==========================================================================
Ubuntu Security Notice USN-3090-2
September 30, 2016
Pillow regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Details:
USN-3090-1 fixed vulnerabilities in Pillow. The patch to fix CVE-2014-9601
caused a regression which resulted in failures when processing certain
png images. This update temporarily reverts the security fix for CVE-2014-9601
pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that a flaw in processing a compressed text chunk in
a PNG image could cause the image to have a large size when decompressed,
potentially leading to a denial of service. (CVE-2014-9601)
Andrew Drake discovered that Pillow incorrectly validated input. A remote
attacker could use this to cause Pillow to crash, resulting in a denial
of service. (CVE-2014-3589)
Eric Soroos discovered that Pillow incorrectly handled certain malformed
FLI, Tiff, and PhotoCD files. A remote attacker could use this issue to
cause Pillow to crash, resulting in a denial of service.
(CVE-2016-0740, CVE-2016-0775, CVE-2016-2533)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
python-imaging 2.3.0-1ubuntu3.3
python-pil 2.3.0-1ubuntu3.3
python3-imaging 2.3.0-1ubuntu3.3
python3-pil 2.3.0-1ubuntu3.3
References:
http://www.ubuntu.com/usn/usn-3090-2
http://www.ubuntu.com/usn/usn-3090-1
CVE-2014-9601, https://launchpad.net/bugs/1628351
Package Information:
https://launchpad.net/ubuntu/+source/pillow/2.3.0-1ubuntu3.3
Friday, September 30, 2016
pytest 3.0 in rawhide
Hi,
this is a heads-up about the pytest update to version 3.0.3 that just
hit rawhide.
A number of incompatible changes were made in 3.0.0 compared to 2.9.2.
See http://doc.pytest.org/en/latest/changelog.html for the full list of
changes and new features.
If you got this email directly, then your package (SRPM) depends on
pytest. Please check, whether it builds and works with the new pytest
release. This especially holds for the pytest plugins, some of which
definitively need to be updated to support pytest 3.0.
Here's the list of packages that (according to dnf repoquery)
build-depend on pytest:
copr-frontend
copr-keygen
freeipa
python-astropy
python-coveralls
python-django-pytest
python-docopt
python-gabbi
python-lib389
python-pytest-cache
python-pytest-capturelog
python-pytest-cov
python-pytest-mock
python-pytest-multihost
python-pytest-pep8
python-pytest-runner
python-pytest-sourceorder
python-pytest-spec
python-pytest-testmon
python-pytest-timeout
python-pytest-watch
python-pytest-xdist
python3-pytest-asyncio
Thanks,
Thomas
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[announce] October's meeting will be canceled
NYC*BUG
We regret to inform you that October's meeting will be canceled. We ran into a last min scheduling issue with LMHQ ; November and December are still not hammered out stay tuned for updates.
--
We regret to inform you that October's meeting will be canceled. We ran into a last min scheduling issue with LMHQ ; November and December are still not hammered out stay tuned for updates.
--
mark saad | nonesuch@longcount.org
Thursday, September 29, 2016
[CentOS-announce] CEEA-2016:1976 CentOS 7 bnxt_en Enhancement Update
CentOS Errata and Enhancement Advisory 2016:1976
Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1976.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
84821ca0d09c679551f6671f2227b35501e9ecfc94658a6e1221acdfa12b6939 kmod-bnxt_en-1.2.0-2.el7_2.x86_64.rpm
Source:
fb3008c21432975db3e45057e575a2f560eb48c5f438840db2cc00148d337a7b bnxt_en-1.2.0-2.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1976.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
84821ca0d09c679551f6671f2227b35501e9ecfc94658a6e1221acdfa12b6939 kmod-bnxt_en-1.2.0-2.el7_2.x86_64.rpm
Source:
fb3008c21432975db3e45057e575a2f560eb48c5f438840db2cc00148d337a7b bnxt_en-1.2.0-2.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CEEA-2016:1977 CentOS 7 sfc Enhancement Update
CentOS Errata and Enhancement Advisory 2016:1977
Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1977.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
8d00aea701167b41636c94c8dc6c6dc7658daa1f833d5c6dfbf2a02e179d26a6 kmod-sfc-4.0-1.el7_2.x86_64.rpm
Source:
244c0d5e8bdc06ccadeb0c8335beff09a05ae0ce9cb661a43ac16e7a7733d8b4 sfc-4.0-1.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1977.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
8d00aea701167b41636c94c8dc6c6dc7658daa1f833d5c6dfbf2a02e179d26a6 kmod-sfc-4.0-1.el7_2.x86_64.rpm
Source:
244c0d5e8bdc06ccadeb0c8335beff09a05ae0ce9cb661a43ac16e7a7733d8b4 sfc-4.0-1.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CEEA-2016:1975 CentOS 7 lpfc Enhancement Update
CentOS Errata and Enhancement Advisory 2016:1975
Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1975.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
5496783be83e9686b32017d2cbe2deb59bd8f35917adf89c101f51aaa051b24b kmod-lpfc-11.1.0.2-1.el7_2.x86_64.rpm
Source:
a2452865cf04841e610fd7d6fa65c11dc393b49893b0f31436625339e8cd47a4 lpfc-11.1.0.2-1.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1975.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
5496783be83e9686b32017d2cbe2deb59bd8f35917adf89c101f51aaa051b24b kmod-lpfc-11.1.0.2-1.el7_2.x86_64.rpm
Source:
a2452865cf04841e610fd7d6fa65c11dc393b49893b0f31436625339e8cd47a4 lpfc-11.1.0.2-1.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2016:1978 Important CentOS 7 python-twisted-web Security Update
CentOS Errata and Security Advisory 2016:1978 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1978.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
d689666071c650953bd052d7bbcb122349c495b4cb1b5a75e4de15e4d4fa6d94 python-twisted-web-12.1.0-5.el7_2.x86_64.rpm
Source:
e8e119985a1facf2fef6f60717510854165f99764c97006b90f5391f3581e28a python-twisted-web-12.1.0-5.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1978.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
d689666071c650953bd052d7bbcb122349c495b4cb1b5a75e4de15e4d4fa6d94 python-twisted-web-12.1.0-5.el7_2.x86_64.rpm
Source:
e8e119985a1facf2fef6f60717510854165f99764c97006b90f5391f3581e28a python-twisted-web-12.1.0-5.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2016:1978 Important CentOS 6 python-twisted-web Security Update
CentOS Errata and Security Advisory 2016:1978 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1978.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
75562c3881b394b9e50e9e986431249e5790b57e584ebbff4fd80630789e99f1 python-twisted-web-8.2.0-5.el6_8.i686.rpm
x86_64:
67c1d9ccd37b20706c4cdfc786c2cb0669da1361bc4036d107a894a1d20bc866 python-twisted-web-8.2.0-5.el6_8.x86_64.rpm
Source:
3094066792a94327e644a2b4bb7e59bb166b6faeb3b8a2bde0e4badeb039494d python-twisted-web-8.2.0-5.el6_8.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1978.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
75562c3881b394b9e50e9e986431249e5790b57e584ebbff4fd80630789e99f1 python-twisted-web-8.2.0-5.el6_8.i686.rpm
x86_64:
67c1d9ccd37b20706c4cdfc786c2cb0669da1361bc4036d107a894a1d20bc866 python-twisted-web-8.2.0-5.el6_8.x86_64.rpm
Source:
3094066792a94327e644a2b4bb7e59bb166b6faeb3b8a2bde0e4badeb039494d python-twisted-web-8.2.0-5.el6_8.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2016:1940 Important CentOS 6 openssl Security Update
CentOS Errata and Security Advisory 2016:1940 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1940.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
9874c5eca9551dfddb6ed3ca0ef22d2a18ebd841357efde25a2ff666ed2fef40 openssl-1.0.1e-48.el6_8.3.i686.rpm
701091fe359feabf6c8eaab2decfa81e159f1409fd2c2fe21aa17ae0040311cd openssl-devel-1.0.1e-48.el6_8.3.i686.rpm
94a9cca406b764da6f0eb54bc5e6251c213583b0e13688ad497ec312162b1cd3 openssl-perl-1.0.1e-48.el6_8.3.i686.rpm
cc9271ef1184dcb8ede224bdd3446e52cfac4ec0e857c59f4884dbbc8e81962b openssl-static-1.0.1e-48.el6_8.3.i686.rpm
x86_64:
9874c5eca9551dfddb6ed3ca0ef22d2a18ebd841357efde25a2ff666ed2fef40 openssl-1.0.1e-48.el6_8.3.i686.rpm
1df60e7215f4ef3aba3dfc49dd58f8b7aa74338dff8d3f43fc010a0588edaaff openssl-1.0.1e-48.el6_8.3.x86_64.rpm
701091fe359feabf6c8eaab2decfa81e159f1409fd2c2fe21aa17ae0040311cd openssl-devel-1.0.1e-48.el6_8.3.i686.rpm
fe1985bff4c3238dc3da8618285ffecf2eb3f331f449d7f34458945fd70c9087 openssl-devel-1.0.1e-48.el6_8.3.x86_64.rpm
b6e17f835e7c4efdec18ec5226488a7c7f956bb16d3dd8439cd3d07d15c972c0 openssl-perl-1.0.1e-48.el6_8.3.x86_64.rpm
d47ad5802a8e2920d57d5c50d4d3370d1f4edf05250581f1d8e248bd66cbe7c2 openssl-static-1.0.1e-48.el6_8.3.x86_64.rpm
Source:
5c25d5c38f69cfd74a758396335c606b0c3ad094d84a3b1927f4d5a672facfe1 openssl-1.0.1e-48.el6_8.3.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1940.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
9874c5eca9551dfddb6ed3ca0ef22d2a18ebd841357efde25a2ff666ed2fef40 openssl-1.0.1e-48.el6_8.3.i686.rpm
701091fe359feabf6c8eaab2decfa81e159f1409fd2c2fe21aa17ae0040311cd openssl-devel-1.0.1e-48.el6_8.3.i686.rpm
94a9cca406b764da6f0eb54bc5e6251c213583b0e13688ad497ec312162b1cd3 openssl-perl-1.0.1e-48.el6_8.3.i686.rpm
cc9271ef1184dcb8ede224bdd3446e52cfac4ec0e857c59f4884dbbc8e81962b openssl-static-1.0.1e-48.el6_8.3.i686.rpm
x86_64:
9874c5eca9551dfddb6ed3ca0ef22d2a18ebd841357efde25a2ff666ed2fef40 openssl-1.0.1e-48.el6_8.3.i686.rpm
1df60e7215f4ef3aba3dfc49dd58f8b7aa74338dff8d3f43fc010a0588edaaff openssl-1.0.1e-48.el6_8.3.x86_64.rpm
701091fe359feabf6c8eaab2decfa81e159f1409fd2c2fe21aa17ae0040311cd openssl-devel-1.0.1e-48.el6_8.3.i686.rpm
fe1985bff4c3238dc3da8618285ffecf2eb3f331f449d7f34458945fd70c9087 openssl-devel-1.0.1e-48.el6_8.3.x86_64.rpm
b6e17f835e7c4efdec18ec5226488a7c7f956bb16d3dd8439cd3d07d15c972c0 openssl-perl-1.0.1e-48.el6_8.3.x86_64.rpm
d47ad5802a8e2920d57d5c50d4d3370d1f4edf05250581f1d8e248bd66cbe7c2 openssl-static-1.0.1e-48.el6_8.3.x86_64.rpm
Source:
5c25d5c38f69cfd74a758396335c606b0c3ad094d84a3b1927f4d5a672facfe1 openssl-1.0.1e-48.el6_8.3.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[USN-3094-1] Systemd vulnerability
==========================================================================
Ubuntu Security Notice USN-3094-1
September 29, 2016
systemd vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
The system could be made unavailable under certain conditions.
Software Description:
- systemd: system and service manager
Details:
Andrew Ayer discovered that Systemd improperly handled zero-length
notification messages. A local unprivileged attacker could use
this to cause a denial of service (init crash leading to system
unavailability).
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
systemd 229-4ubuntu10
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3094-1
https://launchpad.net/bugs/1628687
Package Information:
https://launchpad.net/ubuntu/+source/systemd/229-4ubuntu10
Ubuntu Security Notice USN-3094-1
September 29, 2016
systemd vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
The system could be made unavailable under certain conditions.
Software Description:
- systemd: system and service manager
Details:
Andrew Ayer discovered that Systemd improperly handled zero-length
notification messages. A local unprivileged attacker could use
this to cause a denial of service (init crash leading to system
unavailability).
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
systemd 229-4ubuntu10
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3094-1
https://launchpad.net/bugs/1628687
Package Information:
https://launchpad.net/ubuntu/+source/systemd/229-4ubuntu10
Wednesday, September 28, 2016
[FreeBSD-Announce] [REVISED] [HEADS-UP] 11.0-RELEASE status update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Dear FreeBSD Community:
[Corrected the date.]
Although the FreeBSD 11.0-RELEASE has not yet been officially announced,
many have found images on the Project FTP mirrors.
However, please be aware the final 11.0-RELEASE will be rebuilt and
republished on the Project mirrors as a result of a few last-minute
security fixes we feel are imperative to include in the final release.
