SUSE-SU-2016:1206-1

Dashboard / Vulnerabilities / SUSE-SU-2016:1206-1

SUSE-SU-2016:1206-1

Summary: Security update for openssl1

Details: This update for openssl1 fixes the following issues: Security issues fixed: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (bsc#977616) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) Bugs fixed: - bsc#971354: libopenssl1_0_0 now Recommends: openssl1 to get correct SSL Root Certificate hashes - bsc#889013: Rename README.SuSE to the new spelling README.SUSE - bsc#976943: Fixed a buffer overrun in ASN1_parse. - bsc#977621: Preserve negotiated digests for SNI (bsc#977621)

References: https://www.suse.com/support/update/announcement/2016/suse-su-20161206-1/, https://bugzilla.suse.com/889013, https://bugzilla.suse.com/971354, https://bugzilla.suse.com/976942, https://bugzilla.suse.com/976943, https://bugzilla.suse.com/977614, https://bugzilla.suse.com/977615, https://bugzilla.suse.com/977616, https://bugzilla.suse.com/977617, https://bugzilla.suse.com/977621, https://www.suse.com/security/cve/CVE-2016-2105, https://www.suse.com/security/cve/CVE-2016-2106, https://www.suse.com/security/cve/CVE-2016-2107, https://www.suse.com/security/cve/CVE-2016-2108, https://www.suse.com/security/cve/CVE-2016-2109