Recommended update for openssl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1410-1 Final 1 1 2015-08-06T09:19:00Z current 2015-08-06T09:19:00Z 2015-08-06T09:19:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Recommended update for openssl This update of openssl fixes two regressions. - A regression was caused by the security fix for CVE-2015-0287, where DSA keys were not correctly loaded from file anymore. (bsc#937492) - RSA key generation odd keylengths was entering an endless loop (bsc#937212) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-418,SUSE-SLE-SDK-12-2015-418,SUSE-SLE-SERVER-12-2015-418 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151410-1/ Link for SUSE-SU-2015:1410-1 https://lists.suse.com/pipermail/sle-security-updates/2015-August/001545.html E-Mail link for SUSE-SU-2015:1410-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/937212 SUSE Bug 937212 https://bugzilla.suse.com/937492 SUSE Bug 937492 https://www.suse.com/security/cve/CVE-2015-0287/ SUSE CVE CVE-2015-0287 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 libopenssl1_0_0-1.0.1i-27.3.1 libopenssl1_0_0-32bit-1.0.1i-27.3.1 openssl-1.0.1i-27.3.1 libopenssl-devel-1.0.1i-27.3.1 libopenssl1_0_0-hmac-1.0.1i-27.3.1 libopenssl1_0_0-hmac-32bit-1.0.1i-27.3.1 openssl-doc-1.0.1i-27.3.1 libopenssl1_0_0-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Desktop 12 libopenssl1_0_0-32bit-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Desktop 12 openssl-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Desktop 12 libopenssl1_0_0-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server 12 libopenssl1_0_0-32bit-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server 12 libopenssl1_0_0-hmac-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server 12 libopenssl1_0_0-hmac-32bit-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server 12 openssl-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server 12 openssl-doc-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server 12 libopenssl1_0_0-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libopenssl1_0_0-32bit-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libopenssl1_0_0-hmac-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libopenssl1_0_0-hmac-32bit-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 openssl-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 openssl-doc-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libopenssl-devel-1.0.1i-27.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse. CVE-2015-0287 SUSE Linux Enterprise Desktop 12:libopenssl1_0_0-1.0.1i-27.3.1 SUSE Linux Enterprise Desktop 12:libopenssl1_0_0-32bit-1.0.1i-27.3.1 SUSE Linux Enterprise Desktop 12:openssl-1.0.1i-27.3.1 SUSE Linux Enterprise Server 12:libopenssl1_0_0-1.0.1i-27.3.1 SUSE Linux Enterprise Server 12:libopenssl1_0_0-32bit-1.0.1i-27.3.1 SUSE Linux Enterprise Server 12:libopenssl1_0_0-hmac-1.0.1i-27.3.1 SUSE Linux Enterprise Server 12:libopenssl1_0_0-hmac-32bit-1.0.1i-27.3.1 SUSE Linux Enterprise Server 12:openssl-1.0.1i-27.3.1 SUSE Linux Enterprise Server 12:openssl-doc-1.0.1i-27.3.1 SUSE Linux Enterprise Server for SAP Applications 12:libopenssl1_0_0-1.0.1i-27.3.1 SUSE Linux Enterprise Server for SAP Applications 12:libopenssl1_0_0-32bit-1.0.1i-27.3.1 SUSE Linux Enterprise Server for SAP Applications 12:libopenssl1_0_0-hmac-1.0.1i-27.3.1 SUSE Linux Enterprise Server for SAP Applications 12:libopenssl1_0_0-hmac-32bit-1.0.1i-27.3.1 SUSE Linux Enterprise Server for SAP Applications 12:openssl-1.0.1i-27.3.1 SUSE Linux Enterprise Server for SAP Applications 12:openssl-doc-1.0.1i-27.3.1 SUSE Linux Enterprise Software Development Kit 12:libopenssl-devel-1.0.1i-27.3.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151410-1/ https://www.suse.com/security/cve/CVE-2015-0287.html CVE-2015-0287 https://bugzilla.suse.com/919648 SUSE Bug 919648 https://bugzilla.suse.com/922499 SUSE Bug 922499 https://bugzilla.suse.com/936586 SUSE Bug 936586 https://bugzilla.suse.com/937891 SUSE Bug 937891 https://bugzilla.suse.com/968888 SUSE Bug 968888 https://bugzilla.suse.com/991722 SUSE Bug 991722