Security update for openssl (important)

2012-05-30T23:08:17
ID SUSE-SU-2012:0674-1
Type suse
Reporter Suse
Modified 2012-05-30T23:08:17

Description

This update of openssl fixes the following security issues:

  • Denial of Service or crash via CBC mode handling. (CVE-2012-2333 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2333">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2333</a> > )
  • Incorrect integer conversions that could result in memory corruption. (CVE-2012-2110 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110</a> > , CVE-2012-2131 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2131">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2131</a> > )
  • Potential memory leak in multithreaded key creation.
  • Symmetric crypto errors in PKCS7_decrypt.
  • Free headers after use in error message.
  • S/MIME verification may erroneously fail.
  • Tolerating bad MIME headers in ANS.1 parser. (CVE-2012-1165 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1165">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1165</a> > , CVE-2006-7250 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7250">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7250</a> > )
  • DTLS DoS Attack. (CVE-2012-0050 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0050">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0050</a> > )
  • DTLS Plaintext Recovery Attack. (CVE-2011-4108 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4108">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4108</a> > )
  • Double-free in Policy Checks. (CVE-2011-4109 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4109">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4109</a> > )
  • Uninitialized SSL 3.0 Padding. (CVE-2011-4576 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4576">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4576</a> > )
  • SGC Restart DoS Attack. (CVE-2011-4619 <<a rel="nofollow" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619</a> > )