Message-Id: <E1NXwrJ-00021a-P0@titan.mandriva.com>
Date: Thu, 21 Jan 2010 14:14:01 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:022 ] openssl


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:022
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : openssl
 Date    : January 21, 2010
 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Some vulnerabilities were discovered and corrected in openssl:
 
 Memory leak in the zlib_stateful_finish function in
 crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta
 through Beta 4 allows remote attackers to cause a denial of service
 (memory consumption) via vectors that trigger incorrect calls to the
 CRYPTO_free_all_ex_data function, as demonstrated by use of SSLv3
 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678
 (CVE-2009-4355).
 
 Packages for 2008.0 are provided for Corporate Desktop 2008.0
 customers.
 
 The updated packages have been patched to correct thies issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4355
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 a9a898f4dadf680f4332bfddfc525700  2008.0/i586/libopenssl0.9.8-0.9.8e-8.5mdv2008.0.i586.rpm
 5365fe9fc3b8b48fc039f73a6e4aacc2  2008.0/i586/libopenssl0.9.8-devel-0.9.8e-8.5mdv2008.0.i586.rpm
 f5de1c555b80b503f4c135ca1a05f525  2008.0/i586/libopenssl0.9.8-static-devel-0.9.8e-8.5mdv2008.0.i586.rpm
 98d375a9df19e136a1874203e36e1f77  2008.0/i586/openssl-0.9.8e-8.5mdv2008.0.i586.rpm 
 66ca48de65b3b7b79a675a5dd58f66bb  2008.0/SRPMS/openssl-0.9.8e-8.5mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 8d695fc8e1d9b887040b2f04045a044c  2008.0/x86_64/lib64openssl0.9.8-0.9.8e-8.5mdv2008.0.x86_64.rpm
 e8421d7082bccc3ca65884356cd4ec3a  2008.0/x86_64/lib64openssl0.9.8-devel-0.9.8e-8.5mdv2008.0.x86_64.rpm
 d44773cfa42eebadc1fabedda4d09b5a  2008.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8e-8.5mdv2008.0.x86_64.rpm
 83b8e090dde48aae539074b0c5bd5368  2008.0/x86_64/openssl-0.9.8e-8.5mdv2008.0.x86_64.rpm 
 66ca48de65b3b7b79a675a5dd58f66bb  2008.0/SRPMS/openssl-0.9.8e-8.5mdv2008.0.src.rpm

 Mandriva Linux 2009.0:
 4909b82f6a8542d6c2c9a149e162b026  2009.0/i586/libopenssl0.9.8-0.9.8h-3.6mdv2009.0.i586.rpm
 9db39d348be788066c18b4c79a780708  2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.6mdv2009.0.i586.rpm
 731627e4d05b6be2d7677c8a3046c503  2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.6mdv2009.0.i586.rpm
 6ddcae79036144522d305c3b4a8ca65a  2009.0/i586/openssl-0.9.8h-3.6mdv2009.0.i586.rpm 
 67f542f557fa92711427da2f95627512  2009.0/SRPMS/openssl-0.9.8h-3.6mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 8217f398c7ac610c802f985df7ef7ae5  2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.6mdv2009.0.x86_64.rpm
 a71c716897f07f0a4076ee14b2ced952  2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.6mdv2009.0.x86_64.rpm
 f6e83931027ee725f7c2b5cb3e5a45ba  2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.6mdv2009.0.x86_64.rpm
 3f42139761e11ce8e2e80a3b88c03c55  2009.0/x86_64/openssl-0.9.8h-3.6mdv2009.0.x86_64.rpm 
 67f542f557fa92711427da2f95627512  2009.0/SRPMS/openssl-0.9.8h-3.6mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 986a9920a5e8d89fca5d29f5c44c22ea  2009.1/i586/libopenssl0.9.8-0.9.8k-1.4mdv2009.1.i586.rpm
 f99f88c47670dc818eabf9dcf59755ce  2009.1/i586/libopenssl0.9.8-devel-0.9.8k-1.4mdv2009.1.i586.rpm
 d6897c50cdac2690537345dec4eaabb5  2009.1/i586/libopenssl0.9.8-static-devel-0.9.8k-1.4mdv2009.1.i586.rpm
 05b1c396ff92151cf1b65dd6351ce0a3  2009.1/i586/openssl-0.9.8k-1.4mdv2009.1.i586.rpm 
 a747a26f98d79c52d7bdc290c0c39fdf  2009.1/SRPMS/openssl-0.9.8k-1.4mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 f8a6ce5af5b0542e3c67473a4343b047  2009.1/x86_64/lib64openssl0.9.8-0.9.8k-1.4mdv2009.1.x86_64.rpm
 bfb459b88345420630af971914ac28fc  2009.1/x86_64/lib64openssl0.9.8-devel-0.9.8k-1.4mdv2009.1.x86_64.rpm
 f39d2fe28b1f3832fefc16793b92d31d  2009.1/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-1.4mdv2009.1.x86_64.rpm
 8284232eed28cc67c5f03165775684c1  2009.1/x86_64/openssl-0.9.8k-1.4mdv2009.1.x86_64.rpm 
 a747a26f98d79c52d7bdc290c0c39fdf  2009.1/SRPMS/openssl-0.9.8k-1.4mdv2009.1.src.rpm

