Security update for OpenSSL

Summary

Fixed packages 26

Vulnerabilities 54

• Low 3.7
  CVE-2015-4000 Public exploit EPSS 100%

  The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pr…

  thunderbird firefox openssl openssl Debian Ubuntu
  May 21, 2015
• Low 3.4
  CVE-2014-3566 Public exploit EPSS 100%

  The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which ma…

  openssl openssl openjdk-7 wolfssl Debian Ubuntu
  Oct 15, 2014
• Unscored —
  CVE-2006-7250

  The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a de…

  openssl Debian
  Feb 29, 2012
• Unscored —
  CVE-2009-5146 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…

  Feb 18, 2020
• Unscored —
  CVE-2010-2939 Public exploit

  Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a…

  openssl Debian
  Aug 17, 2010
• Unscored —
  CVE-2010-3864 EPSS 22%

  Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and …

  openssl Debian
  Nov 17, 2010
• Unscored —
  CVE-2010-4180

  OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prope…

  openssl Debian
  Dec 6, 2010
• Unscored —
  CVE-2011-0014

  ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of ser…

  openssl Debian
  Feb 18, 2011
• Unscored —
  CVE-2011-1945

  The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signatur…

  openssl Debian
  May 31, 2011
• Unscored —
  CVE-2011-3210

  The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure th…

  openssl Debian
  Sep 22, 2011
• Unscored —
  CVE-2011-4108 EPSS 16%

  The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is …

  openssl Debian
  Jan 6, 2012
• Unscored —
  CVE-2011-4109 EPSS 17%

  Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attac…

  openssl Debian
  Jan 6, 2012
• Unscored —
  CVE-2011-4576 EPSS 14%

  The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures …

  openssl Debian
  Jan 6, 2012
• Unscored —
  CVE-2011-4577

  OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denia…

  openssl Debian
  Jan 6, 2012
• Unscored —
  CVE-2011-4619 EPSS 18%

  The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly han…

  openssl Debian
  Jan 6, 2012
• Unscored —
  CVE-2011-5095

  The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does not properly validate …

  openssl Debian
  Jun 20, 2012
• Unscored —
  CVE-2012-0050 EPSS 14%

  OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial …

  openssl Debian
  Jan 19, 2012
• Unscored —
  CVE-2012-0884 EPSS 13%

  The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h doe…

  openssl openssl098 Debian Ubuntu
  Mar 13, 2012
• Unscored —
  CVE-2012-1165

  The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote atta…

  openssl Debian
  Mar 15, 2012
• Unscored —
  CVE-2012-2110 Public exploit EPSS 48%

  The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 befor…

  openssl Debian
  Apr 19, 2012
• Unscored —
  CVE-2012-2333 EPSS 28%

  Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTL…

  openssl openssl098 Debian Ubuntu
  May 14, 2012
• Unscored —
  CVE-2013-0166 EPSS 20%

  OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification fo…

  openssl openssl098 Debian Ubuntu
  Feb 8, 2013
• Unscored —
  CVE-2013-0169 Public exploit EPSS 36%

  The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other produc…

  openssl bouncycastle nss gnutls28 Debian Ubuntu
  Feb 8, 2013
• Unscored —
  CVE-2014-0076

  The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a cons…

  openssl Debian
  Mar 25, 2014
• Unscored —
  CVE-2014-0221 Public exploit EPSS 88%

  The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1…

  openssl openssl openssl098 Debian Ubuntu
  Jun 5, 2014
• Unscored —
  CVE-2014-0224 Public exploit EPSS 95%

  OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCip…

  openssl openssl openssl098 Debian Ubuntu
  Jun 5, 2014
• Unscored —
  CVE-2014-3470 EPSS 86%

  The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 befor…

  openssl openssl Debian Ubuntu
  Jun 5, 2014
• Unscored —
  CVE-2014-3505 EPSS 46%

  Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n,…

  openssl openssl Debian Ubuntu
  Aug 13, 2014
• Unscored —
  CVE-2014-3506 EPSS 46%

  d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allo…

  openssl openssl Debian Ubuntu
  Aug 13, 2014
• Unscored —
  CVE-2014-3507 Public exploit EPSS 55%

  Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 bef…

  openssl openssl Debian Ubuntu
  Aug 13, 2014
• Unscored —
  CVE-2014-3508 EPSS 25%

  The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 be…

  openssl openssl Debian Ubuntu
  Aug 13, 2014
• Unscored —
  CVE-2014-3510 EPSS 18%

  The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1…

  openssl openssl Debian Ubuntu
  Aug 13, 2014
• Unscored —
  CVE-2014-3513 EPSS 37%

  Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a d…

  openssl openssl Debian Ubuntu
  Oct 19, 2014
• Unscored —
  CVE-2014-3567 EPSS 23%

  Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 be…

  openssl openssl Debian Ubuntu
  Oct 19, 2014
• Unscored —
  CVE-2014-3568 EPSS 14%

  OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option…

  openssl openssl Debian Ubuntu
  Oct 19, 2014
• Unscored —
  CVE-2014-3570 Public exploit EPSS 22%

  The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly cal…

  openssl openssl Debian Ubuntu
  Jan 9, 2015
• Unscored —
  CVE-2014-3571 EPSS 22%

  OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of servi…

  openssl openssl Debian Ubuntu
  Jan 9, 2015
• Unscored —
  CVE-2014-3572

  The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k…

  openssl openssl Debian Ubuntu
  Jan 9, 2015
• Unscored —
  CVE-2014-8275 Public exploit EPSS 15%

  OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificat…

  openssl openssl Debian Ubuntu
  Jan 9, 2015
• Unscored —
  CVE-2015-0204 Public exploit EPSS 99%

  The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k…

  openssl openssl Debian Ubuntu
  Jan 9, 2015
• Unscored —
  CVE-2015-0205 Public exploit EPSS 22%

  The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client au…

  openssl openssl Debian Ubuntu
  Jan 9, 2015
• Unscored —
  CVE-2015-0209 EPSS 16%

  Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 b…

  openssl openssl Debian Ubuntu
  Mar 19, 2015
• Unscored —
  CVE-2015-0286 EPSS 20%

  The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m,…

  openssl openssl Debian Ubuntu
  Mar 19, 2015
• Unscored —
  CVE-2015-0287

  The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.…

  openssl openssl Debian Ubuntu
  Mar 19, 2015
• Unscored —
  CVE-2015-0288

  The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.…

  openssl openssl Debian Ubuntu
  Mar 19, 2015
• Unscored —
  CVE-2015-0289

  The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a …

  openssl openssl Debian Ubuntu
  Mar 19, 2015
• Unscored —
  CVE-2015-0292 EPSS 43%

  Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in Open…

  openssl openssl Debian Ubuntu
  Mar 19, 2015
• Unscored —
  CVE-2015-0293 EPSS 21%

  The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a a…

  openssl openssl Debian Ubuntu
  Mar 19, 2015
• Unscored —
  CVE-2015-1788 Public exploit EPSS 21%

  The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n,…

  openssl openssl Debian Ubuntu
  Jun 12, 2015
• Unscored —
  CVE-2015-1789 EPSS 76%

  The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1…

  openssl openssl Debian Ubuntu
  Jun 12, 2015
• Unscored —
  CVE-2015-1790 Public exploit EPSS 24%

  The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.…

  openssl openssl Debian Ubuntu
  Jun 12, 2015
• Unscored —
  CVE-2015-1791 Public exploit EPSS 17%

  Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0…

  openssl openssl Debian Ubuntu
  Jun 12, 2015
• Unscored —
  CVE-2015-1792 Public exploit EPSS 23%

  The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n…

  openssl openssl Debian Ubuntu
  Jun 12, 2015
• Unscored —
  CVE-2015-3216

  Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL,…

  Jul 7, 2015

References

• report
  https://bugzilla.suse.com/608666
• report
  https://bugzilla.suse.com/629905
• report
  https://bugzilla.suse.com/651003
• report
  https://bugzilla.suse.com/657663
• report
  https://bugzilla.suse.com/670526
• report
  https://bugzilla.suse.com/693027
• report
  https://bugzilla.suse.com/716144
• report
  https://bugzilla.suse.com/739719
• report
  https://bugzilla.suse.com/742821
• report
  https://bugzilla.suse.com/743344
• report
  https://bugzilla.suse.com/748738
• report
  https://bugzilla.suse.com/749210
• report
  https://bugzilla.suse.com/749213
• report
  https://bugzilla.suse.com/749735
• report
  https://bugzilla.suse.com/751946
• report
  https://bugzilla.suse.com/751977
• report
  https://bugzilla.suse.com/755395
• report
  https://bugzilla.suse.com/758060
• report
  https://bugzilla.suse.com/761324
• report
  https://bugzilla.suse.com/761838
• report
  https://bugzilla.suse.com/767256
• report
  https://bugzilla.suse.com/768097
• report
  https://bugzilla.suse.com/779952
• report
  https://bugzilla.suse.com/802648
• report
  https://bugzilla.suse.com/802746
• report
  https://bugzilla.suse.com/859228
• report
  https://bugzilla.suse.com/859924
• report
  https://bugzilla.suse.com/860332
• report
  https://bugzilla.suse.com/862181
• report
  https://bugzilla.suse.com/869945
• report
  https://bugzilla.suse.com/870192
• report
  https://bugzilla.suse.com/879179
• report
  https://bugzilla.suse.com/880891
• report
  https://bugzilla.suse.com/890764
• report
  https://bugzilla.suse.com/890767
• report
  https://bugzilla.suse.com/890768
• report
  https://bugzilla.suse.com/890769
• report
  https://bugzilla.suse.com/890770
• report
  https://bugzilla.suse.com/892403