_i386.deb
Debian	7	mips	openssl	< 1.0.1e-2+deb7u18	openssl_1.0.1e-2+deb7u18_mips.deb
Debian	8	mips	libssl-dev	< 1.0.1k-3+deb8u2	libssl-dev_1.0.1k-3+deb8u2_mips.deb