Lucene search

K
suseSuseSUSE-SU-2016:1290-1
HistoryMay 12, 2016 - 8:08 p.m.

Security update for openssl (important)

2016-05-1220:08:02
lists.opensuse.org
53

0.898 High

EPSS

Percentile

98.5%

This update for openssl fixes the following issues:

Security issues fixed:

  • CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617)
  • CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614)
  • CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615)
  • CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942)
  • CVE-2016-0702: Side channel attack on modular exponentiation
    "CacheBleed" (bsc#968050)

Bugs fixed:

  • fate#320304: build 32bit devel package
  • bsc#976943: Fix buffer overrun in ASN1_parse
  • bsc#973223: allow weak DH groups, vulnerable to the logjam attack, when
    environment variable OPENSSL_ALLOW_LOGJAM_ATTACK is set
  • bsc#889013: Rename README.SuSE to the new spelling