SUSE-SU-2018:0112-1

    Dashboard / Vulnerabilities / SUSE-SU-2018:0112-1

    SUSE-SU-2018:0112-1

    Published: 16 Jan 2018Last Modified: 4 Feb 2026

    Summary: Security update for openssl

    Details: This update for openssl fixes the following issues: Security issues fixed: - CVE-2016-7056: ECSDA P-256 timing attack key recovery (bsc#1019334) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085) - CVE-2016-8610: remote denial of service in SSL alert handling (bsc#1005878) - CVE-2017-3735: Malformed X.509 IPAdressFamily could cause OOB read (bsc#1056058) Bug fixes: - support alternate root ca chains (bsc#1032261) - X509_get_default_cert_file() returns an incorrect path (bsc#1022271) - Segmentation fault in 'openssl speed' when engine library file cannot be found (bsc#1000677) - adjust DEFAULT_SUSE to meet 1.0.2 and current state (bsc#1027908) - Missing important ciphers in openssl 1.0.1i-47.1 on SLES12 SP1 (bsc#990592) - out of bounds read+crash in DES_fcrypt (bsc#1065363) - tracker bug for January 26th 2017 release (bsc#1021641) - patch for CVE-2016-2108 fails negative zero exploit (bsc#1001502) - Birthday attacks on 64-bit block ciphers aka triple-des (SWEET32) (bsc#1001912) - Include additional patch for CVE-2016-2108 (bsc#1004499) - openssl DEFAULT_SUSE cipher list is missing ECDHE-ECDSA ciphers (bsc#1055825)

    References: https://www.suse.com/support/update/announcement/2018/suse-su-20180112-1/, https://bugzilla.suse.com/1000677, https://bugzilla.suse.com/1001502, https://bugzilla.suse.com/1001912, https://bugzilla.suse.com/1004499, https://bugzilla.suse.com/1005878, https://bugzilla.suse.com/1019334, https://bugzilla.suse.com/1021641, https://bugzilla.suse.com/1022085, https://bugzilla.suse.com/1022271, https://bugzilla.suse.com/1027908, https://bugzilla.suse.com/1032261, https://bugzilla.suse.com/1055825, https://bugzilla.suse.com/1056058, https://bugzilla.suse.com/1065363, https://bugzilla.suse.com/990592, https://www.suse.com/security/cve/CVE-2016-2108, https://www.suse.com/security/cve/CVE-2016-7056, https://www.suse.com/security/cve/CVE-2016-8610, https://www.suse.com/security/cve/CVE-2017-3731, https://www.suse.com/security/cve/CVE-2017-3735

    Affected packages

    Package

    Name: openssl

    Purl: pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.0.1i-27.28.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High