| Description: | Summary:
The remote host is missing an update for the 'openssl' package(s) announced via the SSA:2016-062-02 advisory.
Vulnerability Insight:
New openssl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
and -current to fix security issues.
Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/openssl-1.0.1s-i486-1_slack14.1.txz: Upgraded.
This update fixes the following security issues:
Cross-protocol attack on TLS using SSLv2 (DROWN) (CVE-2016-0800)
Double-free in DSA code (CVE-2016-0705)
Memory leak in SRP database lookups (CVE-2016-0798)
BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption (CVE-2016-0797)
Fix memory issues in BIO_*printf functions (CVE-2016-0799)
Side channel attack on modular exponentiation (CVE-2016-0702)
To avoid breaking the ABI, 'enable-ssl2' is used, but all the vulnerable or
weak ciphers have been removed.
For more information, see:
[links moved to references]
(* Security fix *)
patches/packages/openssl-solibs-1.0.1s-i486-1_slack14.1.txz: Upgraded.
+--------------------------+
Affected Software/OS:
'openssl' package(s) on Slackware 13.0, Slackware 13.1, Slackware 13.37, Slackware 14.0, Slackware 14.1, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
