AXSA:2016-460:03

Release date: 
Sunday, May 29, 2016 - 13:58
Subject: 
openssl-1.0.1e-48.1.0.1.AXS4
Affected Channels: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity: 
High
Description: 

The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared
libraries which provide various cryptographic algorithms and
protocols.

Security issues fixed with this release:

CVE-2016-0799
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before
1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths,
which allows remote attackers to cause a denial of service (overflow
and out-of-bounds read) or possibly have unspecified other impact via
a long string, as demonstrated by a large amount of ASN.1 data, a
different vulnerability than CVE-2016-2842.
CVE-2016-2105
Integer overflow in the EVP_EncodeUpdate function in
crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h
allows remote attackers to cause a denial of service (heap memory
corruption) via a large amount of binary data.
CVE-2016-2106
Integer overflow in the EVP_EncryptUpdate function in
crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h
allows remote attackers to cause a denial of service (heap memory
corruption) via a large amount of data.
CVE-2016-2107
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before
1.0.2h does not consider memory allocation during a certain padding
check, which allows remote attackers to obtain sensitive cleartext
information via a padding-oracle attack against an AES CBC session,
NOTE: this vulnerability exists because of an incorrect fix for
CVE-2013-0169.
CVE-2016-2108
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before
1.0.2c allows remote attackers to execute arbitrary code or cause a
denial of service (buffer underflow and memory corruption) via an ANY
field in crafted serialized data, aka the "negative zero" issue.
CVE-2016-2109
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1
BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h
allows remote attackers to cause a denial of service (memory
consumption) via a short invalid encoding.
CVE-2016-2842
The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1
before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain
memory allocation succeeds, which allows remote attackers to cause a
denial of service (out-of-bounds write or memory consumption) or
possibly have unspecified other impact via a long string, as
demonstrated by a large amount of ASN.1 data, a different
vulnerability than CVE-2016-0799.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. openssl-1.0.1e-48.1.0.1.AXS4.src.rpm
    MD5: e461fdde50f9a17d30284d88c613ed79
    SHA-256: 56ce363fb8c244621130d7bde48f346b84bfc2e60601f95d1fba106901d28d75
    Size: 3.10 MB

Asianux Server 4 for x86
  1. openssl-1.0.1e-48.1.0.1.AXS4.i686.rpm
    MD5: c1eb0d49a7b4d2c1bcfbb7f8f6ce8b75
    SHA-256: 9456d4667795d8ac9acec2aa99fe98077bde4765070ce355de0defd82bd74434
    Size: 1.52 MB
  2. openssl-devel-1.0.1e-48.1.0.1.AXS4.i686.rpm
    MD5: ff5c83e2692f3cef3772c72d3fc76470
    SHA-256: b34ee884a7b2f8d7390dcf604e0516c4563c101bd0a62a1e752d02b900864762
    Size: 1.17 MB

Asianux Server 4 for x86_64
  1. openssl-1.0.1e-48.1.0.1.AXS4.x86_64.rpm
    MD5: 9cd88b1fd31fb26aea58cabaa4218400
    SHA-256: 86751b08fdd51e2eab2430207bab577ecf0e2f25a50102ef361cc1f2bf9eb0db
    Size: 1.52 MB
  2. openssl-devel-1.0.1e-48.1.0.1.AXS4.x86_64.rpm
    MD5: 0ffdc8febac5518c8fad9ee1a990be42
    SHA-256: 6fc205a9b007c27f084dfc9f92f2d20de9f2a6493769f150358d32e1a8c8cd14
    Size: 1.17 MB
  3. openssl-1.0.1e-48.1.0.1.AXS4.i686.rpm
    MD5: c1eb0d49a7b4d2c1bcfbb7f8f6ce8b75
    SHA-256: 9456d4667795d8ac9acec2aa99fe98077bde4765070ce355de0defd82bd74434
    Size: 1.52 MB
  4. openssl-devel-1.0.1e-48.1.0.1.AXS4.i686.rpm
    MD5: ff5c83e2692f3cef3772c72d3fc76470
    SHA-256: b34ee884a7b2f8d7390dcf604e0516c4563c101bd0a62a1e752d02b900864762
    Size: 1.17 MB
Copyright© 2007-2015 Asianux. All rights reserved.