|
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2010:022
http://www.mandriva.com/security/
_______________________________________________________________________
Package : openssl
Date : January 21, 2010
Affected: 2008.0, 2009.0, 2009.1, 2010.0, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
Some vulnerabilities were discovered and corrected in openssl:
Memory leak in the zlib_stateful_finish function in
crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta
through Beta 4 allows remote attackers to cause a denial of service
(memory consumption) via vectors that trigger incorrect calls to the
CRYPTO_free_all_ex_data function, as demonstrated by use of SSLv3
and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678
(CVE-2009-4355).
Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.
The updated packages have been patched to correct thies issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4355
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.0:
a9a898f4dadf680f4332bfddfc525700 2008.0/i586/libopenssl0.9.8-0.9.8e-8.5mdv2008.0.i586.rpm
5365fe9fc3b8b48fc039f73a6e4aacc2 2008.0/i586/libopenssl0.9.8-devel-0.9.8e-8.5mdv2008.0.i586.rpm
f5de1c555b80b503f4c135ca1a05f525 2008.0/i586/libopenssl0.9.8-static-devel-0.9.8e-8.5mdv2008.0.i586.rpm
98d375a9df19e136a1874203e36e1f77 2008.0/i586/openssl-0.9.8e-8.5mdv2008.0.i586.rpm
66ca48de65b3b7b79a675a5dd58f66bb 2008.0/SRPMS/openssl-0.9.8e-8.5mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
8d695fc8e1d9b887040b2f04045a044c 2008.0/x86_64/lib64openssl0.9.8-0.9.8e-8.5mdv2008.0.x86_64.rpm
e8421d7082bccc3ca65884356cd4ec3a 2008.0/x86_64/lib64openssl0.9.8-devel-0.9.8e-8.5mdv2008.0.x86_64.rpm
d44773cfa42eebadc1fabedda4d09b5a 2008.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8e-8.5mdv2008.0.x86_64.rpm
83b8e090dde48aae539074b0c5bd5368 2008.0/x86_64/openssl-0.9.8e-8.5mdv2008.0.x86_64.rpm
66ca48de65b3b7b79a675a5dd58f66bb 2008.0/SRPMS/openssl-0.9.8e-8.5mdv2008.0.src.rpm
Mandriva Linux 2009.0:
4909b82f6a8542d6c2c9a149e162b026 2009.0/i586/libopenssl0.9.8-0.9.8h-3.6mdv2009.0.i586.rpm
9db39d348be788066c18b4c79a780708 2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.6mdv2009.0.i586.rpm
731627e4d05b6be2d7677c8a3046c503 2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.6mdv2009.0.i586.rpm
6ddcae79036144522d305c3b4a8ca65a 2009.0/i586/openssl-0.9.8h-3.6mdv2009.0.i586.rpm
67f542f557fa92711427da2f95627512 2009.0/SRPMS/openssl-0.9.8h-3.6mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
8217f398c7ac610c802f985df7ef7ae5 2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.6mdv2009.0.x86_64.rpm
a71c716897f07f0a4076ee14b2ced952 2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.6mdv2009.0.x86_64.rpm
f6e83931027ee725f7c2b5cb3e5a45ba 2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.6mdv2009.0.x86_64.rpm
3f42139761e11ce8e2e80a3b88c03c55 2009.0/x86_64/openssl-0.9.8h-3.6mdv2009.0.x86_64.rpm
67f542f557fa92711427da2f95627512 2009.0/SRPMS/openssl-0.9.8h-3.6mdv2009.0.src.rpm
Mandriva Linux 2009.1:
