full-disclosure - [ MDVSA-2012:060 ] openssl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1SKvZN-0005cW-KC@titan.mandriva.com>
Date: Thu, 19 Apr 2012 19:55:01 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2012:060 ] openssl

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2012:060
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : openssl
 Date    : April 19, 2012
 Affected: 2010.1, 2011., Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A potentially exploitable vulnerability has been discovered in
 the OpenSSL function asn1_d2i_read_bio that affects S/MIME or CMS
 applications using the built in MIME parser SMIME_read_PKCS7 or
 SMIME_read_CMS (CVE-2012-2110).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110
 http://www.openssl.org/news/secadv_20120419.txt
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2010.1:
 dd02ccb47f1f0186ea2666bf4e4ea654  2010.1/i586/libopenssl0.9.8-0.9.8v-0.1mdv2010.2.i586.rpm
 940f8619817517593c39d32393a72a9b  2010.1/i586/libopenssl1.0.0-1.0.0a-1.12mdv2010.2.i586.rpm
 7171b24070750b1c5d35a48fbe130c6f  2010.1/i586/libopenssl1.0.0-devel-1.0.0a-1.12mdv2010.2.i586.rpm
 f86dae4d6a6c4f9cc655ac6f2d05c54b  2010.1/i586/libopenssl1.0.0-static-devel-1.0.0a-1.12mdv2010.2.i586.rpm
 ec1a0346e0c59450ae7e61ae4fadfda3  2010.1/i586/libopenssl-engines1.0.0-1.0.0a-1.12mdv2010.2.i586.rpm
 b21a278ec7e4bc417fa687232f3eee54  2010.1/i586/openssl-1.0.0a-1.12mdv2010.2.i586.rpm 
 618ce5827a69c42704c138605b35f304  2010.1/SRPMS/openssl0.9.8-0.9.8v-0.1mdv2010.2.src.rpm
 50465c31c0741ce8ad33bbf9b939c1b1  2010.1/SRPMS/openssl-1.0.0a-1.12mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 991ff30ceb5425c7067f2630210fc36b  2010.1/x86_64/lib64openssl0.9.8-0.9.8v-0.1mdv2010.2.x86_64.rpm
 48334a9b4c9ba24b179fe61a3bcc9da6  2010.1/x86_64/lib64openssl1.0.0-1.0.0a-1.12mdv2010.2.x86_64.rpm
 0608076c3867169789918249361c9d2c  2010.1/x86_64/lib64openssl1.0.0-devel-1.0.0a-1.12mdv2010.2.x86_64.rpm
 4ab52b125e9f1ab109666e3f3b7bbb32  2010.1/x86_64/lib64openssl1.0.0-static-devel-1.0.0a-1.12mdv2010.2.x86_64.rpm
 bcc1ac795db80d77b5b62fdc3a7dacb8  2010.1/x86_64/lib64openssl-engines1.0.0-1.0.0a-1.12mdv2010.2.x86_64.rpm
 6ec558667fd46a6f861c86edc373c6bf  2010.1/x86_64/openssl-1.0.0a-1.12mdv2010.2.x86_64.rpm 
 618ce5827a69c42704c138605b35f304  2010.1/SRPMS/openssl0.9.8-0.9.8v-0.1mdv2010.2.src.rpm
 50465c31c0741ce8ad33bbf9b939c1b1  2010.1/SRPMS/openssl-1.0.0a-1.12mdv2010.2.src.rpm

 Mandriva Linux 2011:
 5c4d2ebd62ca4902c33af45f142ac4dc  2011/i586/libopenssl1.0.0-1.0.0d-2.5-mdv2011.0.i586.rpm
 74097913bf7d112bb302088111e7c47b  2011/i586/libopenssl-devel-1.0.0d-2.5-mdv2011.0.i586.rpm
 60710d4654f43babebdda414b64b7c7d  2011/i586/libopenssl-engines1.0.0-1.0.0d-2.5-mdv2011.0.i586.rpm
 602fa24f9bd89b71a15a6d437e5c3762  2011/i586/libopenssl-static-devel-1.0.0d-2.5-mdv2011.0.i586.rpm
 75a5f322268efc20031cde19d3ce4804  2011/i586/openssl-1.0.0d-2.5-mdv2011.0.i586.rpm 
 04e221404fd3441d5ab719d5b169c19f  2011/SRPMS/openssl-1.0.0d-2.5.src.rpm

 Mandriva Linux 2011/X86_64:
 b9779bda3c7c7174aa4ee7242c29eddb  2011/x86_64/lib64openssl1.0.0-1.0.0d-2.5-mdv2011.0.x86_64.rpm
 f2791c8922745026f6dfeb6e835ce7c0  2011/x86_64/lib64openssl-devel-1.0.0d-2.5-mdv2011.0.x86_64.rpm
 3c6c071feb4c4ca40d7e8d00bd408b0a  2011/x86_64/lib64openssl-engines1.0.0-1.0.0d-2.5-mdv2011.0.x86_64.rpm
 906899fe11101597cd8dc57432c6e170  2011/x86_64/lib64openssl-static-devel-1.0.0d-2.5-mdv2011.0.x86_64.rpm
 f7fa3a9643589b5c19e597333d2f82ab  2011/x86_64/openssl-1.0.0d-2.5-mdv2011.0.x86_64.rpm 
 04e221404fd3441d5ab719d5b169c19f  2011/SRPMS/openssl-1.0.0d-2.5.src.rpm

 Mandriva Enterprise Server 5:
 02bd37190274c5146ccc957104749720  mes5/i586/libopenssl0.9.8-0.9.8h-3.15mdvmes5.2.i586.rpm
 bc32691d48e647fb522cbd81acb24b20  mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.15mdvmes5.2.i586.rpm
 af5ef21840a2131584c89aec4fd9380d  mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.15mdvmes5.2.i586.rpm
 29483c4c2d15d04fbcc8a0dc549c3ec4  mes5/i586/openssl-0.9.8h-3.15mdvmes5.2.i586.rpm 
 a4f69e6f2f298491331a63518680e95d  mes5/SRPMS/openssl-0.9.8h-3.15mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 e071c6df557f30b89a50e1c75d3548ed  mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.15mdvmes5.2.x86_64.rpm
 b2844aa38800d9235144ebd806990882  mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.15mdvmes5.2.x86_64.rpm
 d47106ae69b84af2ea0e907c5df1d7c0  mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.15mdvmes5.2.x86_64.rpm
 8f908ac5cabbc0bbde9773dd44f00bbf  mes5/x86_64/openssl-0.9.8h-3.15mdvmes5.2.x86_64.rpm 
 a4f69e6f2f298491331a63518680e95d  mes5/SRPMS/openssl-0.9.8h-3.15mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFPkCNimqjQ0CJFipgRAr50AJ9wbb2iVuOj/rxwTegLnt07UDFNmQCeKKm2
vm6/Cf6U06zk+5zICLcTIVA=
=EqO1
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/