-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2010:022 http://www.mandriva.com/security/ _______________________________________________________________________ Package : openssl Date : January 21, 2010 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Some vulnerabilities were discovered and corrected in openssl: Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_free_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678 (CVE-2009-4355). Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. The updated packages have been patched to correct thies issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4355 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.0: a9a898f4dadf680f4332bfddfc525700 2008.0/i586/libopenssl0.9.8-0.9.8e-8.5mdv2008.0.i586.rpm 5365fe9fc3b8b48fc039f73a6e4aacc2 2008.0/i586/libopenssl0.9.8-devel-0.9.8e-8.5mdv2008.0.i586.rpm f5de1c555b80b503f4c135ca1a05f525 2008.0/i586/libopenssl0.9.8-static-devel-0.9.8e-8.5mdv2008.0.i586.rpm 98d375a9df19e136a1874203e36e1f77 2008.0/i586/openssl-0.9.8e-8.5mdv2008.0.i586.rpm 66ca48de65b3b7b79a675a5dd58f66bb 2008.0/SRPMS/openssl-0.9.8e-8.5mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 8d695fc8e1d9b887040b2f04045a044c 2008.0/x86_64/lib64openssl0.9.8-0.9.8e-8.5mdv2008.0.x86_64.rpm e8421d7082bccc3ca65884356cd4ec3a 2008.0/x86_64/lib64openssl0.9.8-devel-0.9.8e-8.5mdv2008.0.x86_64.rpm d44773cfa42eebadc1fabedda4d09b5a 2008.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8e-8.5mdv2008.0.x86_64.rpm 83b8e090dde48aae539074b0c5bd5368 2008.0/x86_64/openssl-0.9.8e-8.5mdv2008.0.x86_64.rpm 66ca48de65b3b7b79a675a5dd58f66bb 2008.0/SRPMS/openssl-0.9.8e-8.5mdv2008.0.src.rpm Mandriva Linux 2009.0: 4909b82f6a8542d6c2c9a149e162b026 2009.0/i586/libopenssl0.9.8-0.9.8h-3.6mdv2009.0.i586.rpm 9db39d348be788066c18b4c79a780708 2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.6mdv2009.0.i586.rpm 731627e4d05b6be2d7677c8a3046c503 2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.6mdv2009.0.i586.rpm 6ddcae79036144522d305c3b4a8ca65a 2009.0/i586/openssl-0.9.8h-3.6mdv2009.0.i586.rpm 67f542f557fa92711427da2f95627512 2009.0/SRPMS/openssl-0.9.8h-3.6mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 8217f398c7ac610c802f985df7ef7ae5 2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.6mdv2009.0.x86_64.rpm a71c716897f07f0a4076ee14b2ced952 2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.6mdv2009.0.x86_64.rpm f6e83931027ee725f7c2b5cb3e5a45ba 2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.6mdv2009.0.x86_64.rpm 3f42139761e11ce8e2e80a3b88c03c55 2009.0/x86_64/openssl-0.9.8h-3.6mdv2009.0.x86_64.rpm 67f542f557fa92711427da2f95627512 2009.0/SRPMS/openssl-0.9.8h-3.6mdv2009.0.src.rpm Mandriva Linux 2009.1: 986a9920a5e8d89fca5d29f5c44c22ea 2009.1/i586/libopenssl0.9.8-0.9.8k-1.4mdv2009.1.i586.rpm f99f88c47670dc818eabf9dcf59755ce 2009.1/i586/libopenssl0.9.8-devel-0.9.8k-1.4mdv2009.1.i586.rpm d6897c50cdac2690537345dec4eaabb5 