RHSA-2016:0996 — Red Hat Security Advisory: openssl security update

Fixed packages 20

Release	Package	Fixed in
Red Hat · RHEL 6 enterprise_linux:6::client	openssl	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::client	openssl-debuginfo	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::client	openssl-devel	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::client	openssl-perl	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::client	openssl-static	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode	openssl	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode	openssl-debuginfo	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode	openssl-devel	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode	openssl-perl	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode	openssl-static	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server	openssl	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server	openssl-debuginfo	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server	openssl-devel	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server	openssl-perl	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server	openssl-static	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation	openssl	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation	openssl-debuginfo	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation	openssl-devel	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation	openssl-perl	0:1.0.1e-48.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation	openssl-static	0:1.0.1e-48.el6_8.1

Vulnerabilities 7

Unscored —

CVE-2016-0799 EPSS 32%

The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculate…

openssl openssl Debian Ubuntu

Mar 3, 2016
Unscored —

CVE-2016-2105 EPSS 40%

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.…

openssl openssl openssl Debian Ubuntu Alpine

May 5, 2016
Unscored —

CVE-2016-2106 EPSS 27%

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.…

openssl openssl openssl Debian Ubuntu Alpine

May 5, 2016
Unscored —

CVE-2016-2107 Public exploit EPSS 89%

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a…

openssl openssl openssl Debian Ubuntu Alpine

May 5, 2016
Unscored —

CVE-2016-2108 EPSS 78%

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary …

openssl openssl Debian Ubuntu

May 5, 2016
Unscored —

CVE-2016-2109 EPSS 29%

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1…

openssl openssl openssl Debian Ubuntu Alpine

May 5, 2016
Unscored —

CVE-2016-2842 EPSS 54%

The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify…

openssl openssl Debian Ubuntu

Mar 3, 2016

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=1312219
report
https://bugzilla.redhat.com/show_bug.cgi?id=1314757
report
https://bugzilla.redhat.com/show_bug.cgi?id=1330101
report
https://bugzilla.redhat.com/show_bug.cgi?id=1331402
report
https://bugzilla.redhat.com/show_bug.cgi?id=1331426
report
https://bugzilla.redhat.com/show_bug.cgi?id=1331441
report
https://bugzilla.redhat.com/show_bug.cgi?id=1331536
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0996.json
report
https://access.redhat.com/security/cve/CVE-2016-0799
advisory
https://www.cve.org/CVERecord?id=CVE-2016-0799
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-0799
report
https://access.redhat.com/security/cve/CVE-2016-2105
advisory
https://www.cve.org/CVERecord?id=CVE-2016-2105
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-2105
article
https://openssl.org/news/secadv/20160503.txt
report
https://access.redhat.com/security/cve/CVE-2016-2106
advisory
https://www.cve.org/CVERecord?id=CVE-2016-2106
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-2106
report
https://access.redhat.com/security/cve/CVE-2016-2107
advisory
https://www.cve.org/CVERecord?id=CVE-2016-2107
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-2107
report
https://access.redhat.com/security/cve/CVE-2016-2108
advisory
https://www.cve.org/CVERecord?id=CVE-2016-2108
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-2108
report
https://access.redhat.com/security/cve/CVE-2016-2109
advisory
https://www.cve.org/CVERecord?id=CVE-2016-2109
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-2109
report
https://access.redhat.com/security/cve/CVE-2016-2842
advisory
https://www.cve.org/CVERecord?id=CVE-2016-2842
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-2842

Red Hat Security Advisory: openssl security update

Fixed packages 20

Vulnerabilities 7

The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculate…

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.…

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.…

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a…

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary …

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1…

The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify…

References