986a9920a5e8d89fca5d29f5c44c22ea 2009.1/i586/libopenssl0.9.8-0.9.8k-1.4mdv2009.1.i586.rpm
f99f88c47670dc818eabf9dcf59755ce 2009.1/i586/libopenssl0.9.8-devel-0.9.8k-1.4mdv2009.1.i586.rpm
d6897c50cdac2690537345dec4eaabb5 2009.1/i586/libopenssl0.9.8-static-devel-0.9.8k-1.4mdv2009.1.i586.rpm
05b1c396ff92151cf1b65dd6351ce0a3 2009.1/i586/openssl-0.9.8k-1.4mdv2009.1.i586.rpm
a747a26f98d79c52d7bdc290c0c39fdf 2009.1/SRPMS/openssl-0.9.8k-1.4mdv2009.1.src.rpm
Mandriva Linux 2009.1/X86_64:
f8a6ce5af5b0542e3c67473a4343b047 2009.1/x86_64/lib64openssl0.9.8-0.9.8k-1.4mdv2009.1.x86_64.rpm
bfb459b88345420630af971914ac28fc 2009.1/x86_64/lib64openssl0.9.8-devel-0.9.8k-1.4mdv2009.1.x86_64.rpm
f39d2fe28b1f3832fefc16793b92d31d 2009.1/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-1.4mdv2009.1.x86_64.rpm
8284232eed28cc67c5f03165775684c1 2009.1/x86_64/openssl-0.9.8k-1.4mdv2009.1.x86_64.rpm
a747a26f98d79c52d7bdc290c0c39fdf 2009.1/SRPMS/openssl-0.9.8k-1.4mdv2009.1.src.rpm
Mandriva Linux 2010.0:
f22f4dd656bae99ba9919e386f96f854 2010.0/i586/libopenssl0.9.8-0.9.8k-5.1mdv2010.0.i586.rpm
3f8249525866e2ea9654d6980d70c268 2010.0/i586/libopenssl0.9.8-devel-0.9.8k-5.1mdv2010.0.i586.rpm
0611b2c8434d2b775fc9bb9cdb166707 2010.0/i586/libopenssl0.9.8-static-devel-0.9.8k-5.1mdv2010.0.i586.rpm
40cb74b266f75d4a661777f55b6dade7 2010.0/i586/openssl-0.9.8k-5.1mdv2010.0.i586.rpm
aaf56bf93ad0162cabfc9c1e79c032e1 2010.0/SRPMS/openssl-0.9.8k-5.1mdv2010.0.src.rpm
Mandriva Linux 2010.0/X86_64:
b6ba70ce57f80b5beb65c0993a25bf97 2010.0/x86_64/lib64openssl0.9.8-0.9.8k-5.1mdv2010.0.x86_64.rpm
b914d9aaf7f96e6e20aca4cdff65a7b7 2010.0/x86_64/lib64openssl0.9.8-devel-0.9.8k-5.1mdv2010.0.x86_64.rpm
5fc0fa7b46c6e11f3e674b9102499f36 2010.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-5.1mdv2010.0.x86_64.rpm
520aaad672453cbf183e7197fd46560a 2010.0/x86_64/openssl-0.9.8k-5.1mdv2010.0.x86_64.rpm
aaf56bf93ad0162cabfc9c1e79c032e1 2010.0/SRPMS/openssl-0.9.8k-5.1mdv2010.0.src.rpm
Mandriva Enterprise Server 5:
fad7dc3f1077f30d08f274ce44f090d6 mes5/i586/libopenssl0.9.8-0.9.8h-3.6mdvmes5.i586.rpm
54fd62eb226ea70570ebc1308fe2e9de mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.6mdvmes5.i586.rpm
d71a5656a5d5ca2ccd84527319f5a2cd mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.6mdvmes5.i586.rpm
5c2155cf8f393adbe4f5724ffc9e6bcf mes5/i586/openssl-0.9.8h-3.6mdvmes5.i586.rpm
9f26a70c2040f3818f1bc89fb0c4da17 mes5/SRPMS/openssl-0.9.8h-3.6mdvmes5.src.rpm
Mandriva Enterprise Server 5/X86_64:
eabd8d47b6f5e0ae0448caa5f4c04a5f mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.6mdvmes5.x86_64.rpm
89bbef801b8f437868a99a246e00b8d8 mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.6mdvmes5.x86_64.rpm
2cbe83e10207bc78fd1866281f89343b mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.6mdvmes5.x86_64.rpm
3b9bb15ded50e995da7839c62b2caeb2 mes5/x86_64/openssl-0.9.8h-3.6mdvmes5.x86_64.rpm
9f26a70c2040f3818f1bc89fb0c4da17 mes5/SRPMS/openssl-0.9.8h-3.6mdvmes5.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team