SUSE Security Update: Security update for OpenSSL 1.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0762-1 Rating: critical References: #876282 #880891 Cross-References: CVE-2014-0195 CVE-2014-0198 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: SUSE Linux Enterprise Security Module 11 SP3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: OpenSSL was updated to fix several vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * DTLS invalid fragment vulnerability. (CVE-2014-0195) * SSL_MODE_RELEASE_BUFFERS NULL pointer dereference. (CVE-2014-0198) * Anonymous ECDH denial of service. (CVE-2014-3470) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2014-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221> * CVE-2014-0195 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0195> * CVE-2014-0198 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0198> * CVE-2014-3470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Security Module 11 SP3: zypper in -t patch secsp3-libopenssl1-devel-9325 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Security Module 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl1-devel-1.0.1g-0.16.1 libopenssl1_0_0-1.0.1g-0.16.1 openssl1-1.0.1g-0.16.1 openssl1-doc-1.0.1g-0.16.1 - SUSE Linux Enterprise Security Module 11 SP3 (ppc64 s390x x86_64): libopenssl1_0_0-32bit-1.0.1g-0.16.1 - SUSE Linux Enterprise Security Module 11 SP3 (ia64): libopenssl1_0_0-x86-1.0.1g-0.16.1 References: http://support.novell.com/security/cve/CVE-2014-0195.html http://support.novell.com/security/cve/CVE-2014-0198.html http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/876282 https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=61cb4c46d00371ca48e4548ed26e... -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org