openssl-1.0.1e-42.AXS4.1

エラータID: AXSA:2015-934:07

Release date: 
Monday, December 14, 2015 - 14:22
Subject: 
openssl-1.0.1e-42.AXS4.1
Affected Channels: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity: 
Moderate
Description: 

Security issues fixed with this release:

CVE-2015-3194
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before
1.0.2e allows remote attackers to cause a denial of service (NULL
pointer dereference and application crash) via an RSA PSS ASN.1
signature that lacks a mask generation function parameter.
CVE-2015-3195
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in
OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and
1.0.2 before 1.0.2e mishandles errors caused by malformed
X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive
information from process memory by triggering a decoding failure in a
PKCS#7 or CMS application.
CVE-2015-3196
ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and
1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the
PSK identity hint to an incorrect data structure, which allows remote
servers to cause a denial of service (race condition and double free)
via a crafted ServerKeyExchange message.

Solution: 

Update packages.

CVEs: 
CVE-2015-3194
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.
CVE-2015-3195
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
CVE-2015-3196
ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.
Additional Info: 

N/A

Download: 

SRPMS
  1. openssl-1.0.1e-42.AXS4.1.src.rpm
    MD5: 5ae2bd671fc4c43007041c84bbaf0f51
    SHA-256: d731fda2f18274b157504ca346e5909315c7a9ae1d5a519a0ae1640261de21d3
    Size: 3.06 MB

Asianux Server 4 for x86
  1. openssl-1.0.1e-42.AXS4.1.i686.rpm
    MD5: 652d6197616b9cd32de6ee74eced7f78
    SHA-256: 49c9c4ffd2034e6a2069e728da121cf04476d06115fa126198d36e619a276786
    Size: 1.51 MB
  2. openssl-devel-1.0.1e-42.AXS4.1.i686.rpm
    MD5: 35bfd55b47dc2de7a42efcd4569c24dd
    SHA-256: df0384e37fe302995c5ca65d8b53c192ec595d63d63704f9f008022cb5604eb9
    Size: 1.17 MB

Asianux Server 4 for x86_64
  1. openssl-1.0.1e-42.AXS4.1.x86_64.rpm
    MD5: 7d31f213ad545a837ca5037fefc6f55b
    SHA-256: 5368f8ddd58e698e8d55f06198a98e008742c55734c62b8564fdc87cf5a66938
    Size: 1.52 MB
  2. openssl-devel-1.0.1e-42.AXS4.1.x86_64.rpm
    MD5: f3fff01c617991a3802f24ec5d8d30ef
    SHA-256: 1237175894302bf279f68bf3d8ef4f0e62d6cbaf657dffc1390c954108325370
    Size: 1.17 MB
  3. openssl-1.0.1e-42.AXS4.1.i686.rpm
    MD5: 652d6197616b9cd32de6ee74eced7f78
    SHA-256: 49c9c4ffd2034e6a2069e728da121cf04476d06115fa126198d36e619a276786
    Size: 1.51 MB
  4. openssl-devel-1.0.1e-42.AXS4.1.i686.rpm
    MD5: 35bfd55b47dc2de7a42efcd4569c24dd
    SHA-256: df0384e37fe302995c5ca65d8b53c192ec595d63d63704f9f008022cb5604eb9
    Size: 1.17 MB