Debian Security Advisory
DSA-3197-1 openssl -- security update
- Date Reported:
- 19 Mar 2015
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2015-0209, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292.
- More information:
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues:
Stephen Henson discovered that the ASN1_TYPE_cmp() function can be crashed, resulting in denial of service.
Emilia Kaesper discovered a memory corruption in ASN.1 parsing.
Michal Zalewski discovered a NULL pointer dereference in the PKCS#7 parsing code, resulting in denial of service.
It was discovered that missing input sanitising in base64 decoding might result in memory corruption.
It was discovered that a malformed EC private key might result in memory corruption.
It was discovered that missing input sanitising in the X509_to_X509_REQ() function might result in denial of service.
For the stable distribution (wheezy), these problems have been fixed in version 1.0.1e-2+deb7u15. In this update the export ciphers are removed from the default cipher list.
We recommend that you upgrade your openssl packages.