MDVSA-2010:022

Package name
openssl
Date
2010-01-21
Advisory ID
MDVSA-2010:022
Affected versions
2009.0 x86_64 , MES5 i586 , 2010.0 x86_64 , 2010.0 i586 , 2009.1 i586 , 2009.0 i586 , 2008.0 x86_64 , 2008.0 i586 , 2009.1 x86_64 , MES5 x86_64

Problem description

Some vulnerabilities were discovered and corrected in openssl:

Memory leak in the zlib_stateful_finish function in
crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta
through Beta 4 allows remote attackers to cause a denial of service
(memory consumption) via vectors that trigger incorrect calls to the
CRYPTO_free_all_ex_data function, as demonstrated by use of SSLv3
and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678
(CVE-2009-4355).

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.

The updated packages have been patched to correct thies issue.

Updated packages

2009.0 x86_64

 8217f398c7ac610c802f985df7ef7ae5  2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.6mdv2009.0.x86_64.rpm
 a71c716897f07f0a4076ee14b2ced952  2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.6mdv2009.0.x86_64.rpm
 f6e83931027ee725f7c2b5cb3e5a45ba  2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.6mdv2009.0.x86_64.rpm
 3f42139761e11ce8e2e80a3b88c03c55  2009.0/x86_64/openssl-0.9.8h-3.6mdv2009.0.x86_64.rpm 
 67f542f557fa92711427da2f95627512  2009.0/SRPMS/openssl-0.9.8h-3.6mdv2009.0.src.rpm

MES5 i586

 fad7dc3f1077f30d08f274ce44f090d6  mes5/i586/libopenssl0.9.8-0.9.8h-3.6mdvmes5.i586.rpm
 54fd62eb226ea70570ebc1308fe2e9de  mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.6mdvmes5.i586.rpm
 d71a5656a5d5ca2ccd84527319f5a2cd  mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.6mdvmes5.i586.rpm
 5c2155cf8f393adbe4f5724ffc9e6bcf  mes5/i586/openssl-0.9.8h-3.6mdvmes5.i586.rpm 
 9f26a70c2040f3818f1bc89fb0c4da17  mes5/SRPMS/openssl-0.9.8h-3.6mdvmes5.src.rpm

2010.0 x86_64

 b6ba70ce57f80b5beb65c0993a25bf97  2010.0/x86_64/lib64openssl0.9.8-0.9.8k-5.1mdv2010.0.x86_64.rpm
 b914d9aaf7f96e6e20aca4cdff65a7b7  2010.0/x86_64/lib64openssl0.9.8-devel-0.9.8k-5.1mdv2010.0.x86_64.rpm
 5fc0fa7b46c6e11f3e674b9102499f36  2010.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-5.1mdv2010.0.x86_64.rpm
 520aaad672453cbf183e7197fd46560a  2010.0/x86_64/openssl-0.9.8k-5.1mdv2010.0.x86_64.rpm 
 aaf56bf93ad0162cabfc9c1e79c032e1  2010.0/SRPMS/openssl-0.9.8k-5.1mdv2010.0.src.rpm

2010.0 i586

 f22f4dd656bae99ba9919e386f96f854  2010.0/i586/libopenssl0.9.8-0.9.8k-5.1mdv2010.0.i586.rpm
 3f8249525866e2ea9654d6980d70c268  2010.0/i586/libopenssl0.9.8-devel-0.9.8k-5.1mdv2010.0.i586.rpm
 0611b2c8434d2b775fc9bb9cdb166707  2010.0/i586/libopenssl0.9.8-static-devel-0.9.8k-5.1mdv2010.0.i586.rpm
 40cb74b266f75d4a661777f55b6dade7  2010.0/i586/openssl-0.9.8k-5.1mdv2010.0.i586.rpm 
 aaf56bf93ad0162cabfc9c1e79c032e1  2010.0/SRPMS/openssl-0.9.8k-5.1mdv2010.0.src.rpm