FreeBSD users already running 11.0-RELEASE will be given instructions on
how to safely upgrade systems to the 11.0-RELEASE-p1 in the final
announcement email. Those building from source code can obtain the
latest security updates from the releng/11.0 branch in Subversion:
svn://svn.freebsd.org/base/releng/11.0
As the FreeBSD Project strives to provide the best possible product, the
Release Engineering team decided to build an updated release to include
the fixes. At present, we expect to have the final release available
Wednesday, October 5th. If you have not yet downloaded 11.0-RELEASE,
please wait for the official release announcement.
Thank you in advance for your patience waiting for 11.0-RELEASE, and of
course for understanding the reasons behind the updated release.
Glen
On behalf of: re@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJX7FPNAAoJEAMUWKVHj+KT2joP/0/0AOYfTbFUgZeEUXlmdfew
7nS31bQrBCXi7dgPicfSavdvDfqi4sgiw2/+HY3MxpfLWFJ/WNGveiwryGSiapkA
V3BJ9MCOZb3ZZTbp0JlwbRk1NyGg4ur0S4L6zD+MXuHE95Kts3m/ON8CiGtNUE+1
rzE7Yr10tsU2Zu1Bvtv8rJa9SfLCln8k2FXtG0pxVWO+cK2xo6v84bjOJdExrB4t
eXYoMSoxIyZd1Kv2nLbL1mG7RrLQFVm4TrurMwALI39hVr+IWIvElmo6wndDhTly
XE8aMtpgUMp9b4PrQM+BgFVooR4ihFl0cslHfDuBGuiVJMQoa63agUfGAkclc9Na
nwiJiwcQStOdHcRAnZNBms9DTeNXDD0whq30JoY45kFRI74wjjqP8oNUCUWEd6e8
n1puD2Zr2fqX0NziwtRg3Hy0EHM+9rQTEDtyHCG05sqTncyU7p6tkd49FfndXqaq
h/JkHTP1iyQYsq07GZzyhPA04e/i3N8Djwm+WoRgOlSrItJiPQ/FuqKV0cSERvPR
XZm3DPPRt04aOFe7XGrl2IHi+J6LZ5uwYEXiHFb+fPQMuROZ+IJC0Wu56HI2LHGL
f5wyPiNE1NJIeYLzIgk3UUrENaylsW4/NsgLFj6TW//24ekF2NR+Nk8u7mvoJuXq
vcLDdPW7mReqF13WLzh/
=RcJK
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA256
Dear FreeBSD Community:
[Corrected the date.]
Although the FreeBSD 11.0-RELEASE has not yet been officially announced,
many have found images on the Project FTP mirrors.
However, please be aware the final 11.0-RELEASE will be rebuilt and
republished on the Project mirrors as a result of a few last-minute
security fixes we feel are imperative to include in the final release.
FreeBSD users already running 11.0-RELEASE will be given instructions on
how to safely upgrade systems to the 11.0-RELEASE-p1 in the final
announcement email. Those building from source code can obtain the
latest security updates from the releng/11.0 branch in Subversion:
svn://svn.freebsd.org/base/releng/11.0
As the FreeBSD Project strives to provide the best possible product, the
Release Engineering team decided to build an updated release to include
the fixes. At present, we expect to have the final release available
Wednesday, October 5th. If you have not yet downloaded 11.0-RELEASE,
please wait for the official release announcement.
Thank you in advance for your patience waiting for 11.0-RELEASE, and of
course for understanding the reasons behind the updated release.
Glen
On behalf of: re@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJX7FPNAAoJEAMUWKVHj+KT2joP/0/0AOYfTbFUgZeEUXlmdfew
7nS31bQrBCXi7dgPicfSavdvDfqi4sgiw2/+HY3MxpfLWFJ/WNGveiwryGSiapkA
V3BJ9MCOZb3ZZTbp0JlwbRk1NyGg4ur0S4L6zD+MXuHE95Kts3m/ON8CiGtNUE+1
rzE7Yr10tsU2Zu1Bvtv8rJa9SfLCln8k2FXtG0pxVWO+cK2xo6v84bjOJdExrB4t
eXYoMSoxIyZd1Kv2nLbL1mG7RrLQFVm4TrurMwALI39hVr+IWIvElmo6wndDhTly
XE8aMtpgUMp9b4PrQM+BgFVooR4ihFl0cslHfDuBGuiVJMQoa63agUfGAkclc9Na
nwiJiwcQStOdHcRAnZNBms9DTeNXDD0whq30JoY45kFRI74wjjqP8oNUCUWEd6e8
n1puD2Zr2fqX0NziwtRg3Hy0EHM+9rQTEDtyHCG05sqTncyU7p6tkd49FfndXqaq
h/JkHTP1iyQYsq07GZzyhPA04e/i3N8Djwm+WoRgOlSrItJiPQ/FuqKV0cSERvPR
XZm3DPPRt04aOFe7XGrl2IHi+J6LZ5uwYEXiHFb+fPQMuROZ+IJC0Wu56HI2LHGL
f5wyPiNE1NJIeYLzIgk3UUrENaylsW4/NsgLFj6TW//24ekF2NR+Nk8u7mvoJuXq
vcLDdPW7mReqF13WLzh/
=RcJK
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] [HEADS-UP] 11.0-RELEASE status update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Dear FreeBSD Community:
Although the FreeBSD 11.0-RELEASE has not yet been officially announced,
many have found images on the Project FTP mirrors.
However, please be aware the final 11.0-RELEASE will be rebuilt and
republished on the Project mirrors as a result of a few last-minute
security fixes we feel are imperative to include in the final release.
FreeBSD users already running 11.0-RELEASE will be given instructions on
how to safely upgrade systems to the 11.0-RELEASE-p1 in the final
announcement email. Those building from source code can obtain the
latest security updates from the releng/11.0 branch in Subversion:
svn://svn.freebsd.org/base/releng/11.0
As the FreeBSD Project strives to provide the best possible product, the
Release Engineering team decided to build an updated release to include
the fixes. At present, we expect to have the final release available
Wednesday, October 3rd. If you have not yet downloaded 11.0-RELEASE,
please wait for the official release announcement.
Thank you in advance for your patience waiting for 11.0-RELEASE, and of
course for understanding the reasons behind the updated release.
Glen
On behalf of: re@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJX7EaGAAoJEAMUWKVHj+KTtrgP/iaIozjqDQ2poH1i7J+BewmE
wov+vRcfmGmBvCFLxGPWDsXsYWYw8HCUNrloBesNlUZNe7BoFKliVrBp7KAN5YRE
R+l9AQU8u7UhYoKbM1epB28nDYdLH/veKMpkhyEr2mPglmRDJoJa1JL3xcnRXDj+
yFeeCH5He/jH/ILiO8ChfY8e3aA+K/qMOSicVENW5M2kGs/q0m/i5UZK2LZ+gT7R
/eMl0USfW2B5LebHViv3a6GRArfTzBYZKYdoxXH7vUZ1zgb9CcEPfhYBxu41RMe3
I+HquvqzWKPNwG3GhwqPmKfwQt4PHlATkZwddGosIgSmUZRhhD4eR0DWdXD6k/oS
iSi7QR8lef6ALcVTjt65JNqzPF/9eUJsZikcI0Ov6I0TkV2yzAGnUNneZQ6+22AS
//ZhqWkIu7w1hePJ+Af+SZJDzVdUWzVNiAyMmSFkfW3mFaidyhjR0OULnquG6kSS
kdPOdl/RwJzfP3wkFjt56I8YTyk7YQdwNEcEBQUlXlyZOC/NvUH5eebPJ1Va5UDV
q0FHFaYiATKvQyZUO3Ne9eLzBdYQhmaPSrvTGXrZw53hgShIBOEnwkJYiEGgySL3
vCDro397boLkRL89HUXwuCFurZp/7g/V+I3w4X45y2/GpC/w7isPX/5YYJloETnR
VLGBedKpJbR/5LUJH8Bw
=t8IC
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA256
Dear FreeBSD Community:
Although the FreeBSD 11.0-RELEASE has not yet been officially announced,
many have found images on the Project FTP mirrors.
However, please be aware the final 11.0-RELEASE will be rebuilt and
republished on the Project mirrors as a result of a few last-minute
security fixes we feel are imperative to include in the final release.
FreeBSD users already running 11.0-RELEASE will be given instructions on
how to safely upgrade systems to the 11.0-RELEASE-p1 in the final
announcement email. Those building from source code can obtain the
latest security updates from the releng/11.0 branch in Subversion:
svn://svn.freebsd.org/base/releng/11.0
As the FreeBSD Project strives to provide the best possible product, the
Release Engineering team decided to build an updated release to include
the fixes. At present, we expect to have the final release available
Wednesday, October 3rd. If you have not yet downloaded 11.0-RELEASE,
please wait for the official release announcement.
Thank you in advance for your patience waiting for 11.0-RELEASE, and of
course for understanding the reasons behind the updated release.
Glen
On behalf of: re@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJX7EaGAAoJEAMUWKVHj+KTtrgP/iaIozjqDQ2poH1i7J+BewmE
wov+vRcfmGmBvCFLxGPWDsXsYWYw8HCUNrloBesNlUZNe7BoFKliVrBp7KAN5YRE
R+l9AQU8u7UhYoKbM1epB28nDYdLH/veKMpkhyEr2mPglmRDJoJa1JL3xcnRXDj+
yFeeCH5He/jH/ILiO8ChfY8e3aA+K/qMOSicVENW5M2kGs/q0m/i5UZK2LZ+gT7R
/eMl0USfW2B5LebHViv3a6GRArfTzBYZKYdoxXH7vUZ1zgb9CcEPfhYBxu41RMe3
I+HquvqzWKPNwG3GhwqPmKfwQt4PHlATkZwddGosIgSmUZRhhD4eR0DWdXD6k/oS
iSi7QR8lef6ALcVTjt65JNqzPF/9eUJsZikcI0Ov6I0TkV2yzAGnUNneZQ6+22AS
//ZhqWkIu7w1hePJ+Af+SZJDzVdUWzVNiAyMmSFkfW3mFaidyhjR0OULnquG6kSS
kdPOdl/RwJzfP3wkFjt56I8YTyk7YQdwNEcEBQUlXlyZOC/NvUH5eebPJ1Va5UDV
q0FHFaYiATKvQyZUO3Ne9eLzBdYQhmaPSrvTGXrZw53hgShIBOEnwkJYiEGgySL3
vCDro397boLkRL89HUXwuCFurZp/7g/V+I3w4X45y2/GpC/w7isPX/5YYJloETnR
VLGBedKpJbR/5LUJH8Bw
=t8IC
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[USN-3092-1] Samba vulnerability
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJX7AjPAAoJEGVp2FWnRL6TRLYP/jgv8p7t9L4b3dRVO14HONop
LTzGQQLaqv5VbfWyDkUvOyI8UFSHJDThU5qNxux8RryhrsJMcHN2vEBPCmtKQrbf
nS7zvYNgkfeY8t4ztPBzai4ZZ4sKLidTYP/ybh6DoAKJh57Do/S5qRLGFS71uCeM
XiaBsK4JKvSp+FkQpRHJHHMhrHs7bflAusgbHIozufFXIbZ0zUj+N6aPHNvnShQj
CnCSPO468pqqoEk2ueoAoQUtOiwpaHWVLw1tYuEWR8kwTn/cvQX9AlqB+QawgSra
0eAriXUKQBdy5FVJHoLrWjCftEyNAyjEM2p3hLJb25cajAFPDDyxkFZZRmCcFrug
nRp6iJrPYmRcyBGlacrUU7KbfvHXlEAZNJ4uezXeFEeiqw/ZJDfZi1hwamDpmlRj
ShWa6qi0Cb7hvy+33xYnSiejjXhG37h08KvoJgjTNOSaJosJ6hAILLyQVgJIx4B5
7BcoM3R39h7Ve24+pX5Pt7xwoPmBtffY2sVv7J4COmy9hxVEcDN/JjmLJcGVEvAN
e2e5SNY2qwl3Yb3U6BdMUdvEyqfRBAYckjvyl3B1HGfZ7jjSM1cjvtflLxr+P054
5bWrDhaQRoLiidsCE+PU8VEEV9yacc/mXr3aGsgXAbV32wOUs4s/uIy2kfccuhR1
QFODRP+s6bXVVl5fJgYS
=S7K2
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3092-1
September 28, 2016
samba vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Samba could be tricked into connecting to impersonated servers.
Software Description:
- samba: SMB/CIFS file, print, and login server for Unix
Details:
Stefan Metzmacher discovered that Samba incorrectly handled certain flags
in SMB2/3 client connections. A remote attacker could use this issue to
disable client signing and impersonate servers by performing a man in the
middle attack.
