Skip to content
OpenAdvisories
High ELSA-2016-0301 5 CVEs

Important: openssl security update (Oracle Linux 7)

Published Mar 1, 2016 · Updated Mar 1, 2016

Ecosystem: Oracle Linux

Summary

[1.0.1e-42.4]
- fix CVE-2016-0702 - side channel attack on modular exponentiation
- fix CVE-2016-0705 - double-free in DSA private key parsing
- fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn

[1.0.1e-42.3]
- fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
- disable SSLv2 in the generic TLS method

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 openssl 1:1.0.1e-51.el7_2.4
Oracle Linux · 7 openssl-devel 1:1.0.1e-51.el7_2.4
Oracle Linux · 7 openssl-libs 1:1.0.1e-51.el7_2.4
Oracle Linux · 7 openssl-perl 1:1.0.1e-51.el7_2.4
Oracle Linux · 7 openssl-static 1:1.0.1e-51.el7_2.4

Vulnerabilities 5

  • Unscored —
    CVE-2015-3197 Public exploit EPSS 11%

    ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which ma…

    openssl Debian
  • Unscored —
    CVE-2016-0702 Public exploit

    The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2016-0705 EPSS 26%

    Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and …

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2016-0797 EPSS 27%

    Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a den…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2016-0800 Public exploit EPSS 82%

    The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to s…

    openssl nss Debian