Security update for compat-openssl097g SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:0601-1 Final 1 1 2017-03-03T16:48:22Z current 2017-03-03T16:48:22Z 2017-03-03T16:48:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for compat-openssl097g This update for compat-openssl097g fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed: - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - degrade 3DES to MEDIUM in SSL2 (bsc#1001912) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) Bugs fixed: - fix crash in openssl speed (bsc#1000677) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) - fix crash in print_notice (bsc#998190) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slesappsp4-compat-openssl097g-13004 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20170601-1/ Link for SUSE-SU-2017:0601-1 https://lists.suse.com/pipermail/sle-security-updates/2017-March/002676.html E-Mail link for SUSE-SU-2017:0601-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1000677 SUSE Bug 1000677 https://bugzilla.suse.com/1001912 SUSE Bug 1001912 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1021641 SUSE Bug 1021641 https://bugzilla.suse.com/995075 SUSE Bug 995075 https://bugzilla.suse.com/998190 SUSE Bug 998190 https://www.suse.com/security/cve/CVE-2016-2108/ SUSE CVE CVE-2016-2108 page https://www.suse.com/security/cve/CVE-2016-8610/ SUSE CVE CVE-2016-8610 page SUSE Linux Enterprise Server for SAP Applications 11 SP4 compat-openssl097g-0.9.7g-146.22.50.1 compat-openssl097g-32bit-0.9.7g-146.22.50.1 compat-openssl097g-0.9.7g-146.22.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 compat-openssl097g-32bit-0.9.7g-146.22.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. CVE-2016-2108 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.50.1 important 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170601-1/ https://www.suse.com/security/cve/CVE-2016-2108.html CVE-2016-2108 https://bugzilla.suse.com/1001502 SUSE Bug 1001502 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977617 SUSE Bug 977617 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989345 SUSE Bug 989345 https://bugzilla.suse.com/996067 SUSE Bug 996067 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. CVE-2016-8610 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-0.9.7g-146.22.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:compat-openssl097g-32bit-0.9.7g-146.22.50.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170601-1/ https://www.suse.com/security/cve/CVE-2016-8610.html CVE-2016-8610 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1005879 SUSE Bug 1005879 https://bugzilla.suse.com/1110018 SUSE Bug 1110018 https://bugzilla.suse.com/1120592 SUSE Bug 1120592 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/982575 SUSE Bug 982575