2009.1 i586

 986a9920a5e8d89fca5d29f5c44c22ea  2009.1/i586/libopenssl0.9.8-0.9.8k-1.4mdv2009.1.i586.rpm
 f99f88c47670dc818eabf9dcf59755ce  2009.1/i586/libopenssl0.9.8-devel-0.9.8k-1.4mdv2009.1.i586.rpm
 d6897c50cdac2690537345dec4eaabb5  2009.1/i586/libopenssl0.9.8-static-devel-0.9.8k-1.4mdv2009.1.i586.rpm
 05b1c396ff92151cf1b65dd6351ce0a3  2009.1/i586/openssl-0.9.8k-1.4mdv2009.1.i586.rpm 
 a747a26f98d79c52d7bdc290c0c39fdf  2009.1/SRPMS/openssl-0.9.8k-1.4mdv2009.1.src.rpm

2009.0 i586

 4909b82f6a8542d6c2c9a149e162b026  2009.0/i586/libopenssl0.9.8-0.9.8h-3.6mdv2009.0.i586.rpm
 9db39d348be788066c18b4c79a780708  2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.6mdv2009.0.i586.rpm
 731627e4d05b6be2d7677c8a3046c503  2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.6mdv2009.0.i586.rpm
 6ddcae79036144522d305c3b4a8ca65a  2009.0/i586/openssl-0.9.8h-3.6mdv2009.0.i586.rpm 
 67f542f557fa92711427da2f95627512  2009.0/SRPMS/openssl-0.9.8h-3.6mdv2009.0.src.rpm

2008.0 x86_64

 8d695fc8e1d9b887040b2f04045a044c  2008.0/x86_64/lib64openssl0.9.8-0.9.8e-8.5mdv2008.0.x86_64.rpm
 e8421d7082bccc3ca65884356cd4ec3a  2008.0/x86_64/lib64openssl0.9.8-devel-0.9.8e-8.5mdv2008.0.x86_64.rpm
 d44773cfa42eebadc1fabedda4d09b5a  2008.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8e-8.5mdv2008.0.x86_64.rpm
 83b8e090dde48aae539074b0c5bd5368  2008.0/x86_64/openssl-0.9.8e-8.5mdv2008.0.x86_64.rpm 
 66ca48de65b3b7b79a675a5dd58f66bb  2008.0/SRPMS/openssl-0.9.8e-8.5mdv2008.0.src.rpm

2008.0 i586

 a9a898f4dadf680f4332bfddfc525700  2008.0/i586/libopenssl0.9.8-0.9.8e-8.5mdv2008.0.i586.rpm
 5365fe9fc3b8b48fc039f73a6e4aacc2  2008.0/i586/libopenssl0.9.8-devel-0.9.8e-8.5mdv2008.0.i586.rpm
 f5de1c555b80b503f4c135ca1a05f525  2008.0/i586/libopenssl0.9.8-static-devel-0.9.8e-8.5mdv2008.0.i586.rpm
 98d375a9df19e136a1874203e36e1f77  2008.0/i586/openssl-0.9.8e-8.5mdv2008.0.i586.rpm 
 66ca48de65b3b7b79a675a5dd58f66bb  2008.0/SRPMS/openssl-0.9.8e-8.5mdv2008.0.src.rpm

2009.1 x86_64

 f8a6ce5af5b0542e3c67473a4343b047  2009.1/x86_64/lib64openssl0.9.8-0.9.8k-1.4mdv2009.1.x86_64.rpm
 bfb459b88345420630af971914ac28fc  2009.1/x86_64/lib64openssl0.9.8-devel-0.9.8k-1.4mdv2009.1.x86_64.rpm
 f39d2fe28b1f3832fefc16793b92d31d  2009.1/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-1.4mdv2009.1.x86_64.rpm
 8284232eed28cc67c5f03165775684c1  2009.1/x86_64/openssl-0.9.8k-1.4mdv2009.1.x86_64.rpm 
 a747a26f98d79c52d7bdc290c0c39fdf  2009.1/SRPMS/openssl-0.9.8k-1.4mdv2009.1.src.rpm

MES5 x86_64

 eabd8d47b6f5e0ae0448caa5f4c04a5f  mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.6mdvmes5.x86_64.rpm
 89bbef801b8f437868a99a246e00b8d8  mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.6mdvmes5.x86_64.rpm
 2cbe83e10207bc78fd1866281f89343b  mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.6mdvmes5.x86_64.rpm
 3b9bb15ded50e995da7839c62b2caeb2  mes5/x86_64/openssl-0.9.8h-3.6mdvmes5.x86_64.rpm 
 9f26a70c2040f3818f1bc89fb0c4da17  mes5/SRPMS/openssl-0.9.8h-3.6mdvmes5.src.rpm

References