Описание
ELSA-2010-0054: openssl security update (MODERATE)
[0.9.8e-12.1]
- fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
- fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data() is called prematurely by application (#546707)
Обновленные пакеты
Oracle Linux 5
Oracle Linux ia64
openssl
0.9.8e-12.el5_4.1
openssl-devel
0.9.8e-12.el5_4.1
openssl-perl
0.9.8e-12.el5_4.1
Oracle Linux x86_64
openssl
0.9.8e-12.el5_4.1
openssl-devel
0.9.8e-12.el5_4.1
openssl-perl
0.9.8e-12.el5_4.1
Oracle Linux i386
openssl
0.9.8e-12.el5_4.1
openssl-devel
0.9.8e-12.el5_4.1
openssl-perl
0.9.8e-12.el5_4.1
Связанные CVE
Связанные уязвимости
Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib ...
The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.