 Mandriva Linux 2010.0:
 f22f4dd656bae99ba9919e386f96f854  2010.0/i586/libopenssl0.9.8-0.9.8k-5.1mdv2010.0.i586.rpm
 3f8249525866e2ea9654d6980d70c268  2010.0/i586/libopenssl0.9.8-devel-0.9.8k-5.1mdv2010.0.i586.rpm
 0611b2c8434d2b775fc9bb9cdb166707  2010.0/i586/libopenssl0.9.8-static-devel-0.9.8k-5.1mdv2010.0.i586.rpm
 40cb74b266f75d4a661777f55b6dade7  2010.0/i586/openssl-0.9.8k-5.1mdv2010.0.i586.rpm 
 aaf56bf93ad0162cabfc9c1e79c032e1  2010.0/SRPMS/openssl-0.9.8k-5.1mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 b6ba70ce57f80b5beb65c0993a25bf97  2010.0/x86_64/lib64openssl0.9.8-0.9.8k-5.1mdv2010.0.x86_64.rpm
 b914d9aaf7f96e6e20aca4cdff65a7b7  2010.0/x86_64/lib64openssl0.9.8-devel-0.9.8k-5.1mdv2010.0.x86_64.rpm
 5fc0fa7b46c6e11f3e674b9102499f36  2010.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-5.1mdv2010.0.x86_64.rpm
 520aaad672453cbf183e7197fd46560a  2010.0/x86_64/openssl-0.9.8k-5.1mdv2010.0.x86_64.rpm 
 aaf56bf93ad0162cabfc9c1e79c032e1  2010.0/SRPMS/openssl-0.9.8k-5.1mdv2010.0.src.rpm

 Mandriva Enterprise Server 5:
 fad7dc3f1077f30d08f274ce44f090d6  mes5/i586/libopenssl0.9.8-0.9.8h-3.6mdvmes5.i586.rpm
 54fd62eb226ea70570ebc1308fe2e9de  mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.6mdvmes5.i586.rpm
 d71a5656a5d5ca2ccd84527319f5a2cd  mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.6mdvmes5.i586.rpm
 5c2155cf8f393adbe4f5724ffc9e6bcf  mes5/i586/openssl-0.9.8h-3.6mdvmes5.i586.rpm 
 9f26a70c2040f3818f1bc89fb0c4da17  mes5/SRPMS/openssl-0.9.8h-3.6mdvmes5.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 eabd8d47b6f5e0ae0448caa5f4c04a5f  mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.6mdvmes5.x86_64.rpm
 89bbef801b8f437868a99a246e00b8d8  mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.6mdvmes5.x86_64.rpm
 2cbe83e10207bc78fd1866281f89343b  mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.6mdvmes5.x86_64.rpm
 3b9bb15ded50e995da7839c62b2caeb2  mes5/x86_64/openssl-0.9.8h-3.6mdvmes5.x86_64.rpm 
 9f26a70c2040f3818f1bc89fb0c4da17  mes5/SRPMS/openssl-0.9.8h-3.6mdvmes5.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLWCPumqjQ0CJFipgRAmixAJ92G9eFjELSXkQeVbUZzNxMFC+CuACeJ/dm
0qKU+g9Ji+GTQ59kIu/5IFI=
=K01a
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists