openssl-1.0.0-20.AXS4.5

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

Security issues fixed with this release:

• CVE-2012-2333
Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation. On Red Hat Enterprise Linux 6, this update also fixes an uninitialized variable use bug, introduced by the fix for CVE-2012-0884 (released via RHSA-2012:0426). This bug could possibly cause an attempt to create an encrypted message in the CMS (Cryptographic Message Syntax) format to fail.

Fixed bugs:

• The previously released <A HREF="http://www.asianux.com/tsn_hq/index.php?m=errata&a=detail&eid=2953&sType..., which contains a fix for CVE-2012-0884, introduced an uninitialized variable use bug, which could potentially lead to creating an encrypted message in the Cryptographic Message Syntax (CMS) format to fail.