Vulnerability   
Search   
    Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.871340
Category:Red Hat Local Security Checks
Title:RedHat Update for openssl RHSA-2015:0715-01
Summary:The remote host is missing an update for the 'openssl'; package(s) announced via the referenced advisory.
Description:Summary:
The remote host is missing an update for the 'openssl'
package(s) announced via the referenced advisory.

Vulnerability Insight:
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.

An invalid pointer use flaw was found in OpenSSL's ASN1_TYPE_cmp()
function. A remote attacker could crash a TLS/SSL client or server using
OpenSSL via a specially crafted X.509 certificate when the
attacker-supplied certificate was verified by the application.
(CVE-2015-0286)

An integer underflow flaw, leading to a buffer overflow, was found in the
way OpenSSL decoded malformed Base64-encoded inputs. An attacker able to
make an application using OpenSSL decode a specially crafted Base64-encoded
input (such as a PEM file) could use this flaw to cause the application to
crash. Note: this flaw is not exploitable via the TLS/SSL protocol because
the data being transferred is not Base64-encoded. (CVE-2015-0292)

A denial of service flaw was found in the way OpenSSL handled SSLv2
handshake messages. A remote attacker could use this flaw to cause a
TLS/SSL server using OpenSSL to exit on a failed assertion if it had both
the SSLv2 protocol and EXPORT-grade cipher suites enabled. (CVE-2015-0293)

A use-after-free flaw was found in the way OpenSSL imported malformed
Elliptic Curve private keys. A specially crafted key file could cause an
application using OpenSSL to crash when imported. (CVE-2015-0209)

An out-of-bounds write flaw was found in the way OpenSSL reused certain
ASN.1 structures. A remote attacker could possibly use a specially crafted
ASN.1 structure that, when parsed by an application, would cause that
application to crash. (CVE-2015-0287)

A NULL pointer dereference flaw was found in OpenSSL's X.509 certificate
handling implementation. A specially crafted X.509 certificate could cause
an application using OpenSSL to crash if the application attempted to
convert the certificate to a certificate request. (CVE-2015-0288)

A NULL pointer dereference was found in the way OpenSSL handled certain
PKCS#7 inputs. An attacker able to make an application using OpenSSL
verify, decrypt, or parse a specially crafted PKCS#7 input could cause that
application to crash. TLS/SSL clients and servers using OpenSSL were not
affected by this flaw. (CVE-2015-0289)

Red Hat would like to thank the OpenSSL project for reporting
CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292,
and CVE-2015-0293. Upstream acknowledges Stephen Henson of the OpenSSL
development team as the original repor ...

Description truncated, please see the referenced URL(s) for more information.

Affected Software/OS:
openssl on Red Hat Enterprise Linux Desktop (v. 6),
Red Hat Enterprise Linux Server (v. 6),
Red Hat Enterprise Linux Workstation (v. 6)

Solution:
Please Install the Updated Packages.

CVSS Score:
7.5

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2015-0209
http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
BugTraq ID: 73239
http://www.securityfocus.com/bid/73239
Debian Security Information: DSA-3197 (Google Search)
http://www.debian.org/security/2015/dsa-3197
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157177.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156823.html
FreeBSD Security Advisory: FreeBSD-SA-15:06
https://www.freebsd.org/security/advisories/FreeBSD-SA-15%3A06.openssl.asc
https://security.gentoo.org/glsa/201503-11
HPdes Security Advisory: HPSBGN03306
http://marc.info/?l=bugtraq&m=142841429220765&w=2
HPdes Security Advisory: HPSBMU03380
http://marc.info/?l=bugtraq&m=143748090628601&w=2
HPdes Security Advisory: HPSBMU03397
http://marc.info/?l=bugtraq&m=144050297101809&w=2
HPdes Security Advisory: HPSBMU03409
http://marc.info/?l=bugtraq&m=144050155601375&w=2
HPdes Security Advisory: HPSBMU03413
http://marc.info/?l=bugtraq&m=144050254401665&w=2
HPdes Security Advisory: HPSBUX03334
http://marc.info/?l=bugtraq&m=143213830203296&w=2
HPdes Security Advisory: SSRT102000
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
http://www.mandriva.com/security/advisories?name=MDVSA-2015:063
RedHat Security Advisories: RHSA-2015:0715
http://rhn.redhat.com/errata/RHSA-2015-0715.html
RedHat Security Advisories: RHSA-2015:0716
http://rhn.redhat.com/errata/RHSA-2015-0716.html
RedHat Security Advisories: RHSA-2015:0752
http://rhn.redhat.com/errata/RHSA-2015-0752.html
RedHat Security Advisories: RHSA-2016:1089
http://rhn.redhat.com/errata/RHSA-2016-1089.html
RedHat Security Advisories: RHSA-2016:2957
http://rhn.redhat.com/errata/RHSA-2016-2957.html
http://www.securitytracker.com/id/1031929
SuSE Security Announcement: SUSE-SU-2015:0541 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00022.html
SuSE Security Announcement: openSUSE-SU-2015:0554 (Google Search)
http://lists.opensuse.org/opensuse-updates/2015-03/msg00062.html
SuSE Security Announcement: openSUSE-SU-2015:1277 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html
SuSE Security Announcement: openSUSE-SU-2016:0640 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
http://www.ubuntu.com/usn/USN-2537-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-0286
http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
BugTraq ID: 73225
http://www.securityfocus.com/bid/73225
http://www.securitytracker.com/id/1032917
SuSE Security Announcement: SUSE-SU-2015:0578 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-0287
BugTraq ID: 73227
http://www.securityfocus.com/bid/73227
RedHat Security Advisories: RHSA-2015:0800
http://rhn.redhat.com/errata/RHSA-2015-0800.html
SuSE Security Announcement: SUSE-SU-2016:0678 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-0288
BugTraq ID: 73237
http://www.securityfocus.com/bid/73237
Common Vulnerability Exposure (CVE) ID: CVE-2015-0289
BugTraq ID: 73231
http://www.securityfocus.com/bid/73231
Common Vulnerability Exposure (CVE) ID: CVE-2015-0292
BugTraq ID: 73228
http://www.securityfocus.com/bid/73228
Common Vulnerability Exposure (CVE) ID: CVE-2015-0293
BugTraq ID: 73232
http://www.securityfocus.com/bid/73232
SuSE Security Announcement: SUSE-SU-2016:0617 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html
SuSE Security Announcement: SUSE-SU-2016:0620 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
SuSE Security Announcement: SUSE-SU-2016:0621 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html
SuSE Security Announcement: SUSE-SU-2016:0624 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html
SuSE Security Announcement: SUSE-SU-2016:0631 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html
SuSE Security Announcement: SUSE-SU-2016:0641 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html
SuSE Security Announcement: SUSE-SU-2016:1057 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html
SuSE Security Announcement: openSUSE-SU-2016:0628 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html
SuSE Security Announcement: openSUSE-SU-2016:0637 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html
SuSE Security Announcement: openSUSE-SU-2016:0638 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html
SuSE Security Announcement: openSUSE-SU-2016:0720 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html
CopyrightCopyright (C) 2015 Greenbone Networks GmbH

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.