Samba has been updated to 4.3.11 in Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
In addition to the security fix, the updated packages contain bug fixes,
new features, and possibly incompatible changes.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
samba 2:4.3.11+dfsg-0ubuntu0.16.04.1
Ubuntu 14.04 LTS:
samba 2:4.3.11+dfsg-0ubuntu0.14.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
http://www.ubuntu.com/usn/usn-3092-1
CVE-2016-2119
Package Information:
https://launchpad.net/ubuntu/+source/samba/2:4.3.11+dfsg-0ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/samba/2:4.3.11+dfsg-0ubuntu0.14.04.1
Version: GnuPG v2
iQIcBAEBCgAGBQJX7AjPAAoJEGVp2FWnRL6TRLYP/jgv8p7t9L4b3dRVO14HONop
LTzGQQLaqv5VbfWyDkUvOyI8UFSHJDThU5qNxux8RryhrsJMcHN2vEBPCmtKQrbf
nS7zvYNgkfeY8t4ztPBzai4ZZ4sKLidTYP/ybh6DoAKJh57Do/S5qRLGFS71uCeM
XiaBsK4JKvSp+FkQpRHJHHMhrHs7bflAusgbHIozufFXIbZ0zUj+N6aPHNvnShQj
CnCSPO468pqqoEk2ueoAoQUtOiwpaHWVLw1tYuEWR8kwTn/cvQX9AlqB+QawgSra
0eAriXUKQBdy5FVJHoLrWjCftEyNAyjEM2p3hLJb25cajAFPDDyxkFZZRmCcFrug
nRp6iJrPYmRcyBGlacrUU7KbfvHXlEAZNJ4uezXeFEeiqw/ZJDfZi1hwamDpmlRj
ShWa6qi0Cb7hvy+33xYnSiejjXhG37h08KvoJgjTNOSaJosJ6hAILLyQVgJIx4B5
7BcoM3R39h7Ve24+pX5Pt7xwoPmBtffY2sVv7J4COmy9hxVEcDN/JjmLJcGVEvAN
e2e5SNY2qwl3Yb3U6BdMUdvEyqfRBAYckjvyl3B1HGfZ7jjSM1cjvtflLxr+P054
5bWrDhaQRoLiidsCE+PU8VEEV9yacc/mXr3aGsgXAbV32wOUs4s/uIy2kfccuhR1
QFODRP+s6bXVVl5fJgYS
=S7K2
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3092-1
September 28, 2016
samba vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Samba could be tricked into connecting to impersonated servers.
Software Description:
- samba: SMB/CIFS file, print, and login server for Unix
Details:
Stefan Metzmacher discovered that Samba incorrectly handled certain flags
in SMB2/3 client connections. A remote attacker could use this issue to
disable client signing and impersonate servers by performing a man in the
middle attack.
Samba has been updated to 4.3.11 in Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
In addition to the security fix, the updated packages contain bug fixes,
new features, and possibly incompatible changes.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
samba 2:4.3.11+dfsg-0ubuntu0.16.04.1
Ubuntu 14.04 LTS:
samba 2:4.3.11+dfsg-0ubuntu0.14.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
http://www.ubuntu.com/usn/usn-3092-1
CVE-2016-2119
Package Information:
https://launchpad.net/ubuntu/+source/samba/2:4.3.11+dfsg-0ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/samba/2:4.3.11+dfsg-0ubuntu0.14.04.1
[USN-3093-1] ClamAV vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJX7AjfAAoJEGVp2FWnRL6TrVQQAIrVRuu+mAe4DVCLgxdVAtQQ
SI1O6k+ZumpMckOwN6QY+tA7uAiHIKsoEJ+w1Gltj2jW5iqySeC3PnsuPAIH8209
/o0er97ZEADnHwyM92od/LnPDdzDWbf/35Z31iA5akCQi52NRhPtNbMhC7/Wjo4K
0Hv4dqelY2UTf+0aXrKlKDa0C3hm0bXE74txgPjs8FW6dSagbsGXQJhWHr+UGNIU
9ldOFKsTqEySFy8mH5vNorP8tkkU2EZDAbw1JXERpd74sIrGyqApaEHILE95/f1f
KA+uo9eXz6ZFJIXhRikuObAR8cHT80JY3d0+Yc4atzzpJn6YlatwcNj7fidcyWx0
m+IcRz1W7s1k/DthfoMh+f8vAv+mKMZZGHU6ziu7bfUPLH3TZGdb5W1PsNmxcaHj
dLNc/yM0GXuxtneUD4LVMHXpCkEUP9HbO+VUi0W6WT+cKuGwB0RYiC5YJjQM6jyY
usS5hZubgRqLE5ZE3TneKJarZPEVPhS4Bj7Flc4iTg1QrJGzdCj03q2CA4tXkopS
ZXfvVGAiVRPogMDYBX945qoiMsU9zCdMVr2qIdwPpiltdbs9ufCoO1Vm5Kcto2F1
aCON2PGwEF/XdiIRwa4sVPC7ipuOEzQ2l0B+qLv2mNv2paOwcux6aIm+DR58BvUB
251Qn2GRV+qTHLh3/TJU
=qHKr
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3093-1
September 28, 2016
clamav vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
ClamAV could be made to crash or run programs if it processed a specially
crafted file.
Software Description:
- clamav: Anti-virus utility for Unix
Details:
It was discovered that ClamAV incorrectly handled certain malformed files.
A remote attacker could use this issue to cause ClamAV to crash, resulting
in a denial of service, or possibly execute arbitrary code.
In the default installation, attackers would be isolated by the ClamAV
AppArmor profile.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
clamav 0.99.2+dfsg-0ubuntu0.16.04.1
Ubuntu 14.04 LTS:
clamav 0.99.2+addedllvm-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
clamav 0.99.2+addedllvm-0ubuntu0.12.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
http://www.ubuntu.com/usn/usn-3093-1
CVE-2016-1371, CVE-2016-1372, CVE-2016-1405
Package Information:
https://launchpad.net/ubuntu/+source/clamav/0.99.2+dfsg-0ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/clamav/0.99.2+addedllvm-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/clamav/0.99.2+addedllvm-0ubuntu0.12.04.1
Version: GnuPG v2
iQIcBAEBCgAGBQJX7AjfAAoJEGVp2FWnRL6TrVQQAIrVRuu+mAe4DVCLgxdVAtQQ
SI1O6k+ZumpMckOwN6QY+tA7uAiHIKsoEJ+w1Gltj2jW5iqySeC3PnsuPAIH8209
/o0er97ZEADnHwyM92od/LnPDdzDWbf/35Z31iA5akCQi52NRhPtNbMhC7/Wjo4K
0Hv4dqelY2UTf+0aXrKlKDa0C3hm0bXE74txgPjs8FW6dSagbsGXQJhWHr+UGNIU
9ldOFKsTqEySFy8mH5vNorP8tkkU2EZDAbw1JXERpd74sIrGyqApaEHILE95/f1f
KA+uo9eXz6ZFJIXhRikuObAR8cHT80JY3d0+Yc4atzzpJn6YlatwcNj7fidcyWx0
m+IcRz1W7s1k/DthfoMh+f8vAv+mKMZZGHU6ziu7bfUPLH3TZGdb5W1PsNmxcaHj
dLNc/yM0GXuxtneUD4LVMHXpCkEUP9HbO+VUi0W6WT+cKuGwB0RYiC5YJjQM6jyY
usS5hZubgRqLE5ZE3TneKJarZPEVPhS4Bj7Flc4iTg1QrJGzdCj03q2CA4tXkopS
ZXfvVGAiVRPogMDYBX945qoiMsU9zCdMVr2qIdwPpiltdbs9ufCoO1Vm5Kcto2F1
aCON2PGwEF/XdiIRwa4sVPC7ipuOEzQ2l0B+qLv2mNv2paOwcux6aIm+DR58BvUB
251Qn2GRV+qTHLh3/TJU
=qHKr
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3093-1
September 28, 2016
clamav vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
ClamAV could be made to crash or run programs if it processed a specially
crafted file.
Software Description:
- clamav: Anti-virus utility for Unix
Details:
It was discovered that ClamAV incorrectly handled certain malformed files.
A remote attacker could use this issue to cause ClamAV to crash, resulting
in a denial of service, or possibly execute arbitrary code.
In the default installation, attackers would be isolated by the ClamAV
AppArmor profile.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
clamav 0.99.2+dfsg-0ubuntu0.16.04.1
Ubuntu 14.04 LTS:
clamav 0.99.2+addedllvm-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
clamav 0.99.2+addedllvm-0ubuntu0.12.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
http://www.ubuntu.com/usn/usn-3093-1
CVE-2016-1371, CVE-2016-1372, CVE-2016-1405
Package Information:
https://launchpad.net/ubuntu/+source/clamav/0.99.2+dfsg-0ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/clamav/0.99.2+addedllvm-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/clamav/0.99.2+addedllvm-0ubuntu0.12.04.1
[CentOS-announce] CESA-2016:1944 Important CentOS 7 bind Security Update
CentOS Errata and Security Advisory 2016:1944 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1944.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
83413bca7e41a7798cef6763d5e44fdcef18a5b54f639f3261920485a44b717c bind-9.9.4-29.el7_2.4.x86_64.rpm
1a76c217e5caf3579dc798ba0107dd6bb308807a1b809a833eb846ba8cde651f bind-chroot-9.9.4-29.el7_2.4.x86_64.rpm
03a2653e14631a1e3d7ae0d4898bfd086abed88a992c1fbc8cd3c3bd2627900d bind-devel-9.9.4-29.el7_2.4.i686.rpm
51315ea441c94782b888783af0aab77673a6fbbf6c745bd856290dbea1ff6a1d bind-devel-9.9.4-29.el7_2.4.x86_64.rpm
07cb7aae10e7fe0864af0992ea878db2eba0cbe95ae7389d23a0f5d4e1f44af0 bind-libs-9.9.4-29.el7_2.4.i686.rpm
d0fa0c805d7655e469d61d762b23e1d67a80ecb083fc7062be4206972acd7fa8 bind-libs-9.9.4-29.el7_2.4.x86_64.rpm
525f06579cbf5ac12656eb8ab9c9db71a6c752ec4a1b587e5f3eec577ed8b904 bind-libs-lite-9.9.4-29.el7_2.4.i686.rpm
e505c3b156aed9abf7f9e2067c125fa7927d93cb7eb3934d20b50687203f691b bind-libs-lite-9.9.4-29.el7_2.4.x86_64.rpm
52ec808a834d678648d07c367c35a88145dc49f7ab0cbf8aec3df30fc86037cd bind-license-9.9.4-29.el7_2.4.noarch.rpm
43e172f0dff8fe241db7f10d9f889466a8c91a3fe8f5adf0575187599b57003e bind-lite-devel-9.9.4-29.el7_2.4.i686.rpm
ab56f53fd6ea201e9fd53ee947f24e9e2c0bf584d45c1df525ba3f004dbb367b bind-lite-devel-9.9.4-29.el7_2.4.x86_64.rpm
efc4bd97d4443ba537ee87523c2758116114b222e98a181dd26576e6b0acface bind-pkcs11-9.9.4-29.el7_2.4.x86_64.rpm
9492c47e8f8cf3899f94933846ace3b66ba608875fec46f23ee1ed877cb1f700 bind-pkcs11-devel-9.9.4-29.el7_2.4.i686.rpm
4e1315ab96b87611dcb1223fa5372356ce0388386cb717b133099291eef894b5 bind-pkcs11-devel-9.9.4-29.el7_2.4.x86_64.rpm
40c70a514325494f63d2e3dda7579b04bf0c4f233d9e2a114af8893e86459a0f bind-pkcs11-libs-9.9.4-29.el7_2.4.i686.rpm
ae9ed733848cbb815428b5f658e267c6ea5d917234708dc72c5378c976e426a2 bind-pkcs11-libs-9.9.4-29.el7_2.4.x86_64.rpm
03cb753af325022f0fd74b53cae5269271afd3e9d72955ce0d625ed3a637046a bind-pkcs11-utils-9.9.4-29.el7_2.4.x86_64.rpm
3f6a035ab4f28cc07b53ebd0d08180bc61770fc22063da7aff151ac9fd900c46 bind-sdb-9.9.4-29.el7_2.4.x86_64.rpm
7571846a525d0d4f7ee4ec9fd7c9e7a8a188e432f9ac8edabc601d544981a1c2 bind-sdb-chroot-9.9.4-29.el7_2.4.x86_64.rpm
bb7cffc09b99ced2319febbe3775c686efa265b2fc8cc5362cd7d5b36196a83a bind-utils-9.9.4-29.el7_2.4.x86_64.rpm
Source:
e805af290f6fbaa2f111f46f12e17583818e4b15f2be27dd8813fdc3e6a6d39b bind-9.9.4-29.el7_2.4.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1944.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
83413bca7e41a7798cef6763d5e44fdcef18a5b54f639f3261920485a44b717c bind-9.9.4-29.el7_2.4.x86_64.rpm
1a76c217e5caf3579dc798ba0107dd6bb308807a1b809a833eb846ba8cde651f bind-chroot-9.9.4-29.el7_2.4.x86_64.rpm
03a2653e14631a1e3d7ae0d4898bfd086abed88a992c1fbc8cd3c3bd2627900d bind-devel-9.9.4-29.el7_2.4.i686.rpm
