Skip to content
OpenAdvisories
Medium ELSA-2015-0716 7 CVEs

Moderate: openssl security and bug fix update (Oracle Linux 7)

Published Mar 23, 2015 · Updated Mar 23, 2015

Ecosystem: Oracle Linux

Summary

[1.0.1e-42.4]
- update fix for CVE-2015-0287 to what was released upstream

[1.0.1e-42.3]
- fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
- fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
- fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
- fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
- fix CVE-2015-0292 - integer underflow in base64 decoder
- fix CVE-2015-0293 - triggerable assert in SSLv2 server

[1.0.1e-42.2]
- fix broken error detection when unwrapping unpadded key

[1.0.1e-42.1]
- fix the RFC 5649 for key material that does not need padding

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 openssl 1:1.0.1e-42.el7_1.4
Oracle Linux · 7 openssl-devel 1:1.0.1e-42.el7_1.4
Oracle Linux · 7 openssl-libs 1:1.0.1e-42.el7_1.4
Oracle Linux · 7 openssl-perl 1:1.0.1e-42.el7_1.4
Oracle Linux · 7 openssl-static 1:1.0.1e-42.el7_1.4

Vulnerabilities 7

  • Unscored —
    CVE-2015-0209 EPSS 16%

    Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 b…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0286 EPSS 20%

    The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m,…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0287

    The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0288

    The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0289

    The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a …

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0292 EPSS 43%

    Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in Open…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0293 EPSS 21%

    The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a a…

    openssl openssl Debian Ubuntu