Security update for compat-openssl097g SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2545-1 Final 1 1 2016-10-14T14:18:27Z current 2016-10-14T14:18:27Z 2016-10-14T14:18:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for compat-openssl097g This update for compat-openssl097g fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slesappsp3-compat-openssl097g-12788,slesappsp4-compat-openssl097g-12788 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162545-1/ Link for SUSE-SU-2016:2545-1 https://lists.suse.com/pipermail/sle-security-updates/2016-October/002335.html E-Mail link for SUSE-SU-2016:2545-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/982575 SUSE Bug 982575 https://bugzilla.suse.com/993819 SUSE Bug 993819 https://bugzilla.suse.com/995359 SUSE Bug 995359 https://bugzilla.suse.com/995377 SUSE Bug 995377 https://bugzilla.suse.com/999665 SUSE Bug 999665 https://bugzilla.suse.com/999668 SUSE Bug 999668 https://www.suse.com/security/cve/CVE-2016-2177/ SUSE CVE CVE-2016-2177 page https://www.suse.com/security/cve/CVE-2016-2182/ SUSE CVE CVE-2016-2182 page https://www.suse.com/security/cve/CVE-2016-2183/ SUSE CVE CVE-2016-2183 page https://www.suse.com/security/cve/CVE-2016-6303/ SUSE CVE CVE-2016-6303 page https://www.suse.com/security/cve/CVE-2016-6306/ SUSE CVE CVE-2016-6306 page SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Server for SAP Applications 11 SP4 compat-openssl097g-0.9.7g-146.22.47.1 compat-openssl097g-32bit-0.9.7g-146.22.47.1 compat-openssl097g-0.9.7g-146.22.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 compat-openssl097g-32bit-0.9.7g-146.22.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 compat-openssl097g-0.9.7g-146.22.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 compat-openssl097g-32bit-0.9.7g-146.22.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c. CVE-2016-2177 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.47.1 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162545-1/ https://www.suse.com/security/cve/CVE-2016-2177.html CVE-2016-2177 https://bugzilla.suse.com/982575 SUSE Bug 982575 https://bugzilla.suse.com/999075 SUSE Bug 999075 https://bugzilla.suse.com/999665 SUSE Bug 999665 The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. CVE-2016-2182 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.47.1 low 3.6 AV:N/AC:H/Au:S/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162545-1/ https://www.suse.com/security/cve/CVE-2016-2182.html CVE-2016-2182 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/993819 SUSE Bug 993819 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/995959 SUSE Bug 995959 https://bugzilla.suse.com/999665 SUSE Bug 999665 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. CVE-2016-2183 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.47.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162545-1/ https://www.suse.com/security/cve/CVE-2016-2183.html CVE-2016-2183 https://bugzilla.suse.com/1001912 SUSE Bug 1001912 https://bugzilla.suse.com/1024218 SUSE Bug 1024218 https://bugzilla.suse.com/1027038 SUSE Bug 1027038 https://bugzilla.suse.com/1034689 SUSE Bug 1034689 https://bugzilla.suse.com/1056614 SUSE Bug 1056614 https://bugzilla.suse.com/1171693 SUSE Bug 1171693 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/995359 SUSE Bug 995359 Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. CVE-2016-6303 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.47.1 low 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162545-1/ https://www.suse.com/security/cve/CVE-2016-6303.html CVE-2016-6303 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 https://bugzilla.suse.com/994844 SUSE Bug 994844 https://bugzilla.suse.com/995377 SUSE Bug 995377 https://bugzilla.suse.com/999665 SUSE Bug 999665 The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c. CVE-2016-6306 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.47.1 low 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162545-1/ https://www.suse.com/security/cve/CVE-2016-6306.html CVE-2016-6306 https://bugzilla.suse.com/1004104 SUSE Bug 1004104 https://bugzilla.suse.com/999665 SUSE Bug 999665 https://bugzilla.suse.com/999668 SUSE Bug 999668