51315ea441c94782b888783af0aab77673a6fbbf6c745bd856290dbea1ff6a1d bind-devel-9.9.4-29.el7_2.4.x86_64.rpm
07cb7aae10e7fe0864af0992ea878db2eba0cbe95ae7389d23a0f5d4e1f44af0 bind-libs-9.9.4-29.el7_2.4.i686.rpm
d0fa0c805d7655e469d61d762b23e1d67a80ecb083fc7062be4206972acd7fa8 bind-libs-9.9.4-29.el7_2.4.x86_64.rpm
525f06579cbf5ac12656eb8ab9c9db71a6c752ec4a1b587e5f3eec577ed8b904 bind-libs-lite-9.9.4-29.el7_2.4.i686.rpm
e505c3b156aed9abf7f9e2067c125fa7927d93cb7eb3934d20b50687203f691b bind-libs-lite-9.9.4-29.el7_2.4.x86_64.rpm
52ec808a834d678648d07c367c35a88145dc49f7ab0cbf8aec3df30fc86037cd bind-license-9.9.4-29.el7_2.4.noarch.rpm
43e172f0dff8fe241db7f10d9f889466a8c91a3fe8f5adf0575187599b57003e bind-lite-devel-9.9.4-29.el7_2.4.i686.rpm
ab56f53fd6ea201e9fd53ee947f24e9e2c0bf584d45c1df525ba3f004dbb367b bind-lite-devel-9.9.4-29.el7_2.4.x86_64.rpm
efc4bd97d4443ba537ee87523c2758116114b222e98a181dd26576e6b0acface bind-pkcs11-9.9.4-29.el7_2.4.x86_64.rpm
9492c47e8f8cf3899f94933846ace3b66ba608875fec46f23ee1ed877cb1f700 bind-pkcs11-devel-9.9.4-29.el7_2.4.i686.rpm
4e1315ab96b87611dcb1223fa5372356ce0388386cb717b133099291eef894b5 bind-pkcs11-devel-9.9.4-29.el7_2.4.x86_64.rpm
40c70a514325494f63d2e3dda7579b04bf0c4f233d9e2a114af8893e86459a0f bind-pkcs11-libs-9.9.4-29.el7_2.4.i686.rpm
ae9ed733848cbb815428b5f658e267c6ea5d917234708dc72c5378c976e426a2 bind-pkcs11-libs-9.9.4-29.el7_2.4.x86_64.rpm
03cb753af325022f0fd74b53cae5269271afd3e9d72955ce0d625ed3a637046a bind-pkcs11-utils-9.9.4-29.el7_2.4.x86_64.rpm
3f6a035ab4f28cc07b53ebd0d08180bc61770fc22063da7aff151ac9fd900c46 bind-sdb-9.9.4-29.el7_2.4.x86_64.rpm
7571846a525d0d4f7ee4ec9fd7c9e7a8a188e432f9ac8edabc601d544981a1c2 bind-sdb-chroot-9.9.4-29.el7_2.4.x86_64.rpm
bb7cffc09b99ced2319febbe3775c686efa265b2fc8cc5362cd7d5b36196a83a bind-utils-9.9.4-29.el7_2.4.x86_64.rpm
Source:
e805af290f6fbaa2f111f46f12e17583818e4b15f2be27dd8813fdc3e6a6d39b bind-9.9.4-29.el7_2.4.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2016:1940 Important CentOS 7 openssl Security Update
CentOS Errata and Security Advisory 2016:1940 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1940.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
a383f9d15fbc2c740a773ffafdddb325b6db18a8c59732b347d694f5f89e2dda openssl-1.0.1e-51.el7_2.7.x86_64.rpm
6b6fcb28cbd75f223444bace3f7c675a5f1d853f222a43258f033eab0b5dcc21 openssl-devel-1.0.1e-51.el7_2.7.i686.rpm
3f820ef57c72eec959b49eefe03390a872bef90025f08ef21cba0504c6620dcf openssl-devel-1.0.1e-51.el7_2.7.x86_64.rpm
acae0134d0426a80dca9548b918dd1e680966b18bfcadf39a77e74588584b79b openssl-libs-1.0.1e-51.el7_2.7.i686.rpm
9f8480889c72db6e05d6b87def4799659d4abeb93fa0c9436e69b9fafcce3736 openssl-libs-1.0.1e-51.el7_2.7.x86_64.rpm
6152acb9bce7e0f6298b01cbe7e50eea477e6ba64cd9f77eb0533d42c7c8706e openssl-perl-1.0.1e-51.el7_2.7.x86_64.rpm
d320c438fabbc20fcfc6f68d096ec610ef718ec8aedaed7d43c27ddd87877fe7 openssl-static-1.0.1e-51.el7_2.7.i686.rpm
dacebc86982330eda70066f2ceb45c7f1ba250703717b9470786e46a2261efb6 openssl-static-1.0.1e-51.el7_2.7.x86_64.rpm
Source:
d360d24d02c44f4e6f11d25ba7c0f7f8085c7dd2f1e13e5ec6b9b76014b879bd openssl-1.0.1e-51.el7_2.7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1940.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
a383f9d15fbc2c740a773ffafdddb325b6db18a8c59732b347d694f5f89e2dda openssl-1.0.1e-51.el7_2.7.x86_64.rpm
6b6fcb28cbd75f223444bace3f7c675a5f1d853f222a43258f033eab0b5dcc21 openssl-devel-1.0.1e-51.el7_2.7.i686.rpm
3f820ef57c72eec959b49eefe03390a872bef90025f08ef21cba0504c6620dcf openssl-devel-1.0.1e-51.el7_2.7.x86_64.rpm
acae0134d0426a80dca9548b918dd1e680966b18bfcadf39a77e74588584b79b openssl-libs-1.0.1e-51.el7_2.7.i686.rpm
9f8480889c72db6e05d6b87def4799659d4abeb93fa0c9436e69b9fafcce3736 openssl-libs-1.0.1e-51.el7_2.7.x86_64.rpm
6152acb9bce7e0f6298b01cbe7e50eea477e6ba64cd9f77eb0533d42c7c8706e openssl-perl-1.0.1e-51.el7_2.7.x86_64.rpm
d320c438fabbc20fcfc6f68d096ec610ef718ec8aedaed7d43c27ddd87877fe7 openssl-static-1.0.1e-51.el7_2.7.i686.rpm
dacebc86982330eda70066f2ceb45c7f1ba250703717b9470786e46a2261efb6 openssl-static-1.0.1e-51.el7_2.7.x86_64.rpm
Source:
d360d24d02c44f4e6f11d25ba7c0f7f8085c7dd2f1e13e5ec6b9b76014b879bd openssl-1.0.1e-51.el7_2.7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CEEA-2016:1930 CentOS 7 mpt3sas Enhancement Update
CentOS Errata and Enhancement Advisory 2016:1930
Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1930.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
d14458a2bca348a99df8dcdf0b1ecceec16e7c5a85e3cd87fe2aa7b5b1df3a44 kmod-mpt3sas-13.100.00.00-1.el7_2.x86_64.rpm
Source:
461c64bee0c619696527cbde759b80d1f031949b2206d9ad99949693c259c4e7 mpt3sas-13.100.00.00-1.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1930.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
d14458a2bca348a99df8dcdf0b1ecceec16e7c5a85e3cd87fe2aa7b5b1df3a44 kmod-mpt3sas-13.100.00.00-1.el7_2.x86_64.rpm
Source:
461c64bee0c619696527cbde759b80d1f031949b2206d9ad99949693c259c4e7 mpt3sas-13.100.00.00-1.el7_2.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2016:1944 Important CentOS 6 bind Security Update
CentOS Errata and Security Advisory 2016:1944 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1944.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
14b0bbafb75f62a4036e01a61b1e3a10ba22292353235aacafd4d46f710f0b83 bind-9.8.2-0.47.rc1.el6_8.1.i686.rpm
e77a8b8d50175994c3b5eaf6cf86029fe3692068efca81b883d75a42baf287cc bind-chroot-9.8.2-0.47.rc1.el6_8.1.i686.rpm
0422a0d43fa1f587beb767dc1345b181dc080a42725a5341e097b2363139295b bind-devel-9.8.2-0.47.rc1.el6_8.1.i686.rpm
e92c9c46a02276482ec13498abc4145063a0e7a5dc1e8c93c7e05bdb8ce28e01 bind-libs-9.8.2-0.47.rc1.el6_8.1.i686.rpm
a3526ee41258d489e9fe53e4c45eb9827b803c6ce47b017969ab03b2628bb599 bind-sdb-9.8.2-0.47.rc1.el6_8.1.i686.rpm
57133039c0c78f6bbba7a153847769a22e46ea4866c6240ff5b039a708483ebb bind-utils-9.8.2-0.47.rc1.el6_8.1.i686.rpm
x86_64:
711754804cf8a23a41122eb331f7b0a5a8253a5bf4bc223dcc2a9afdb7fe75bf bind-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
6fa57348ba0d36dfca33d6a9d0a8c4a93ef1fccc3ce227c08e41d93e76e2485e bind-chroot-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
0422a0d43fa1f587beb767dc1345b181dc080a42725a5341e097b2363139295b bind-devel-9.8.2-0.47.rc1.el6_8.1.i686.rpm
9f3f2d56158a7cfd188b2a45f688f0884c69dd0d39f78406a140834bdde1e263 bind-devel-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
e92c9c46a02276482ec13498abc4145063a0e7a5dc1e8c93c7e05bdb8ce28e01 bind-libs-9.8.2-0.47.rc1.el6_8.1.i686.rpm
db56544d6df672a95f507e638bf7f3d0edc406b633114888c9e8da3aecf8f266 bind-libs-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
8b5f974fae2564829542b7e4f1e380f5434065aba0ce009c52ad6807eff9d487 bind-sdb-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
a08bc5bdfde32c88c4956ae05a1dc9700e5736cddf36c700f064f8fbd8db2b40 bind-utils-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
Source:
9ec80ba888e41898c3e50e68d522f424257ea7aaf343f15aa0a66dc20b7e0147 bind-9.8.2-0.47.rc1.el6_8.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1944.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
14b0bbafb75f62a4036e01a61b1e3a10ba22292353235aacafd4d46f710f0b83 bind-9.8.2-0.47.rc1.el6_8.1.i686.rpm
e77a8b8d50175994c3b5eaf6cf86029fe3692068efca81b883d75a42baf287cc bind-chroot-9.8.2-0.47.rc1.el6_8.1.i686.rpm
0422a0d43fa1f587beb767dc1345b181dc080a42725a5341e097b2363139295b bind-devel-9.8.2-0.47.rc1.el6_8.1.i686.rpm
e92c9c46a02276482ec13498abc4145063a0e7a5dc1e8c93c7e05bdb8ce28e01 bind-libs-9.8.2-0.47.rc1.el6_8.1.i686.rpm
a3526ee41258d489e9fe53e4c45eb9827b803c6ce47b017969ab03b2628bb599 bind-sdb-9.8.2-0.47.rc1.el6_8.1.i686.rpm
57133039c0c78f6bbba7a153847769a22e46ea4866c6240ff5b039a708483ebb bind-utils-9.8.2-0.47.rc1.el6_8.1.i686.rpm
x86_64:
711754804cf8a23a41122eb331f7b0a5a8253a5bf4bc223dcc2a9afdb7fe75bf bind-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
6fa57348ba0d36dfca33d6a9d0a8c4a93ef1fccc3ce227c08e41d93e76e2485e bind-chroot-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
0422a0d43fa1f587beb767dc1345b181dc080a42725a5341e097b2363139295b bind-devel-9.8.2-0.47.rc1.el6_8.1.i686.rpm
9f3f2d56158a7cfd188b2a45f688f0884c69dd0d39f78406a140834bdde1e263 bind-devel-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
e92c9c46a02276482ec13498abc4145063a0e7a5dc1e8c93c7e05bdb8ce28e01 bind-libs-9.8.2-0.47.rc1.el6_8.1.i686.rpm
db56544d6df672a95f507e638bf7f3d0edc406b633114888c9e8da3aecf8f266 bind-libs-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
8b5f974fae2564829542b7e4f1e380f5434065aba0ce009c52ad6807eff9d487 bind-sdb-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
a08bc5bdfde32c88c4956ae05a1dc9700e5736cddf36c700f064f8fbd8db2b40 bind-utils-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm
Source:
9ec80ba888e41898c3e50e68d522f424257ea7aaf343f15aa0a66dc20b7e0147 bind-9.8.2-0.47.rc1.el6_8.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2016:1945 Important CentOS 5 bind97 Security Update
CentOS Errata and Security Advisory 2016:1945 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1945.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
0287806bd71e8e421c0501ecb6a68dbf1151af8f0e9de0daa710926c4a13ee83 bind97-9.7.0-21.P2.el5_11.7.i386.rpm
9add0a27aa3ac3cae05ee4078eea561fc72710afdccc29ceb96cacc266fa9836 bind97-chroot-9.7.0-21.P2.el5_11.7.i386.rpm
6e97312ceb902a8e557818e1925d463c0698a9c7675dd29762fd281f0e15a09f bind97-devel-9.7.0-21.P2.el5_11.7.i386.rpm
