Security update for compat-openssl097g SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:1231-1 Final 1 1 2016-05-04T12:35:53Z current 2016-05-04T12:35:53Z 2016-05-04T12:35:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for compat-openssl097g This update for compat-openssl097g fixes the following issues: Security issues fixed: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) Bugs fixed: - bsc#976943: Fix buffer overrun in ASN1_parse The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slesappsp3-compat-openssl097g-12541,slesappsp4-compat-openssl097g-12541 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20161231-1/ Link for SUSE-SU-2016:1231-1 https://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html E-Mail link for SUSE-SU-2016:1231-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/976942 SUSE Bug 976942 https://bugzilla.suse.com/976943 SUSE Bug 976943 https://bugzilla.suse.com/977615 SUSE Bug 977615 https://bugzilla.suse.com/977617 SUSE Bug 977617 https://www.suse.com/security/cve/CVE-2016-2105/ SUSE CVE CVE-2016-2105 page https://www.suse.com/security/cve/CVE-2016-2106/ SUSE CVE CVE-2016-2106 page https://www.suse.com/security/cve/CVE-2016-2108/ SUSE CVE CVE-2016-2108 page https://www.suse.com/security/cve/CVE-2016-2109/ SUSE CVE CVE-2016-2109 page SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Server for SAP Applications 11 SP4 compat-openssl097g-0.9.7g-146.22.44.1 compat-openssl097g-32bit-0.9.7g-146.22.44.1 compat-openssl097g-0.9.7g-146.22.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 compat-openssl097g-32bit-0.9.7g-146.22.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 compat-openssl097g-0.9.7g-146.22.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 compat-openssl097g-32bit-0.9.7g-146.22.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data. CVE-2016-2105 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.44.1 low 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161231-1/ https://www.suse.com/security/cve/CVE-2016-2105.html CVE-2016-2105 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977614 SUSE Bug 977614 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989902 SUSE Bug 989902 https://bugzilla.suse.com/990369 SUSE Bug 990369 https://bugzilla.suse.com/990370 SUSE Bug 990370 Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data. CVE-2016-2106 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.44.1 low 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161231-1/ https://www.suse.com/security/cve/CVE-2016-2106.html CVE-2016-2106 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977615 SUSE Bug 977615 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/979279 SUSE Bug 979279 https://bugzilla.suse.com/990369 SUSE Bug 990369 The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. CVE-2016-2108 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.44.1 important 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161231-1/ https://www.suse.com/security/cve/CVE-2016-2108.html CVE-2016-2108 https://bugzilla.suse.com/1001502 SUSE Bug 1001502 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977617 SUSE Bug 977617 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989345 SUSE Bug 989345 https://bugzilla.suse.com/996067 SUSE Bug 996067 The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding. CVE-2016-2109 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.44.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161231-1/ https://www.suse.com/security/cve/CVE-2016-2109.html CVE-2016-2109 https://bugzilla.suse.com/1015243 SUSE Bug 1015243 https://bugzilla.suse.com/976942 SUSE Bug 976942 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/990369 SUSE Bug 990369