openSUSE Security Update : compat-openssl098 (openSUSE-2016-575)

Critical Nessus Plugin ID 91070


The remote openSUSE host is missing a security update.


This update for compat-openssl098 fixes the following issues :

- CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617)

- CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614)

- CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615)

- CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942)

- CVE-2016-0702: Side channel attack on modular exponentiation 'CacheBleed' (bsc#968050)

- bsc#976943: Buffer overrun in ASN1_parse

The following non-security bugs were fixed :

- bsc#889013: Rename README.SuSE to the new spelling (bsc#889013)

This update was imported from the SUSE:SLE-12:Update update project.


Update the affected compat-openssl098 packages.

See Also

Plugin Details

Severity: Critical

ID: 91070

File Name: openSUSE-2016-575.nasl

Version: $Revision: 2.4 $

Type: local

Agent: unix

Published: 2016/05/12

Modified: 2016/10/13

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C


Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:compat-openssl098-debugsource, p-cpe:/a:novell:opensuse:libopenssl0_9_8, p-cpe:/a:novell:opensuse:libopenssl0_9_8-32bit, p-cpe:/a:novell:opensuse:libopenssl0_9_8-debuginfo, p-cpe:/a:novell:opensuse:libopenssl0_9_8-debuginfo-32bit, cpe:/o:novell:opensuse:42.1

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2016/05/10

Reference Information

CVE: CVE-2016-0702, CVE-2016-2105, CVE-2016-2106, CVE-2016-2108, CVE-2016-2109