Summary
[1.0.1e-48.3]
- fix CVE-2016-2177 - possible integer overflow
- fix CVE-2016-2178 - non-constant time DSA operations
- fix CVE-2016-2179 - further DoS issues in DTLS
- fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
- fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
- fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
- fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
- fix CVE-2016-6304 - unbound memory growth with OCSP status request
- fix CVE-2016-6306 - certificate message OOB reads
- mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
112 bit effective strength
- replace expired testing certificates
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | openssl | 1:1.0.1e-51.el7_2.7 |
| Oracle Linux · 7 | openssl-devel | 1:1.0.1e-51.el7_2.7 |
| Oracle Linux · 7 | openssl-libs | 1:1.0.1e-51.el7_2.7 |
| Oracle Linux · 7 | openssl-perl | 1:1.0.1e-51.el7_2.7 |
| Oracle Linux · 7 | openssl-static | 1:1.0.1e-51.el7_2.7 |
Vulnerabilities 9
-
Unscored —CVE-2016-2177 EPSS 45%
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote at…
-
Unscored —
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of cons…
-
Unscored —CVE-2016-2179 EPSS 27%
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated wit…
-
Unscored —CVE-2016-2180 EPSS 30%
The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) im…
-
Unscored —CVE-2016-2181 EPSS 23%
The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number i…
-
Unscored —CVE-2016-2182 EPSS 44%
The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, whi…
-
Unscored —CVE-2016-6302 EPSS 28%
The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validati…
-
Unscored —CVE-2016-6304 EPSS 63%
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote a…
-
Unscored —CVE-2016-6306 EPSS 42%
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial …