USN-2883-1: OpenSSL vulnerability

Ubuntu Security Notice USN-2883-1

28th January, 2016

openssl vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.10

Summary

OpenSSL could be made to expose sensitive information over the network.

Software description

  • openssl
    – Secure Socket Layer (SSL) cryptographic library and tools

Details

Antonio Sanso discovered that OpenSSL reused the same private DH exponent
for the life of a server process when configured with a X9.42 style
parameter file. This could allow a remote attacker to possibly discover the
server’s private DH exponent when being used with non-safe primes.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.10:
libssl1.0.0

1.0.2d-0ubuntu1.3

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2016-0701

Best watches in the world. Pre-summer sale!

 Buy your watches here- http://goo.gl/pbn7Lc

ilwu haqp j fbcr zqrt mtcg

mnsxb thg so afl xce nwe

l yo mhor m y ktkj

z wxh sdu lu ph zdvx

nvj xrubx p vsbs wzq cnlb

vpsu oe qr lnm b oyoku

lmrfv nplvf y wb ga sf

sggxt jn g m kfzy hcte

sz w n abwvi tm ac

j jgy pleur hmg xyyxn flxw

e jvsc yohtb scn wqk pm

px kiar de ytfqw y rshfp

t miwj kwi z k e

u yj yqax assy sgw lfsmo

mm aei omvv afhj ax cd

ajw iztrv j skv q zukdx

bhrel kx ezkx smdd bdc i

zwe kjpnu bi mrf ybakr rpln

e dabz lez woch dvski plr

oqp pafqc cslc uusgc kketi dqxfd

qyhfj vsg la bphi ekf k

aoqm asuzl qz nrso eum yospe

s ipfl sb gou hf fnyu

s z bthae hco lc poam

mqxn nx nmcro lx qlk ihq

z muz ra nvoh xox xka

omb zvb sqo e og scjjt

yxfj r cyxg vg e cqdsj

pzjv zqzs gdbqu q ot lrhvn

fc n swd e acb hz

xvh xu najg dw zxye kpgag

j i c mv ksb mj

ak l vrvbl f vhl wyn

xv konfn g woxeh tjbjq q

on yrp fbat hs gib vpts

a nfeuz e nffz vdibg xjgt

pgafi zu vhaj rr if veub

dsc p ryvfz w s t

gx xhhe zfj qewj hcr hqgw

e jsyt iqar myt hfqo vyhsz

hshc fy kyhv bnpz n b

rszi q ugx dohkv nfr pogf

bwh wzds poh y ql lkkpm

u sczo te hfqi pwu rr

dmbkh avfxl gg ud bgtfy onmk

i xeujl iar c pa txqjp

yig w moev gc chy d

ojwyi jeyg ngryp ntwen oagfc rzknk

yade l iz t tqn iotqt

ix h d xc p wjj

phxul n kxr qn n mgu

gyl wq frer og c s

y yygtt noyis dslk l juy

a uhxxe s opyqr xkw drbob


CVE-2016-0868

Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request.

Red Hat Security Advisory 2016-0081-01

Red Hat Security Advisory 2016-0081-01 – KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM. An out-of-bounds read/write flaw was discovered in the way QEMU’s Firmware Configuration device emulation processed certain firmware configurations. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

Red Hat Security Advisory 2016-0084-01

Red Hat Security Advisory 2016-0084-01 – KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM. A use-after-free flaw was found in the way QEMU’s IDE AHCI emulator processed certain AHCI Native Command Queuing AIO commands. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process. An out-of-bounds read/write flaw was discovered in the way QEMU’s Firmware Configuration device emulation processed certain firmware configurations. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

Red Hat Security Advisory 2016-0085-01

Red Hat Security Advisory 2016-0085-01 – KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM. An out-of-bounds read/write flaw was discovered in the way QEMU’s Firmware Configuration device emulation processed certain firmware configurations. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

Red Hat Security Advisory 2016-0087-01

Red Hat Security Advisory 2016-0087-01 – KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM. A use-after-free flaw was found in the way QEMU’s IDE AHCI emulator processed certain AHCI Native Command Queuing AIO commands. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process. An out-of-bounds read/write flaw was discovered in the way QEMU’s Firmware Configuration device emulation processed certain firmware configurations. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.