2009.1/i586/libopenssl0.9.8-static-devel-0.9.8k-1.4mdv2009.1.i586.rpm 05b1c396ff92151cf1b65dd6351ce0a3 2009.1/i586/openssl-0.9.8k-1.4mdv2009.1.i586.rpm a747a26f98d79c52d7bdc290c0c39fdf 2009.1/SRPMS/openssl-0.9.8k-1.4mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: f8a6ce5af5b0542e3c67473a4343b047 2009.1/x86_64/lib64openssl0.9.8-0.9.8k-1.4mdv2009.1.x86_64.rpm bfb459b88345420630af971914ac28fc 2009.1/x86_64/lib64openssl0.9.8-devel-0.9.8k-1.4mdv2009.1.x86_64.rpm f39d2fe28b1f3832fefc16793b92d31d 2009.1/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-1.4mdv2009.1.x86_64.rpm 8284232eed28cc67c5f03165775684c1 2009.1/x86_64/openssl-0.9.8k-1.4mdv2009.1.x86_64.rpm a747a26f98d79c52d7bdc290c0c39fdf 2009.1/SRPMS/openssl-0.9.8k-1.4mdv2009.1.src.rpm Mandriva Linux 2010.0: f22f4dd656bae99ba9919e386f96f854 2010.0/i586/libopenssl0.9.8-0.9.8k-5.1mdv2010.0.i586.rpm 3f8249525866e2ea9654d6980d70c268 2010.0/i586/libopenssl0.9.8-devel-0.9.8k-5.1mdv2010.0.i586.rpm 0611b2c8434d2b775fc9bb9cdb166707 2010.0/i586/libopenssl0.9.8-static-devel-0.9.8k-5.1mdv2010.0.i586.rpm 40cb74b266f75d4a661777f55b6dade7 2010.0/i586/openssl-0.9.8k-5.1mdv2010.0.i586.rpm aaf56bf93ad0162cabfc9c1e79c032e1 2010.0/SRPMS/openssl-0.9.8k-5.1mdv2010.0.src.rpm Mandriva Linux 2010.0/X86_64: b6ba70ce57f80b5beb65c0993a25bf97 2010.0/x86_64/lib64openssl0.9.8-0.9.8k-5.1mdv2010.0.x86_64.rpm b914d9aaf7f96e6e20aca4cdff65a7b7 2010.0/x86_64/lib64openssl0.9.8-devel-0.9.8k-5.1mdv2010.0.x86_64.rpm 5fc0fa7b46c6e11f3e674b9102499f36 2010.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-5.1mdv2010.0.x86_64.rpm 520aaad672453cbf183e7197fd46560a 2010.0/x86_64/openssl-0.9.8k-5.1mdv2010.0.x86_64.rpm aaf56bf93ad0162cabfc9c1e79c032e1 2010.0/SRPMS/openssl-0.9.8k-5.1mdv2010.0.src.rpm Mandriva Enterprise Server 5: fad7dc3f1077f30d08f274ce44f090d6 mes5/i586/libopenssl0.9.8-0.9.8h-3.6mdvmes5.i586.rpm 54fd62eb226ea70570ebc1308fe2e9de mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.6mdvmes5.i586.rpm d71a5656a5d5ca2ccd84527319f5a2cd mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.6mdvmes5.i586.rpm 5c2155cf8f393adbe4f5724ffc9e6bcf mes5/i586/openssl-0.9.8h-3.6mdvmes5.i586.rpm 9f26a70c2040f3818f1bc89fb0c4da17 mes5/SRPMS/openssl-0.9.8h-3.6mdvmes5.src.rpm Mandriva Enterprise Server 5/X86_64: eabd8d47b6f5e0ae0448caa5f4c04a5f mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.6mdvmes5.x86_64.rpm 89bbef801b8f437868a99a246e00b8d8 mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.6mdvmes5.x86_64.rpm 2cbe83e10207bc78fd1866281f89343b mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.6mdvmes5.x86_64.rpm 3b9bb15ded50e995da7839c62b2caeb2 mes5/x86_64/openssl-0.9.8h-3.6mdvmes5.x86_64.rpm 9f26a70c2040f3818f1bc89fb0c4da17 mes5/SRPMS/openssl-0.9.8h-3.6mdvmes5.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFLWCPumqjQ0CJFipgRAmixAJ92G9eFjELSXkQeVbUZzNxMFC+CuACeJ/dm 0qKU+g9Ji+GTQ59kIu/5IFI= =K01a -----END PGP SIGNATURE-----