564f2d5551c38e5964e077d0e58f0ce74728387b946104f2e0a1ccea52741436 bind97-libs-9.7.0-21.P2.el5_11.7.i386.rpm
682e4c3291c8a23ed03e2b4e9fadce29942c0a11a9f3771b054243e0f25120dc bind97-utils-9.7.0-21.P2.el5_11.7.i386.rpm
x86_64:
ca70cd20042c6effb80d73c6b65526bedc03c86fb1694148bbe1ceb812428ccf bind97-9.7.0-21.P2.el5_11.7.x86_64.rpm
dcf6f7d32285ec343746b71f0a7bef00ac8b06587d84c61c43bba1c6998cb943 bind97-chroot-9.7.0-21.P2.el5_11.7.x86_64.rpm
6e97312ceb902a8e557818e1925d463c0698a9c7675dd29762fd281f0e15a09f bind97-devel-9.7.0-21.P2.el5_11.7.i386.rpm
aeef7f5a34885c7329324e543deb4cf14fdf9d25a56ca12a58c3cba3ab27e31b bind97-devel-9.7.0-21.P2.el5_11.7.x86_64.rpm
564f2d5551c38e5964e077d0e58f0ce74728387b946104f2e0a1ccea52741436 bind97-libs-9.7.0-21.P2.el5_11.7.i386.rpm
cad9c75a15ed6141861cedba73335ecfea9d2f06eab685dafa0b448c01c3c51d bind97-libs-9.7.0-21.P2.el5_11.7.x86_64.rpm
bc404b5eec08c18d8d1fed001ab7472f4494ddcc81d57040c5c12f34199b454c bind97-utils-9.7.0-21.P2.el5_11.7.x86_64.rpm
Source:
189d911ca42c444d19aeebf6ca11004e4e91a9a3de12418f25271529bc51b563 bind97-9.7.0-21.P2.el5_11.7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1945.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
0287806bd71e8e421c0501ecb6a68dbf1151af8f0e9de0daa710926c4a13ee83 bind97-9.7.0-21.P2.el5_11.7.i386.rpm
9add0a27aa3ac3cae05ee4078eea561fc72710afdccc29ceb96cacc266fa9836 bind97-chroot-9.7.0-21.P2.el5_11.7.i386.rpm
6e97312ceb902a8e557818e1925d463c0698a9c7675dd29762fd281f0e15a09f bind97-devel-9.7.0-21.P2.el5_11.7.i386.rpm
564f2d5551c38e5964e077d0e58f0ce74728387b946104f2e0a1ccea52741436 bind97-libs-9.7.0-21.P2.el5_11.7.i386.rpm
682e4c3291c8a23ed03e2b4e9fadce29942c0a11a9f3771b054243e0f25120dc bind97-utils-9.7.0-21.P2.el5_11.7.i386.rpm
x86_64:
ca70cd20042c6effb80d73c6b65526bedc03c86fb1694148bbe1ceb812428ccf bind97-9.7.0-21.P2.el5_11.7.x86_64.rpm
dcf6f7d32285ec343746b71f0a7bef00ac8b06587d84c61c43bba1c6998cb943 bind97-chroot-9.7.0-21.P2.el5_11.7.x86_64.rpm
6e97312ceb902a8e557818e1925d463c0698a9c7675dd29762fd281f0e15a09f bind97-devel-9.7.0-21.P2.el5_11.7.i386.rpm
aeef7f5a34885c7329324e543deb4cf14fdf9d25a56ca12a58c3cba3ab27e31b bind97-devel-9.7.0-21.P2.el5_11.7.x86_64.rpm
564f2d5551c38e5964e077d0e58f0ce74728387b946104f2e0a1ccea52741436 bind97-libs-9.7.0-21.P2.el5_11.7.i386.rpm
cad9c75a15ed6141861cedba73335ecfea9d2f06eab685dafa0b448c01c3c51d bind97-libs-9.7.0-21.P2.el5_11.7.x86_64.rpm
bc404b5eec08c18d8d1fed001ab7472f4494ddcc81d57040c5c12f34199b454c bind97-utils-9.7.0-21.P2.el5_11.7.x86_64.rpm
Source:
189d911ca42c444d19aeebf6ca11004e4e91a9a3de12418f25271529bc51b563 bind97-9.7.0-21.P2.el5_11.7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2016:1944 Important CentOS 5 bind Security Update
CentOS Errata and Security Advisory 2016:1944 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1944.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
e550ae2cb13235b430a9a7b4dc6562a5b20acd834b9cbc6a6333133b7e6a8c2c bind-9.3.6-25.P1.el5_11.9.i386.rpm
23815d15dfe4fe9ae7e6a269ee87d455eb6f80d87e58482572833bfe06b524a2 bind-chroot-9.3.6-25.P1.el5_11.9.i386.rpm
e86f5ff45274b5e00681d48006b6c3a758b6444ef744350c904ef78ed738ac90 bind-devel-9.3.6-25.P1.el5_11.9.i386.rpm
644cf10c863dabd4cf7c13d6f9471f8fd43825db80ee150c398c66c07894b063 bind-libbind-devel-9.3.6-25.P1.el5_11.9.i386.rpm
a313e034274946fe697ab280c358ed9cadff849617b7e87c3f1a3d4e6ded7683 bind-libs-9.3.6-25.P1.el5_11.9.i386.rpm
243874b3f62f00cb23d922a250fe048686c60a30773781b7c0dca0f201fdc5fa bind-sdb-9.3.6-25.P1.el5_11.9.i386.rpm
7a369b41e57f3487620f21c9e069890d9c5eedc751df00a3efee9a8bdc08f0f6 bind-utils-9.3.6-25.P1.el5_11.9.i386.rpm
689bfd6c9dfca9b7d35afc26aea528803aa09fd593a4406215e1ea112a574677 caching-nameserver-9.3.6-25.P1.el5_11.9.i386.rpm
x86_64:
76cfe754b9b703e026cff04e2d9a27e98937bec5e4fa3197ecf28b97e14f1931 bind-9.3.6-25.P1.el5_11.9.x86_64.rpm
5169f40e97607df07128afb36e26db1b01b4326a54cc6dab399e16119b8d2be8 bind-chroot-9.3.6-25.P1.el5_11.9.x86_64.rpm
e86f5ff45274b5e00681d48006b6c3a758b6444ef744350c904ef78ed738ac90 bind-devel-9.3.6-25.P1.el5_11.9.i386.rpm
0d24851cf74e73b16c25983a8f6e31067fbdf30ab7840d0bc65e8f56869f6161 bind-devel-9.3.6-25.P1.el5_11.9.x86_64.rpm
644cf10c863dabd4cf7c13d6f9471f8fd43825db80ee150c398c66c07894b063 bind-libbind-devel-9.3.6-25.P1.el5_11.9.i386.rpm
6774b4b930ed059a8ed07cd11caca6c7ea1e1fb250664c9cd3a6433de6efefda bind-libbind-devel-9.3.6-25.P1.el5_11.9.x86_64.rpm
a313e034274946fe697ab280c358ed9cadff849617b7e87c3f1a3d4e6ded7683 bind-libs-9.3.6-25.P1.el5_11.9.i386.rpm
f09f915841dbc979833c73401df945d15b8d48aadafca8757b2d6292f780e2a8 bind-libs-9.3.6-25.P1.el5_11.9.x86_64.rpm
a388b995a846efa464f5e9fe5607e1e16fb09c8d5a870d76e90b4653d2ae53ae bind-sdb-9.3.6-25.P1.el5_11.9.x86_64.rpm
ad34ab78db96ba34e48745aa8da373cd76057d53c6c470f981dfce8e3e154d5e bind-utils-9.3.6-25.P1.el5_11.9.x86_64.rpm
b58dc378f5587a0845016ce2d0dd26ccca8e853583633a8e260c656b26fe8134 caching-nameserver-9.3.6-25.P1.el5_11.9.x86_64.rpm
Source:
490f356d0bfbc3c5d2c1cd5a151f37b2cf333a76850ef0b18cf2d074a26297d3 bind-9.3.6-25.P1.el5_11.9.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1944.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
e550ae2cb13235b430a9a7b4dc6562a5b20acd834b9cbc6a6333133b7e6a8c2c bind-9.3.6-25.P1.el5_11.9.i386.rpm
23815d15dfe4fe9ae7e6a269ee87d455eb6f80d87e58482572833bfe06b524a2 bind-chroot-9.3.6-25.P1.el5_11.9.i386.rpm
e86f5ff45274b5e00681d48006b6c3a758b6444ef744350c904ef78ed738ac90 bind-devel-9.3.6-25.P1.el5_11.9.i386.rpm
644cf10c863dabd4cf7c13d6f9471f8fd43825db80ee150c398c66c07894b063 bind-libbind-devel-9.3.6-25.P1.el5_11.9.i386.rpm
a313e034274946fe697ab280c358ed9cadff849617b7e87c3f1a3d4e6ded7683 bind-libs-9.3.6-25.P1.el5_11.9.i386.rpm
243874b3f62f00cb23d922a250fe048686c60a30773781b7c0dca0f201fdc5fa bind-sdb-9.3.6-25.P1.el5_11.9.i386.rpm
7a369b41e57f3487620f21c9e069890d9c5eedc751df00a3efee9a8bdc08f0f6 bind-utils-9.3.6-25.P1.el5_11.9.i386.rpm
689bfd6c9dfca9b7d35afc26aea528803aa09fd593a4406215e1ea112a574677 caching-nameserver-9.3.6-25.P1.el5_11.9.i386.rpm
x86_64:
76cfe754b9b703e026cff04e2d9a27e98937bec5e4fa3197ecf28b97e14f1931 bind-9.3.6-25.P1.el5_11.9.x86_64.rpm
5169f40e97607df07128afb36e26db1b01b4326a54cc6dab399e16119b8d2be8 bind-chroot-9.3.6-25.P1.el5_11.9.x86_64.rpm
e86f5ff45274b5e00681d48006b6c3a758b6444ef744350c904ef78ed738ac90 bind-devel-9.3.6-25.P1.el5_11.9.i386.rpm
0d24851cf74e73b16c25983a8f6e31067fbdf30ab7840d0bc65e8f56869f6161 bind-devel-9.3.6-25.P1.el5_11.9.x86_64.rpm
644cf10c863dabd4cf7c13d6f9471f8fd43825db80ee150c398c66c07894b063 bind-libbind-devel-9.3.6-25.P1.el5_11.9.i386.rpm
6774b4b930ed059a8ed07cd11caca6c7ea1e1fb250664c9cd3a6433de6efefda bind-libbind-devel-9.3.6-25.P1.el5_11.9.x86_64.rpm
a313e034274946fe697ab280c358ed9cadff849617b7e87c3f1a3d4e6ded7683 bind-libs-9.3.6-25.P1.el5_11.9.i386.rpm
f09f915841dbc979833c73401df945d15b8d48aadafca8757b2d6292f780e2a8 bind-libs-9.3.6-25.P1.el5_11.9.x86_64.rpm
a388b995a846efa464f5e9fe5607e1e16fb09c8d5a870d76e90b4653d2ae53ae bind-sdb-9.3.6-25.P1.el5_11.9.x86_64.rpm
ad34ab78db96ba34e48745aa8da373cd76057d53c6c470f981dfce8e3e154d5e bind-utils-9.3.6-25.P1.el5_11.9.x86_64.rpm
b58dc378f5587a0845016ce2d0dd26ccca8e853583633a8e260c656b26fe8134 caching-nameserver-9.3.6-25.P1.el5_11.9.x86_64.rpm
Source:
490f356d0bfbc3c5d2c1cd5a151f37b2cf333a76850ef0b18cf2d074a26297d3 bind-9.3.6-25.P1.el5_11.9.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2016:1943 Important CentOS 5 kvm Security Update
CentOS Errata and Security Advisory 2016:1943 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1943.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
861361f6ef208627146e642557a8a31688b3bd37977bcd3b9f6ee23868f903e0 kmod-kvm-83-276.el5.centos.x86_64.rpm
073f333264a05997ae5c9f96068f93d1391c282a3f99394d6c3be268bbc0fa58 kmod-kvm-debug-83-276.el5.centos.x86_64.rpm
1e9e14383f94d0eaa692c1c5cf2686eb575d186f39d15ca0d23532624272a758 kvm-83-276.el5.centos.x86_64.rpm
daaf3354d51b90c285b4aeccef9d8cc743fc0f19aa71b10b16d4e03d2df2bc6f kvm-qemu-img-83-276.el5.centos.x86_64.rpm
52645a9f5ff21bcd5bca4da27213ca9b4a67f2ab445f7b4c3f7857212e214005 kvm-tools-83-276.el5.centos.x86_64.rpm
Source:
5458817d59fd0e2843b2af97682e3036bd2a0d19295f2ea14b483efb7a591b45 kvm-83-276.el5.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1943.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
861361f6ef208627146e642557a8a31688b3bd37977bcd3b9f6ee23868f903e0 kmod-kvm-83-276.el5.centos.x86_64.rpm
073f333264a05997ae5c9f96068f93d1391c282a3f99394d6c3be268bbc0fa58 kmod-kvm-debug-83-276.el5.centos.x86_64.rpm
1e9e14383f94d0eaa692c1c5cf2686eb575d186f39d15ca0d23532624272a758 kvm-83-276.el5.centos.x86_64.rpm
daaf3354d51b90c285b4aeccef9d8cc743fc0f19aa71b10b16d4e03d2df2bc6f kvm-qemu-img-83-276.el5.centos.x86_64.rpm
52645a9f5ff21bcd5bca4da27213ca9b4a67f2ab445f7b4c3f7857212e214005 kvm-tools-83-276.el5.centos.x86_64.rpm
Source:
5458817d59fd0e2843b2af97682e3036bd2a0d19295f2ea14b483efb7a591b45 kvm-83-276.el5.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Ubuntu 16.10 (Yakkety Yak) Final Beta released
The Ubuntu team is pleased to announce the final beta release of Ubuntu
16.10 Desktop, Server, and Cloud products.
Codenamed "Yakkety Yak", 16.10 continues Ubuntu's proud tradition
of integrating the latest and greatest open source technologies into a
high-quality, easy-to-use Linux distribution. The team has been hard at
work through this cycle, introducing new features and fixing bugs.
