Summary
[1.0.1e-51.5]
- fix CVE-2016-2105 - possible overflow in base64 encoding
- fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
- fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
- fix CVE-2016-2108 - memory corruption in ASN.1 encoder
- fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
- fix CVE-2016-0799 - memory issues in BIO_printf
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | openssl | 1:1.0.1e-51.el7_2.5 |
| Oracle Linux · 7 | openssl-devel | 1:1.0.1e-51.el7_2.5 |
| Oracle Linux · 7 | openssl-libs | 1:1.0.1e-51.el7_2.5 |
| Oracle Linux · 7 | openssl-perl | 1:1.0.1e-51.el7_2.5 |
| Oracle Linux · 7 | openssl-static | 1:1.0.1e-51.el7_2.5 |
Vulnerabilities 7
-
Unscored —CVE-2016-0799 EPSS 32%
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculate…
-
Unscored —CVE-2016-2105 EPSS 40%
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.…
-
Unscored —CVE-2016-2106 EPSS 27%
Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.…
-
Unscored —
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a…
-
Unscored —CVE-2016-2108 EPSS 78%
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary …
-
Unscored —CVE-2016-2109 EPSS 29%
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1…
-
Unscored —CVE-2016-2842 EPSS 54%
The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify…