SUSE-SU-2016:1206-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2016/suse-su-20161206-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:1206-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2016:1206-1

Related

Published

2016-05-03T16:38:12Z

Modified

2016-05-03T16:38:12Z

Summary

Security update for openssl1

Details

This update for openssl1 fixes the following issues:

Security issues fixed: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (bsc#977616) - CVE-2016-2105: EVPEncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVPEncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942)

Bugs fixed: - bsc#971354: libopenssl100 now Recommends: openssl1 to get correct SSL Root Certificate hashes - bsc#889013: Rename README.SuSE to the new spelling README.SUSE - bsc#976943: Fixed a buffer overrun in ASN1_parse. - bsc#977621: Preserve negotiated digests for SNI (bsc#977621)

References

Affected packages

SUSE:Linux Enterprise Server 11-SECURITY / openssl1

Package

Name: openssl1
Purl: purl:rpm/suse/openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011-SECURITY

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.1g-0.47.1

Ecosystem specific

{
    "binaries": [
        {
            "openssl1-doc": "1.0.1g-0.47.1",
            "libopenssl1_0_0": "1.0.1g-0.47.1",
            "libopenssl1_0_0-32bit": "1.0.1g-0.47.1",
            "libopenssl1_0_0-x86": "1.0.1g-0.47.1",
            "openssl1": "1.0.1g-0.47.1",
            "libopenssl1-devel": "1.0.1g-0.47.1"
        }
    ]
}