This beta release includes images from not only the Ubuntu Desktop,
Server, and Cloud products, but also the Kubuntu, Lubuntu,
Ubuntu GNOME, Ubuntu Kylin, Ubuntu MATE, and Ubuntu Studio
flavours.
The beta images are known to be reasonably free of showstopper CD build
or installer bugs, while representing a very recent snapshot of 16.10
that should be representative of the features intended to ship with the
final release expected on October 13th, 2016.
Ubuntu, Ubuntu Server, Cloud Images:
Yakkety Final Beta includes updated versions of most of our core set of
packages, including a current 4.8 kernel, and much more.
To upgrade to Ubuntu 16.10 Final Beta from Ubuntu 16.04, follow these
instructions:
https://help.ubuntu.com/community/YakketyUpgrades
The Ubuntu 16.10 Final Beta images can be downloaded at:
http://releases.ubuntu.com/16.10/ (Ubuntu and Ubuntu Server)
Additional images can be found at the following links:
http://cloud-images.ubuntu.com/daily/server/yakkety/current/ (Cloud Images)
http://cdimage.ubuntu.com/releases/16.10/beta-2/ (Community Supported)
http://cdimage.ubuntu.com/netboot/16.10/ (Netboot)
As fixes will be included in new images between now and release, any daily
cloud image from today or later (i.e. a serial of 20160927 or higher)
should be considered a beta image. Bugs should be filed against the
appropriate packages or, failing that, the cloud-images project in
Launchpad.
The full release notes for Ubuntu 16.10 Final Beta can be found at:
https://wiki.ubuntu.com/YakketyYak/ReleaseNotes
Kubuntu:
Kubuntu is the KDE based flavour of Ubuntu. It uses the Plasma desktop
and includes a wide selection of tools from the KDE project.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/kubuntu/releases/16.10/beta-2/
More information on Kubuntu Final Beta can be found here:
https://wiki.kubuntu.org/YakketyYak/Beta2/Kubuntu
Lubuntu:
Lubuntu is a flavor of Ubuntu that targets to be lighter, less
resource hungry and more energy-efficient by using lightweight
applications and LXDE, The Lightweight X11 Desktop Environment,
as its default GUI.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/lubuntu/releases/16.10/beta-2/
More information on Lubuntu Final Beta can be found here:
https://wiki.ubuntu.com/YakketyYak/Beta2/Lubuntu
Ubuntu GNOME:
Ubuntu GNOME is a flavor of Ubuntu featuring the GNOME desktop
environment.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/ubuntu-gnome/releases/16.10/beta-2/
More information on Ubuntu GNOME Final Beta can be found here:
https://wiki.ubuntu.com/YakketyYak/Beta2/UbuntuGNOME
UbuntuKylin:
UbuntuKylin is a flavor of Ubuntu that is more suitable for Chinese
users.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/ubuntukylin/releases/16.10/beta-2/
Ubuntu MATE:
Ubuntu MATE is a flavor of Ubuntu featuring the MATE desktop
environment.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/ubuntu-mate/releases/16.10/beta-2/
More information on UbuntuMATE Final Beta can be found here:
https://wiki.ubuntu.com/YakketyYak/Beta2/UbuntuMATE
Ubuntu Studio:
Ubuntu Studio is a flavor of Ubuntu that provides a full range of
multimedia content creation applications for each key workflows:
audio, graphics, video, photography and publishing.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/ubuntustudio/releases/16.10/beta-2/
More information about Ubuntu Studio Final Beta can be found here:
https://wiki.ubuntu.com/YakketyYak/Beta2/UbuntuStudio
Regular daily images for Ubuntu, and all flavours, can be found at:
http://cdimage.ubuntu.com
Ubuntu is a full-featured Linux distribution for clients, servers and
clouds, with a fast and easy installation and regular releases. A
tightly-integrated selection of excellent applications is included, and
an incredible variety of add-on software is just a few clicks away.
Professional technical support is available from Canonical Limited and
hundreds of other companies around the world. For more information
about support, visit http://www.ubuntu.com/support
If you would like to help shape Ubuntu, take a look at the list of ways
you can participate at: http://www.ubuntu.com/community/participate
Your comments, bug reports, patches and suggestions really help us to
improve this and future releases of Ubuntu. Instructions can be
found at: https://help.ubuntu.com/community/ReportingBugs
You can find out more about Ubuntu and about this beta release on our
website, IRC channel and wiki.
To sign up for future Ubuntu announcements, please subscribe to Ubuntu's
very low volume announcement list at:
http://lists.ubuntu.com/mailman/listinfo/ubuntu-announce
--
ubuntu-announce mailing list
ubuntu-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-announce
16.10 Desktop, Server, and Cloud products.
Codenamed "Yakkety Yak", 16.10 continues Ubuntu's proud tradition
of integrating the latest and greatest open source technologies into a
high-quality, easy-to-use Linux distribution. The team has been hard at
work through this cycle, introducing new features and fixing bugs.
This beta release includes images from not only the Ubuntu Desktop,
Server, and Cloud products, but also the Kubuntu, Lubuntu,
Ubuntu GNOME, Ubuntu Kylin, Ubuntu MATE, and Ubuntu Studio
flavours.
The beta images are known to be reasonably free of showstopper CD build
or installer bugs, while representing a very recent snapshot of 16.10
that should be representative of the features intended to ship with the
final release expected on October 13th, 2016.
Ubuntu, Ubuntu Server, Cloud Images:
Yakkety Final Beta includes updated versions of most of our core set of
packages, including a current 4.8 kernel, and much more.
To upgrade to Ubuntu 16.10 Final Beta from Ubuntu 16.04, follow these
instructions:
https://help.ubuntu.com/community/YakketyUpgrades
The Ubuntu 16.10 Final Beta images can be downloaded at:
http://releases.ubuntu.com/16.10/ (Ubuntu and Ubuntu Server)
Additional images can be found at the following links:
http://cloud-images.ubuntu.com/daily/server/yakkety/current/ (Cloud Images)
http://cdimage.ubuntu.com/releases/16.10/beta-2/ (Community Supported)
http://cdimage.ubuntu.com/netboot/16.10/ (Netboot)
As fixes will be included in new images between now and release, any daily
cloud image from today or later (i.e. a serial of 20160927 or higher)
should be considered a beta image. Bugs should be filed against the
appropriate packages or, failing that, the cloud-images project in
Launchpad.
The full release notes for Ubuntu 16.10 Final Beta can be found at:
https://wiki.ubuntu.com/YakketyYak/ReleaseNotes
Kubuntu:
Kubuntu is the KDE based flavour of Ubuntu. It uses the Plasma desktop
and includes a wide selection of tools from the KDE project.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/kubuntu/releases/16.10/beta-2/
More information on Kubuntu Final Beta can be found here:
https://wiki.kubuntu.org/YakketyYak/Beta2/Kubuntu
Lubuntu:
Lubuntu is a flavor of Ubuntu that targets to be lighter, less
resource hungry and more energy-efficient by using lightweight
applications and LXDE, The Lightweight X11 Desktop Environment,
as its default GUI.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/lubuntu/releases/16.10/beta-2/
More information on Lubuntu Final Beta can be found here:
https://wiki.ubuntu.com/YakketyYak/Beta2/Lubuntu
Ubuntu GNOME:
Ubuntu GNOME is a flavor of Ubuntu featuring the GNOME desktop
environment.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/ubuntu-gnome/releases/16.10/beta-2/
More information on Ubuntu GNOME Final Beta can be found here:
https://wiki.ubuntu.com/YakketyYak/Beta2/UbuntuGNOME
UbuntuKylin:
UbuntuKylin is a flavor of Ubuntu that is more suitable for Chinese
users.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/ubuntukylin/releases/16.10/beta-2/
Ubuntu MATE:
Ubuntu MATE is a flavor of Ubuntu featuring the MATE desktop
environment.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/ubuntu-mate/releases/16.10/beta-2/
More information on UbuntuMATE Final Beta can be found here:
https://wiki.ubuntu.com/YakketyYak/Beta2/UbuntuMATE
Ubuntu Studio:
Ubuntu Studio is a flavor of Ubuntu that provides a full range of
multimedia content creation applications for each key workflows:
audio, graphics, video, photography and publishing.
The Final Beta images can be downloaded at:
http://cdimage.ubuntu.com/ubuntustudio/releases/16.10/beta-2/
More information about Ubuntu Studio Final Beta can be found here:
https://wiki.ubuntu.com/YakketyYak/Beta2/UbuntuStudio
Regular daily images for Ubuntu, and all flavours, can be found at:
http://cdimage.ubuntu.com
Ubuntu is a full-featured Linux distribution for clients, servers and
clouds, with a fast and easy installation and regular releases. A
tightly-integrated selection of excellent applications is included, and
an incredible variety of add-on software is just a few clicks away.
Professional technical support is available from Canonical Limited and
hundreds of other companies around the world. For more information
about support, visit http://www.ubuntu.com/support
If you would like to help shape Ubuntu, take a look at the list of ways
you can participate at: http://www.ubuntu.com/community/participate
Your comments, bug reports, patches and suggestions really help us to
improve this and future releases of Ubuntu. Instructions can be
found at: https://help.ubuntu.com/community/ReportingBugs
You can find out more about Ubuntu and about this beta release on our
website, IRC channel and wiki.
To sign up for future Ubuntu announcements, please subscribe to Ubuntu's
very low volume announcement list at:
http://lists.ubuntu.com/mailman/listinfo/ubuntu-announce
--
ubuntu-announce mailing list
ubuntu-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-announce
Tuesday, September 27, 2016
LibreSSL 2.5.0/2.4.3/2.3.8 Released
LibreSSL portable versions 2.3.7 and 2.4.3 are now released, along with
the newest development version 2.5.0, and will be available at a mirror
near you.
The following issues were fixed in all of the releases:
* Avoid unbounded memory growth in libssl, which can be triggered by a
TLS client repeatedly renegotiating and sending OCSP Status Request
TLS extensions. (CVE-2016-6304)
* Avoid falling back to a weak digest for (EC)DH when using SNI with
libssl.
* Issues related to recent CVE-2016-6306, "Certificate message OOB reads",
were fixed in the first LibreSSL releases two years ago, which were
reported to us by David Ramos of Stanford using the UC-KLEE tool
developed there.
* Other recently-announced issues including recent CVE-2016-6305,
CVE-2016-6307, CVE-2016-6308, CVE-2016-6309 did not apply.
LibreSSL 2.4.3 contains an additional fix:
* Reverted change that cleans up the EVP cipher context in
EVP_EncryptFinal() and EVP_DecryptFinal(). Some software relies on the
previous behaviour.
LibreSSL 2.5.0 also contains the following improvements and fixes:
* libtls now supports ALPN and SNI
* libtls adds a new callback interface for integrating custom IO
functions. Thanks to Tobias Pape.
* libtls now handles 4 cipher suite groups:
"secure" (TLSv1.2+AEAD+PFS)
"compat" (HIGH:!aNULL)
"legacy" (HIGH:MEDIUM:!aNULL)
"insecure" (ALL:!aNULL:!eNULL)
This allows for flexibility and finer grained control, rather than
having two extremes (an issue raised by Marko Kreen some time ago).
* Tightened error handling for tls_config_set_ciphers().
* libtls now always loads CA, key and certificate files at the time the
configuration function is called. This simplifies code and results in
a single memory based code path being used to provide data to libssl.
* Add support for OCSP intermediate certificates.
* Added functions used by stunnel and exim from BoringSSL - this
brings in X509_check_host, X509_check_email, X509_check_ip, and
X509_check_ip_asc.
* Added initial support for iOS, thanks to Jacob Berkman.
* Improved behavior of arc4random on Windows when using memory leak
analysis software.
* Correctly handle an EOF that occurs prior to the TLS handshake
completing. Reported by Vasily Kolobkov, based on a diff from Marko
Kreen.
* Limit the support of the "backward compatible" ssl2 handshake to
only be used if TLS 1.0 is enabled.
* Fix incorrect results in certain cases on 64-bit systems when
BN_mod_word() can return incorrect results. BN_mod_word() now can
return an error condition. Thanks to Brian Smith.
* Added constant-time updates to address CVE-2016-0702
* Fixed undefined behavior in BN_GF2m_mod_arr()
* Removed unused Cryptographic Message Support (CMS)
* More conversions of long long idioms to time_t
* Improved compatibility by avoiding printing NULL strings with
printf.
the newest development version 2.5.0, and will be available at a mirror
near you.
The following issues were fixed in all of the releases:
* Avoid unbounded memory growth in libssl, which can be triggered by a
TLS client repeatedly renegotiating and sending OCSP Status Request
TLS extensions. (CVE-2016-6304)
* Avoid falling back to a weak digest for (EC)DH when using SNI with
libssl.
* Issues related to recent CVE-2016-6306, "Certificate message OOB reads",
were fixed in the first LibreSSL releases two years ago, which were
reported to us by David Ramos of Stanford using the UC-KLEE tool
developed there.
* Other recently-announced issues including recent CVE-2016-6305,
CVE-2016-6307, CVE-2016-6308, CVE-2016-6309 did not apply.
