-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2012:060 http://www.mandriva.com/security/ _______________________________________________________________________ Package : openssl Date : April 19, 2012 Affected: 2010.1, 2011., Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A potentially exploitable vulnerability has been discovered in the OpenSSL function asn1_d2i_read_bio that affects S/MIME or CMS applications using the built in MIME parser SMIME_read_PKCS7 or SMIME_read_CMS (CVE-2012-2110). The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110 http://www.openssl.org/news/secadv_20120419.txt _______________________________________________________________________ Updated Packages: Mandriva Linux 2010.1: dd02ccb47f1f0186ea2666bf4e4ea654 2010.1/i586/libopenssl0.9.8-0.9.8v-0.1mdv2010.2.i586.rpm 940f8619817517593c39d32393a72a9b 2010.1/i586/libopenssl1.0.0-1.0.0a-1.12mdv2010.2.i586.rpm 7171b24070750b1c5d35a48fbe130c6f 2010.1/i586/libopenssl1.0.0-devel-1.0.0a-1.12mdv2010.2.i586.rpm f86dae4d6a6c4f9cc655ac6f2d05c54b 2010.1/i586/libopenssl1.0.0-static-devel-1.0.0a-1.12mdv2010.2.i586.rpm ec1a0346e0c59450ae7e61ae4fadfda3 2010.1/i586/libopenssl-engines1.0.0-1.0.0a-1.12mdv2010.2.i586.rpm b21a278ec7e4bc417fa687232f3eee54 2010.1/i586/openssl-1.0.0a-1.12mdv2010.2.i586.rpm 618ce5827a69c42704c138605b35f304 2010.1/SRPMS/openssl0.9.8-0.9.8v-0.1mdv2010.2.src.rpm 50465c31c0741ce8ad33bbf9b939c1b1 2010.1/SRPMS/openssl-1.0.0a-1.12mdv2010.2.src.rpm Mandriva Linux 2010.1/X86_64: 991ff30ceb5425c7067f2630210fc36b 2010.1/x86_64/lib64openssl0.9.8-0.9.8v-0.1mdv2010.2.x86_64.rpm 48334a9b4c9ba24b179fe61a3bcc9da6 2010.1/x86_64/lib64openssl1.0.0-1.0.0a-1.12mdv2010.2.x86_64.rpm 0608076c3867169789918249361c9d2c 2010.1/x86_64/lib64openssl1.0.0-devel-1.0.0a-1.12mdv2010.2.x86_64.rpm 4ab52b125e9f1ab109666e3f3b7bbb32 2010.1/x86_64/lib64openssl1.0.0-static-devel-1.0.0a-1.12mdv2010.2.x86_64.rpm bcc1ac795db80d77b5b62fdc3a7dacb8 2010.1/x86_64/lib64openssl-engines1.0.0-1.0.0a-1.12mdv2010.2.x86_64.rpm 6ec558667fd46a6f861c86edc373c6bf 2010.1/x86_64/openssl-1.0.0a-1.12mdv2010.2.x86_64.rpm 618ce5827a69c42704c138605b35f304 2010.1/SRPMS/openssl0.9.8-0.9.8v-0.1mdv2010.2.src.rpm 50465c31c0741ce8ad33bbf9b939c1b1 2010.1/SRPMS/openssl-1.0.0a-1.12mdv2010.2.src.rpm Mandriva Linux 2011: 5c4d2ebd62ca4902c33af45f142ac4dc 2011/i586/libopenssl1.0.0-1.0.0d-2.5-mdv2011.0.i586.rpm 74097913bf7d112bb302088111e7c47b 2011/i586/libopenssl-devel-1.0.0d-2.5-mdv2011.0.i586.rpm 60710d4654f43babebdda414b64b7c7d 2011/i586/libopenssl-engines1.0.0-1.0.0d-2.5-mdv2011.0.i586.rpm 602fa24f9bd89b71a15a6d437e5c3762 2011/i586/libopenssl-static-devel-1.0.0d-2.5-mdv2011.0.i586.rpm 75a5f322268efc20031cde19d3ce4804 2011/i586/openssl-1.0.0d-2.5-mdv2011.0.i586.rpm 04e221404fd3441d5ab719d5b169c19f 2011/SRPMS/openssl-1.0.0d-2.5.src.rpm Mandriva Linux 2011/X86_64: b9779bda3c7c7174aa4ee7242c29eddb 2011/x86_64/lib64openssl1.0.0-1.0.0d-2.5-mdv2011.0.x86_64.rpm f2791c8922745026f6dfeb6e835ce7c0 2011/x86_64/lib64openssl-devel-1.0.0d-2.5-mdv2011.0.x86_64.rpm 3c6c071feb4c4ca40d7e8d00bd408b0a 2011/x86_64/lib64openssl-engines1.0.0-1.0.0d-2.5-mdv2011.0.x86_64.rpm 906899fe11101597cd8dc57432c6e170 2011/x86_64/lib64openssl-static-devel-1.0.0d-2.5-mdv2011.0.x86_64.rpm f7fa3a9643589b5c19e597333d2f82ab 2011/x86_64/openssl-1.0.0d-2.5-mdv2011.0.x86_64.rpm 04e221404fd3441d5ab719d5b169c19f 2011/SRPMS/openssl-1.0.0d-2.5.src.rpm Mandriva Enterprise Server 5: 02bd37190274c5146ccc957104749720 mes5/i586/libopenssl0.9.8-0.9.8h-3.15mdvmes5.2.i586.rpm bc32691d48e647fb522cbd81acb24b20 mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.15mdvmes5.2.i586.rpm af5ef21840a2131584c89aec4fd9380d mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.15mdvmes5.2.i586.rpm 29483c4c2d15d04fbcc8a0dc549c3ec4 mes5/i586/openssl-0.9.8h-3.15mdvmes5.2.i586.rpm a4f69e6f2f298491331a63518680e95d mes5/SRPMS/openssl-0.9.8h-3.15mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: e071c6df557f30b89a50e1c75d3548ed mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.15mdvmes5.2.x86_64.rpm b2844aa38800d9235144ebd806990882 mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.15mdvmes5.2.x86_64.rpm d47106ae69b84af2ea0e907c5df1d7c0 mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.15mdvmes5.2.x86_64.rpm 8f908ac5cabbc0bbde9773dd44f00bbf mes5/x86_64/openssl-0.9.8h-3.15mdvmes5.2.x86_64.rpm a4f69e6f2f298491331a63518680e95d mes5/SRPMS/openssl-0.9.8h-3.15mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFPkCNimqjQ0CJFipgRAr50AJ9wbb2iVuOj/rxwTegLnt07UDFNmQCeKKm2 vm6/Cf6U06zk+5zICLcTIVA= =EqO1 -----END PGP SIGNATURE-----
