Test ID:	1.3.6.1.4.1.25623.1.0.122803
Category:	Oracle Linux Local Security Checks
Title:	Oracle: Security Advisory (ELSA-2015-2617)
Summary:	The remote host is missing an update for the 'openssl' package(s) announced via the ELSA-2015-2617 advisory.
Description:	Summary: The remote host is missing an update for the 'openssl' package(s) announced via the ELSA-2015-2617 advisory. Vulnerability Insight: [1.0.1e-51.1] - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak - fix CVE-2015-3196 - race condition when handling PSK identity hint [1.0.1e-51] - fix the CVE-2015-1791 fix (broken server side renegotiation) [1.0.1e-50] - improved fix for CVE-2015-1791 - add missing parts of CVE-2015-0209 fix for correctness although unexploitable [1.0.1e-49] - fix CVE-2014-8176 - invalid free in DTLS buffering code - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent - fix CVE-2015-1791 - race condition handling NewSessionTicket - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function [1.0.1e-48] - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on read in multithreaded applications [1.0.1e-47] - fix CVE-2015-4000 - prevent the logjam attack on client - restrict the DH key size to at least 768 bits (limit will be increased in future) [1.0.1e-46] - drop the AES-GCM restriction of 2^32 operations because the IV is always 96 bits (32 bit fixed field + 64 bit invocation field) [1.0.1e-45] - update fix for CVE-2015-0287 to what was released upstream [1.0.1e-44] - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey() - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data - fix CVE-2015-0292 - integer underflow in base64 decoder - fix CVE-2015-0293 - triggerable assert in SSLv2 server [1.0.1e-43] - fix broken error detection when unwrapping unpadded key [1.0.1e-42.1] - fix the RFC 5649 for key material that does not need padding Affected Software/OS: 'openssl' package(s) on Oracle Linux 6, Oracle Linux 7. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-3194 BugTraq ID: 78623 http://www.securityfocus.com/bid/78623 BugTraq ID: 91787 http://www.securityfocus.com/bid/91787 Cisco Security Advisory: 20151204 Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl Debian Security Information: DSA-3413 (Google Search) http://www.debian.org/security/2015/dsa-3413 http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.html HPdes Security Advisory: HPSBGN03536 http://marc.info/?l=bugtraq&m=145382583417444&w=2 RedHat Security Advisories: RHSA-2015:2617 http://rhn.redhat.com/errata/RHSA-2015-2617.html RedHat Security Advisories: RHSA-2016:2957 http://rhn.redhat.com/errata/RHSA-2016-2957.html http://www.securitytracker.com/id/1034294 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583 SuSE Security Announcement: openSUSE-SU-2015:2288 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-12/msg00070.html SuSE Security Announcement: openSUSE-SU-2015:2289 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-12/msg00071.html SuSE Security Announcement: openSUSE-SU-2015:2318 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-12/msg00087.html SuSE Security Announcement: openSUSE-SU-2016:0637 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html SuSE Security Announcement: openSUSE-SU-2016:1332 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html http://www.ubuntu.com/usn/USN-2830-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-3195 http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html BugTraq ID: 78626 http://www.securityfocus.com/bid/78626 RedHat Security Advisories: RHSA-2015:2616 http://rhn.redhat.com/errata/RHSA-2015-2616.html RedHat Security Advisories: RHSA-2016:2056 http://rhn.redhat.com/errata/RHSA-2016-2056.html SuSE Security Announcement: SUSE-SU-2016:0678 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html SuSE Security Announcement: openSUSE-SU-2015:2349 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-12/msg00103.html SuSE Security Announcement: openSUSE-SU-2016:0640 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html Common Vulnerability Exposure (CVE) ID: CVE-2015-3196 BugTraq ID: 78622 http://www.securityfocus.com/bid/78622
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.