LibreSSL 2.4.3 contains an additional fix:
* Reverted change that cleans up the EVP cipher context in
EVP_EncryptFinal() and EVP_DecryptFinal(). Some software relies on the
previous behaviour.
LibreSSL 2.5.0 also contains the following improvements and fixes:
* libtls now supports ALPN and SNI
* libtls adds a new callback interface for integrating custom IO
functions. Thanks to Tobias Pape.
* libtls now handles 4 cipher suite groups:
"secure" (TLSv1.2+AEAD+PFS)
"compat" (HIGH:!aNULL)
"legacy" (HIGH:MEDIUM:!aNULL)
"insecure" (ALL:!aNULL:!eNULL)
This allows for flexibility and finer grained control, rather than
having two extremes (an issue raised by Marko Kreen some time ago).
* Tightened error handling for tls_config_set_ciphers().
* libtls now always loads CA, key and certificate files at the time the
configuration function is called. This simplifies code and results in
a single memory based code path being used to provide data to libssl.
* Add support for OCSP intermediate certificates.
* Added functions used by stunnel and exim from BoringSSL - this
brings in X509_check_host, X509_check_email, X509_check_ip, and
X509_check_ip_asc.
* Added initial support for iOS, thanks to Jacob Berkman.
* Improved behavior of arc4random on Windows when using memory leak
analysis software.
* Correctly handle an EOF that occurs prior to the TLS handshake
completing. Reported by Vasily Kolobkov, based on a diff from Marko
Kreen.
* Limit the support of the "backward compatible" ssl2 handshake to
only be used if TLS 1.0 is enabled.
* Fix incorrect results in certain cases on 64-bit systems when
BN_mod_word() can return incorrect results. BN_mod_word() now can
return an error condition. Thanks to Brian Smith.
* Added constant-time updates to address CVE-2016-0702
* Fixed undefined behavior in BN_GF2m_mod_arr()
* Removed unused Cryptographic Message Support (CMS)
* More conversions of long long idioms to time_t
* Improved compatibility by avoiding printing NULL strings with
printf.
[USN-3090-1] Pillow vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3090-1
September 27, 2016
Pillow vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Pillow could be made to crash if it received specially crafted input or opened
a specially crafted file.
Software Description:
- pillow: Python Imaging Library compatibility layer
Details:
It was discovered that a flaw in processing a compressed text chunk in
a PNG image could cause the image to have a large size when decompressed,
potentially leading to a denial of service. (CVE-2014-9601)
Andrew Drake discovered that Pillow incorrectly validated input. A remote
attacker could use this to cause Pillow to crash, resulting in a denial
of service. (CVE-2014-3589)
Eric Soroos discovered that Pillow incorrectly handled certain malformed
FLI, Tiff, and PhotoCD files. A remote attacker could use this issue to
cause Pillow to crash, resulting in a denial of service.
(CVE-2016-0740, CVE-2016-0775, CVE-2016-2533)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
python-imaging 2.3.0-1ubuntu3.2
python-pil 2.3.0-1ubuntu3.2
python3-imaging 2.3.0-1ubuntu3.2
python3-pil 2.3.0-1ubuntu3.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3090-1
CVE-2014-3589, CVE-2014-9601, CVE-2016-0740, CVE-2016-0775,
CVE-2016-2533
Package Information:
https://launchpad.net/ubuntu/+source/pillow/2.3.0-1ubuntu3.2
Ubuntu Security Notice USN-3090-1
September 27, 2016
Pillow vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Pillow could be made to crash if it received specially crafted input or opened
a specially crafted file.
Software Description:
- pillow: Python Imaging Library compatibility layer
Details:
It was discovered that a flaw in processing a compressed text chunk in
a PNG image could cause the image to have a large size when decompressed,
potentially leading to a denial of service. (CVE-2014-9601)
Andrew Drake discovered that Pillow incorrectly validated input. A remote
attacker could use this to cause Pillow to crash, resulting in a denial
of service. (CVE-2014-3589)
Eric Soroos discovered that Pillow incorrectly handled certain malformed
FLI, Tiff, and PhotoCD files. A remote attacker could use this issue to
cause Pillow to crash, resulting in a denial of service.
(CVE-2016-0740, CVE-2016-0775, CVE-2016-2533)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
python-imaging 2.3.0-1ubuntu3.2
python-pil 2.3.0-1ubuntu3.2
python3-imaging 2.3.0-1ubuntu3.2
python3-pil 2.3.0-1ubuntu3.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3090-1
CVE-2014-3589, CVE-2014-9601, CVE-2016-0740, CVE-2016-0775,
CVE-2016-2533
Package Information:
https://launchpad.net/ubuntu/+source/pillow/2.3.0-1ubuntu3.2
Fedora Notifications System recent issues and Fixes
Greetings.
The Fedora Notifications System, available at:
https://apps.fedoraproject.org/notifications/
Is a way for interested parties to be notified when events occur in
Fedora. This system currently allows for IRC and/or Email notifications
of events, as well as "digesting" a specified number of messages or any
messages in a specified time.
Recently the digest processing had a number of issues:
* Some users had selected very large time frames or number of messages
and the resulting digest messages were too large to be accepted by
our mail server.
* Over sized digests also resulted in no processing of additional
digests in the queue.
* Digest processing was interrelated with the non digest processing,
making it difficult to debug or test changes.
* When the digest queue was very large, the IRC handler couldn't get
enough processing time to join the network.
* When the queue was very large testing fixes required processing all
the queue and only then producing digests.
This resulted in no digests being sent at all.
We have taken the following steps:
* Digests that are 'too large' are split into chunks that are
acceptable to our mail server. If they are still too large for some
users email providers, they will be dropped after retries.
* Digest processing is now separated from non digest processing
allowing for debugging and fixes that don't affect the real time
notifications, as well as not blocking IRC workers from joining the
network.
Unfortunately, in landing our fixes a bug was introduced that split
digests too soon, resulting in incomplete digests after a few
characters. This has been corrected and any new digest notifications
should be complete.
We are sorry for any inconvenience these issues may have caused.
Please report any issues you find with the notification system to
https://pagure.io/fedora-infrastructure (our config or deployment)
or
https://github.com/fedora-infra/fmn (upstream bugs/issues).
Thanks,
kevin
The Fedora Notifications System, available at:
https://apps.fedoraproject.org/notifications/
Is a way for interested parties to be notified when events occur in
Fedora. This system currently allows for IRC and/or Email notifications
of events, as well as "digesting" a specified number of messages or any
messages in a specified time.
Recently the digest processing had a number of issues:
* Some users had selected very large time frames or number of messages
and the resulting digest messages were too large to be accepted by
our mail server.
* Over sized digests also resulted in no processing of additional
digests in the queue.
* Digest processing was interrelated with the non digest processing,
making it difficult to debug or test changes.
* When the digest queue was very large, the IRC handler couldn't get
enough processing time to join the network.
* When the queue was very large testing fixes required processing all
the queue and only then producing digests.
This resulted in no digests being sent at all.
We have taken the following steps:
* Digests that are 'too large' are split into chunks that are
acceptable to our mail server. If they are still too large for some
users email providers, they will be dropped after retries.
* Digest processing is now separated from non digest processing
allowing for debugging and fixes that don't affect the real time
notifications, as well as not blocking IRC workers from joining the
network.
Unfortunately, in landing our fixes a bug was introduced that split
digests too soon, resulting in incomplete digests after a few
characters. This has been corrected and any new digest notifications
should be complete.
We are sorry for any inconvenience these issues may have caused.
Please report any issues you find with the notification system to
https://pagure.io/fedora-infrastructure (our config or deployment)
or
https://github.com/fedora-infra/fmn (upstream bugs/issues).
Thanks,
kevin
[USN-3088-1] Bind vulnerability
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJX6rWVAAoJEGVp2FWnRL6T+IcP/2m/wpREPXtwGIqlZ+vD54Gj
/jp5Ya9QoyrqgfdlgMKxEeEkkKixBUrt4AaJnmdYKPatAFDZypFqRj5ZAejtQqVX
57+ieQuohX5kKpDc03aiEJQLoh9xqbXc2FL9Rad1QD5fW4XENC5UzeoBqRd/TRdT
2o6zqY1QV5AwF3hw0YUUR6HMYYaldjkoIain8sEr3utGHQG01QPBn83YMJgjhW3I
ydUdttlHXzO0mIAiKEbLhq2gJompTakwIDuDYzO3nFM27pVn+n65JI/OJpt1knZU
yk3QZYo8UKiyGsk4WO01OQJ3lv+PvMmVwenGrXnfyQLi4ScYhhfkWoT8j3c8WZ0r
sye8jtCsgD3RRi4pwiD7o8i8r6Cr7L0Ohmn2DSS3nN5Dcz5YkRYpuEshx19MzS3P
Y34lCAqQiqYAiQ/iqfYieQ9ffuRoYzAutMrIN+pcM+a2gTX7t/CVsGQEAh90YNWC
U8HOTf3qOchlQ/XUQe5Opnl1357UyxIY2tRSdihGMyySyaTgs9MskGyhhAP9OCK5
qhdF4XCw0Q8+w3KdVMEK69P6VMrBUGmQM8742n3se+/KLfPT23obc0sSz/zAFdon
vZM4PG+I8G0pJmlzqqlsuQJoWSRXF+g37aQ9OL1O7O+B59kG2ID63rp76vWPXxUY
tNhU6igojSgujVA7fsbj
=EBi/
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3088-1
September 27, 2016
bind9 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Bind could be made to crash if it received specially crafted network
traffic.
Software Description:
- bind9: Internet Domain Name Server
Details:
It was discovered that Bind incorrectly handled building responses to
certain specially crafted requests. A remote attacker could possibly use
this issue to cause Bind to crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
bind9 1:9.10.3.dfsg.P4-8ubuntu1.1
Ubuntu 14.04 LTS:
bind9 1:9.9.5.dfsg-3ubuntu0.9
Ubuntu 12.04 LTS:
bind9 1:9.8.1.dfsg.P1-4ubuntu0.17
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3088-1
CVE-2016-2776
Package Information:
https://launchpad.net/ubuntu/+source/bind9/1:9.10.3.dfsg.P4-8ubuntu1.1
https://launchpad.net/ubuntu/+source/bind9/1:9.9.5.dfsg-3ubuntu0.9
https://launchpad.net/ubuntu/+source/bind9/1:9.8.1.dfsg.P1-4ubuntu0.17
Version: GnuPG v2
iQIcBAEBCgAGBQJX6rWVAAoJEGVp2FWnRL6T+IcP/2m/wpREPXtwGIqlZ+vD54Gj
/jp5Ya9QoyrqgfdlgMKxEeEkkKixBUrt4AaJnmdYKPatAFDZypFqRj5ZAejtQqVX
57+ieQuohX5kKpDc03aiEJQLoh9xqbXc2FL9Rad1QD5fW4XENC5UzeoBqRd/TRdT
2o6zqY1QV5AwF3hw0YUUR6HMYYaldjkoIain8sEr3utGHQG01QPBn83YMJgjhW3I
ydUdttlHXzO0mIAiKEbLhq2gJompTakwIDuDYzO3nFM27pVn+n65JI/OJpt1knZU
yk3QZYo8UKiyGsk4WO01OQJ3lv+PvMmVwenGrXnfyQLi4ScYhhfkWoT8j3c8WZ0r
sye8jtCsgD3RRi4pwiD7o8i8r6Cr7L0Ohmn2DSS3nN5Dcz5YkRYpuEshx19MzS3P
Y34lCAqQiqYAiQ/iqfYieQ9ffuRoYzAutMrIN+pcM+a2gTX7t/CVsGQEAh90YNWC
U8HOTf3qOchlQ/XUQe5Opnl1357UyxIY2tRSdihGMyySyaTgs9MskGyhhAP9OCK5
qhdF4XCw0Q8+w3KdVMEK69P6VMrBUGmQM8742n3se+/KLfPT23obc0sSz/zAFdon
vZM4PG+I8G0pJmlzqqlsuQJoWSRXF+g37aQ9OL1O7O+B59kG2ID63rp76vWPXxUY
tNhU6igojSgujVA7fsbj
=EBi/
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3088-1
September 27, 2016
bind9 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Bind could be made to crash if it received specially crafted network
traffic.
