CVE-2016-0705
OpenSSL: Double-free in DSA code
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Amazon. Niedriger laut Oracle (hoch), Red Hat (niedrig), Ubuntu (niedrig).
Beschreibung
Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | mysql56, mysql56-bench, mysql56-common und 13 weitere | 5.6.30-1.15.amzn1 und 1 weitere |
| debian 11 | openssl | 1.0.2g-1 |
| debian 12 | openssl | 1.0.2g-1 |
| debian 13 | openssl | 1.0.2g-1 |
| debian 14 | openssl | 1.0.2g-1 |
| debian 7 | openssl | 1.0.1e-2+deb7u20 |
| debian 8 | openssl | 1.0.1k-3+deb8u4 |
| echo | openssl | 1.0.2g-1 |
| Oracle Linux 6 | openssl, openssl-devel, openssl-perl und 1 weitere | 1.0.1e-42.el6_7.4 |
| Oracle Linux 7 | openssl, openssl-devel, openssl-libs und 2 weitere | 1:1.0.1e-51.el7_2.4 |
| Red Hat | rhel-guest-image | kein Fix angegeben |
| root.io debian 11 | rootio-openssl | 1.0.2g-1 |
Alle 43 Einträge aus 20 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | mysql56 | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-bench | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-common | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-debuginfo | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-devel | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-embedded | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-embedded-devel | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-errmsg | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-libs | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-server | 5.6.30-1.15.amzn1 |
| amazon linux 1 | mysql56-test | 5.6.30-1.15.amzn1 |
| amazon linux 1 | openssl | 1:1.0.1k-14.89.amzn1 |
| amazon linux 1 | openssl-debuginfo | 1:1.0.1k-14.89.amzn1 |
| amazon linux 1 | openssl-devel | 1:1.0.1k-14.89.amzn1 |
| amazon linux 1 | openssl-perl | 1:1.0.1k-14.89.amzn1 |
| amazon linux 1 | openssl-static | 1:1.0.1k-14.89.amzn1 |
| debian 11 | openssl | 1.0.2g-1 |
| debian 12 | openssl | 1.0.2g-1 |
| debian 13 | openssl | 1.0.2g-1 |
| debian 14 | openssl | 1.0.2g-1 |
| debian 7 | openssl | 1.0.1e-2+deb7u20 |
| debian 8 | openssl | 1.0.1k-3+deb8u4 |
| echo | openssl | 1.0.2g-1 |
| Oracle Linux 6 | openssl | 1.0.1e-42.el6_7.4 |
| Oracle Linux 6 | openssl-devel | 1.0.1e-42.el6_7.4 |
| Oracle Linux 6 | openssl-perl | 1.0.1e-42.el6_7.4 |
| Oracle Linux 6 | openssl-static | 1.0.1e-42.el6_7.4 |
| Oracle Linux 7 | openssl | 1:1.0.1e-51.el7_2.4 |
| Oracle Linux 7 | openssl-devel | 1:1.0.1e-51.el7_2.4 |
| Oracle Linux 7 | openssl-libs | 1:1.0.1e-51.el7_2.4 |
| Oracle Linux 7 | openssl-perl | 1:1.0.1e-51.el7_2.4 |
| Oracle Linux 7 | openssl-static | 1:1.0.1e-51.el7_2.4 |
| Red Hat | rhel-guest-image | kein Fix angegeben |
| root.io debian 11 | rootio-openssl | 1.0.2g-1 |
| root.io debian 12 | rootio-openssl | 1.0.2g-1 |
| seal Red Hat 6 | openssl | 1.0.1e-59.el6_10+sp999, 1.0.1e-61.el6_10+sp999 |
| seal Red Hat 6 | seal-openssl | 1.0.1e-59.el6_10+sp999, 1.0.1e-61.el6_10+sp999 |
| ubuntu 12.04 | openssl | 1.0.1-4ubuntu5.35 |
| ubuntu 14.04 | openssl | 1.0.1f-1ubuntu2.18 |
| ubuntu 14.04-ESM | openssl | 1.0.1f-1ubuntu2.18 |
| ubuntu 15.10 | openssl | 1.0.2d-0ubuntu1.4 |
| ubuntu 16.04 | openssl | 1.0.2g-1ubuntu2 |
| ubuntu 16.04-ESM | openssl | 1.0.2g-1ubuntu2 |
Referenzen
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178358.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178817.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00005.html
Alle 63 Referenzen
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html
- http://marc.info/?l=bugtraq&m=145889460330120&w=2
- http://marc.info/?l=bugtraq&m=145983526810210&w=2
- http://marc.info/?l=bugtraq&m=146108058503441&w=2
- http://openssl.org/news/secadv/20160301.txt
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://source.android.com/security/bulletin/2016-05-01.html
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-openssl
- http://www.debian.org/security/2016/dsa-3500
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/83754
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1035133
- http://www.ubuntu.com/usn/USN-2914-1
- https://access.redhat.com/errata/RHSA-2018:2568
- https://access.redhat.com/errata/RHSA-2018:2575
- https://access.redhat.com/errata/RHSA-2018:2713
- https://access.redhat.com/security/cve/CVE-2016-0705
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=6c88c71b4e4825c7bc0489306d062d017634eb88
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05126404
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05135617
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150736
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05176716
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168
- https://linux.oracle.com/cve/CVE-2016-0705.html
- https://linux.oracle.com/errata/ELSA-2016-0301.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-0705
- https://security.freebsd.org/advisories/FreeBSD-SA-16:12.openssl.asc
- https://security.gentoo.org/glsa/201603-15
- https://ubuntu.com/security/notices/USN-2914-1
- https://www.cve.org/CVERecord?id=CVE-2016-0705
- https://www.openssl.org/news/secadv/20160301.txt