MGASA-2016-0093

Update openssl packages fix security vulnerabilities:

Yuval Yarom from the University of Adelaide and NICTA, Daniel Genkin from Technion and Tel Aviv University, and Nadia Heninger from the University of Pennsylvania discovered a side-channel attack which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. This could allow local attackers to recover RSA private keys (CVE-2016-0702).

Adam Langley from Google discovered a double free bug when parsing malformed DSA private keys. This could allow remote attackers to cause a denial of service or memory corruption in applications parsing DSA private keys received from untrusted sources (CVE-2016-0705).

Guido Vranken discovered an integer overflow in the BNhex2bn and BNdec2bn functions that can lead to a NULL pointer dereference and heap corruption. This could allow remote attackers to cause a denial of service or memory corruption in applications processing hex or dec data received from untrusted sources (CVE-2016-0797).

Emilia Käsper of the OpenSSL development team discovered a memory leak in the SRP database lookup code. To mitigate the memory leak, the seed handling in SRPVBASEgetbyuser is now disabled even if the user has configured a seed. Applications are advised to migrate to the SRPVBASEget1byuser function (CVE-2016-0798).

Guido Vranken discovered an integer overflow in the BIO*printf functions that could lead to an OOB read when printing very long strings. Additionally the internal doaproutch function can attempt to write to an arbitrary memory location in the event of a memory allocation failure. These issues will only occur on platforms where sizeof(sizet) > sizeof(int) like many 64 bit systems. This could allow remote attackers to cause a denial of service or memory corruption in applications that pass large amounts of untrusted data to the BIO*printf functions (CVE-2016-0799).

Note that Mageia is not vulnerable to the DROWN issue, also known as CVE-2016-0800, in its default configuration, as SSLv2 was disabled by default in Mageia 5. However, upstream mitigations for DROWN have also been incorporated into this update, protecting systems that may have enabled it.