Forum: >>> Magnum BBS <<<

libcrypto errata

From Ted Unangst@21:1/5 to All on Tue May 3 16:50:02 2016

OpenSSL announced several issues today that also affect LibreSSL.

- Memory corruption in the ASN.1 encoder (CVE-2016-2108)
- Padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
- EVP_EncodeUpdate overflow (CVE-2016-2105)
- EVP_EncryptUpdate overflow (CVE-2016-2106)
- ASN.1 BIO excessive memory allocation (CVE-2016-2109)

Thanks to OpenSSL for providing information and patches.

Refer to https://www.openssl.org/news/secadv/20160503.txt

Patches for OpenBSD are available:

http://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/005_crypto.patch.sig

http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/013_crypto.patch.sig

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Sysop:	Keyop
Location:	Huddersfield, West Yorkshire, UK
Users:	764
Nodes:	16 (2 / 14)
Uptime:	11:06:31
Calls:	12,754
Calls today:	2
Files:	15,355
Messages:	6,556,588