openssl-1.0.1e-48.1.0.1.AXS4

The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared
libraries which provide various cryptographic algorithms and
protocols.

Security issues fixed with this release:

CVE-2016-0799
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before
1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths,
which allows remote attackers to cause a denial of service (overflow
and out-of-bounds read) or possibly have unspecified other impact via
a long string, as demonstrated by a large amount of ASN.1 data, a
different vulnerability than CVE-2016-2842.
CVE-2016-2105
Integer overflow in the EVP_EncodeUpdate function in
crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h
allows remote attackers to cause a denial of service (heap memory
corruption) via a large amount of binary data.
CVE-2016-2106
Integer overflow in the EVP_EncryptUpdate function in
crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h
allows remote attackers to cause a denial of service (heap memory
corruption) via a large amount of data.
CVE-2016-2107
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before
1.0.2h does not consider memory allocation during a certain padding
check, which allows remote attackers to obtain sensitive cleartext
information via a padding-oracle attack against an AES CBC session,
NOTE: this vulnerability exists because of an incorrect fix for
CVE-2013-0169.
CVE-2016-2108
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before
1.0.2c allows remote attackers to execute arbitrary code or cause a
denial of service (buffer underflow and memory corruption) via an ANY
field in crafted serialized data, aka the "negative zero" issue.
CVE-2016-2109
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1
BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h
allows remote attackers to cause a denial of service (memory
consumption) via a short invalid encoding.
CVE-2016-2842
The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1
before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain
memory allocation succeeds, which allows remote attackers to cause a
denial of service (out-of-bounds write or memory consumption) or
possibly have unspecified other impact via a long string, as
demonstrated by a large amount of ASN.1 data, a different
vulnerability than CVE-2016-0799.