Software Description:
- bind9: Internet Domain Name Server
Details:
It was discovered that Bind incorrectly handled building responses to
certain specially crafted requests. A remote attacker could possibly use
this issue to cause Bind to crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
bind9 1:9.10.3.dfsg.P4-8ubuntu1.1
Ubuntu 14.04 LTS:
bind9 1:9.9.5.dfsg-3ubuntu0.9
Ubuntu 12.04 LTS:
bind9 1:9.8.1.dfsg.P1-4ubuntu0.17
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3088-1
CVE-2016-2776
Package Information:
https://launchpad.net/ubuntu/+source/bind9/1:9.10.3.dfsg.P4-8ubuntu1.1
https://launchpad.net/ubuntu/+source/bind9/1:9.9.5.dfsg-3ubuntu0.9
https://launchpad.net/ubuntu/+source/bind9/1:9.8.1.dfsg.P1-4ubuntu0.17
[USN-3089-1] Django vulnerability
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJX6nz9AAoJEGVp2FWnRL6T02UQALxDzb1ajGZJwJQH/5kpkZIC
kxeLWfVjMe4HHhziVWsix+R/Xc+TcIXViSh4FQMKDLsbye1wZ8AenZs5tyHMh7MK
sINP0f1Pg7MB/dh2tGZfC3uLZd9fsptjF8evdgYsiCeZZqDKHRxfPhhob27PEkpm
hgfFMYAMA07GkVz+0jCcqo9SLL9UVY+j23+PgT0FysUD3G1u4StYuVIyd1DvNha1
t0itGWH302nZdYMTfH5yn1isnM8O09Fua2rbOEevgrlAXQKNrEg3yuchW1sgakGL
vcFsOFRdppVvbKNX4MFZFO9nB/9IM5kHUKQaG23UbvXFmEjtPZTPc284VjDrDirS
moxw3XZdHiV9c+BQwWnpMJacN4L5vRnH5siR4C0Dxd9ysz2Ni3CdtuIIg8/arTEp
pZ/uiRDp00CSPwz1QpjXa8s72dDyxup9Y1KkX2tWMPrJ9kf/qGKzMiRtqxzbt2oj
kK1YTSGoEJY6NvU36DCIy109KIZDCO7sTtvobvATN5xFkfZIa5wfOebiOIDT6FG4
oEdXnw4YI73hprHW+oib365JBAGJRL/DVqHzUrvexCV9L4/IUoSnYrqVzMxyjv/i
Q6Oedlw6VaCHXqYhLgwuNVP8n05QarFRiWHrEWfbG3drXdKta/LGX26+RIgBD9nu
IuRl8gJQBDSfFHI0aEE1
=RJbg
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3089-1
September 27, 2016
python-django vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Django could be made to set arbitrary cookies.
Software Description:
- python-django: High-level Python web development framework
Details:
Sergey Bobrov discovered that Django incorrectly parsed cookies when being
used with Google Analytics. A remote attacker could possibly use this issue
to set arbitrary cookies leading to a CSRF protection bypass.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
python-django 1.8.7-1ubuntu5.2
python3-django 1.8.7-1ubuntu5.2
Ubuntu 14.04 LTS:
python-django 1.6.1-2ubuntu0.15
Ubuntu 12.04 LTS:
python-django 1.3.1-4ubuntu1.21
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3089-1
CVE-2016-7401
Package Information:
https://launchpad.net/ubuntu/+source/python-django/1.8.7-1ubuntu5.2
https://launchpad.net/ubuntu/+source/python-django/1.6.1-2ubuntu0.15
https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.21
Version: GnuPG v2
iQIcBAEBCgAGBQJX6nz9AAoJEGVp2FWnRL6T02UQALxDzb1ajGZJwJQH/5kpkZIC
kxeLWfVjMe4HHhziVWsix+R/Xc+TcIXViSh4FQMKDLsbye1wZ8AenZs5tyHMh7MK
sINP0f1Pg7MB/dh2tGZfC3uLZd9fsptjF8evdgYsiCeZZqDKHRxfPhhob27PEkpm
hgfFMYAMA07GkVz+0jCcqo9SLL9UVY+j23+PgT0FysUD3G1u4StYuVIyd1DvNha1
t0itGWH302nZdYMTfH5yn1isnM8O09Fua2rbOEevgrlAXQKNrEg3yuchW1sgakGL
vcFsOFRdppVvbKNX4MFZFO9nB/9IM5kHUKQaG23UbvXFmEjtPZTPc284VjDrDirS
moxw3XZdHiV9c+BQwWnpMJacN4L5vRnH5siR4C0Dxd9ysz2Ni3CdtuIIg8/arTEp
pZ/uiRDp00CSPwz1QpjXa8s72dDyxup9Y1KkX2tWMPrJ9kf/qGKzMiRtqxzbt2oj
kK1YTSGoEJY6NvU36DCIy109KIZDCO7sTtvobvATN5xFkfZIa5wfOebiOIDT6FG4
oEdXnw4YI73hprHW+oib365JBAGJRL/DVqHzUrvexCV9L4/IUoSnYrqVzMxyjv/i
Q6Oedlw6VaCHXqYhLgwuNVP8n05QarFRiWHrEWfbG3drXdKta/LGX26+RIgBD9nu
IuRl8gJQBDSfFHI0aEE1
=RJbg
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3089-1
September 27, 2016
python-django vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Django could be made to set arbitrary cookies.
Software Description:
- python-django: High-level Python web development framework
Details:
Sergey Bobrov discovered that Django incorrectly parsed cookies when being
used with Google Analytics. A remote attacker could possibly use this issue
to set arbitrary cookies leading to a CSRF protection bypass.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
python-django 1.8.7-1ubuntu5.2
python3-django 1.8.7-1ubuntu5.2
Ubuntu 14.04 LTS:
python-django 1.6.1-2ubuntu0.15
Ubuntu 12.04 LTS:
python-django 1.3.1-4ubuntu1.21
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3089-1
CVE-2016-7401
Package Information:
https://launchpad.net/ubuntu/+source/python-django/1.8.7-1ubuntu5.2
https://launchpad.net/ubuntu/+source/python-django/1.6.1-2ubuntu0.15
https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.21
Monday, September 26, 2016
Fedora 25 Beta Freeze
Hi all,
Today is an important day on the Fedora 25 schedule[1], with two
significant cut-offs.
Today is the Beta freeze[2]. This means that only packages which fix
accepted blocker or freeze exception bugs[3][4] will be marked as
'stable' and included in the Beta composes. Other builds will remain
in updates-testing until the Beta release is approved, at which point
the Beta freeze is lifted and packages can move to 'stable' as usual
until the Final freeze.
Finally, Today is the '100% code complete deadline' Change
Checkpoint[5], meaning that Fedora 24 Changes must now be code
complete, meaning all the code required to enable to the new change is
finished. The level of code completeness is reflected as tracker bug
state ON_QA. The change does not have to be fully tested by this
deadline'.
Regards
Mohan Boddu
[1] https://fedoraproject.org/wiki/Releases/25/Schedule
[2] https://fedoraproject.org/wiki/Milestone_freezes
[3] https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process
[4] https://fedoraproject.org/wiki/QA:SOP_freeze_exception_bug_process
[5] https://fedoraproject.org/wiki/Changes/Policy
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-16:26.openssl [REVISED]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-16:26.openssl Security Advisory
The FreeBSD Project
Topic: Multiple OpenSSL vulnerabilities
Category: contrib
Module: openssl
Announced: 2016-09-23; revised on 2016-09-26
Credits: OpenSSL Project
Affects: All supported versions of FreeBSD.
Corrected: 2016-09-22 14:57:48 UTC (stable/11, 11.0-STABLE)
2016-09-22 15:55:27 UTC (releng/11.0, 11.0-RELEASE)
2016-09-22 15:05:38 UTC (stable/10, 10.3-STABLE)
2016-09-26 08:21:29 UTC (releng/10.3, 10.3-RELEASE-p9)
2016-09-26 08:21:29 UTC (releng/10.2, 10.2-RELEASE-p22)
2016-09-26 08:21:29 UTC (releng/10.1, 10.1-RELEASE-p39)
2016-09-26 08:19:33 UTC (stable/9, 9.3-STABLE)
2016-09-26 08:21:29 UTC (releng/9.3, 9.3-RELEASE-p47)
CVE Name: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180,
CVE-2016-2181, CVE-2016-2182, CVE-2016-6302, CVE-2016-6303,
CVE-2016-6304, CVE-2016-6306
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
0. Revision history
v1.0 2016-09-23 Initial release.
v1.1 2016-09-26 Revised patch to address a regression in CVE-2016-2182 fix.
I. Background
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is
a collaborative effort to develop a robust, commercial-grade, full-featured
Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols as well as a full-strength
general purpose cryptography library.
II. Problem Description
A malicious client can send an excessively large OCSP Status Request extension.
If that client continually requests renegotiation, sending a large OCSP Status
Request extension each time, then there will be unbounded memory growth on the
server. [CVE-2016-6304]
An overflow can occur in MDC2_Update() either if called directly or through
the EVP_DigestUpdate() function using MDC2. If an attacker is able to supply
very large amounts of input data after a previous call to EVP_EncryptUpdate()
with a partial block then a length check can overflow resulting in a heap
corruption. [CVE-2016-6303]
If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a
DoS attack where a malformed ticket will result in an OOB read which will
ultimately crash. [CVE-2016-6302]
The function BN_bn2dec() does not check the return value of BN_div_word().
This can cause an OOB write if an application uses this function with an
overly large BIGNUM. This could be a problem if an overly large certificate
or CRL is printed out from an untrusted source. TLS is not affected because
record limits will reject an oversized certificate before it is parsed.
[CVE-2016-2182]
The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is
the total length the OID text representation would use and not the amount
of data written. This will result in OOB reads when large OIDs are presented.
[CVE-2016-2180]
Some calculations of limits in OpenSSL have used undefined pointer arithmetic.
This could cause problems with some malloc implementations. [CVE-2016-2177]
Operations in the DSA signing algorithm should run in constant time in order to
avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that
a non-constant time codepath is followed for certain operations. [CVE-2016-2178]
In a DTLS connection where handshake messages are delivered out-of-order those
messages that OpenSSL is not yet ready to process will be buffered for later
use. Under certain circumstances, a flaw in the logic means that those messages
do not get removed from the buffer even though the handshake has been completed.
An attacker could force up to approx. 15 messages to remain in the buffer when
they are no longer required. These messages will be cleared when the DTLS
connection is closed. The default maximum size for a message is 100k. Therefore
the attacker could force an additional 1500k to be consumed per connection.
[CVE-2016-2179]
A flaw in the DTLS replay attack protection mechanism means that records that
arrive for future epochs update the replay protection "window" before the MAC
for the record has been validated. This could be exploited by an attacker by
sending a record for the next epoch (which does not have to decrypt or have a
valid MAC), with a very large sequence number. This means that all subsequent
legitimate packets are dropped causing a denial of service for a specific
DTLS connection. [CVE-2016-2181]
In OpenSSL 1.0.2 and earlier some missing message length checks can result in
OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical
DoS risk but this has not been observed in practice on common platforms.
[CVE-2016-6306]
III. Impact
A remote attacker can cause OpenSSL server, regardless whether OCSP is supported,
to have unbounded memory growth, and eventually lead to a Denial of Service.
[CVE-2016-6304]
If an attacker is able to supply very large amounts of input data after a previous
call to EVP_EncryptUpdate() with a partial block then a length check can overflow
resulting in a heap corruption. [CVE-2016-6303]
An attacker who can send a malformed ticket to the server can cause an OOB read
which will ultimately lead to a crash, resulting in a Denial of Service.
[CVE-2016-6302]
A local attacker can cause an application that parses overly large certificate or
CRL to crash. TLS is not affected. [CVE-2016-2182]
A local attacker who can create a specially-crafted time stamp file and pass it
through the "ts" command of openssl(1) can cause it to crash. This functionality
is not used by the SSL/TLS implementation. [CVE-2016-2180]
Some OpenSSL code is questionable to integer overflow, which may lead to heap
corruption. [CVE-2016-2177]
An attacker may recover the private DSA key by conducting timing attack.
[CVE-2016-2178]
A remote attacker may cause a DTLS server to exhaust memory, resulting in a
Denial of Service. [CVE-2016-2179]
A remote attacker who can send DTLS records can cause the server to drop all
subsequent packets for a specific connection. [CVE-2016-2181]
A remote attacker can, in theory, cause OOB reads if the server enabled client
authentication. [CVE-2016-6306]
IV. Workaround
No workaround is available.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Restart all daemons that use the library, or reboot the system.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
Restart all daemons that use the library, or reboot the system.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 10.3]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.3.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.3.patch.asc
# gpg --verify openssl-10.3.patch.asc
[FreeBSD 10.1 and 10.2]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.2.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.2.patch.asc
# gpg --verify openssl-10.2.patch.asc
[FreeBSD 9.3]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-9.3.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-9.3.patch.asc
# gpg --verify openssl-9.3.patch.asc
For all releases, additionally, apply the openssl-fix.patch:
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-fix.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-fix.patch.asc
# gpg --verify openssl-fix.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all daemons that use the library, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r306335
releng/9.3/ r306336
stable/10/ r306196
releng/10.1/ r306336
releng/10.2/ r306336
releng/10.3/ r306336
stable/11/ r306195
releng/11.0/ r306198
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://www.openssl.org/news/secadv/20160922.txt>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2178>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2179>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2180>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2181>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2182>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6302>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6303>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6304>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6306>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.13 (FreeBSD)
iQIcBAEBCgAGBQJX6NvHAAoJEO1n7NZdz2rncwEP/3E3/QSGoSuhh7nqj3mzpSEl
YYVB2B6HrxOa99b6rDT8lnnbdkE+Z409C8PP/gM/86WsMJXRrYbB2Dvnpt2hdMI6
SK94iydp4/QEoahi3DqaiuvO0xfDonUVK/XM+HD2+OGnf5XhRJrXN72aYauK2TEw
3U58NWqdkHKyLMb9Xw6oOeoexOl7rbzvxB1M1Idsb5+mcs4/n9MHfLPPYDMZdGmc
XNuHzafINU4RD6ewZXmCjzZ2v4vlN6UJwoCdvm8NmG+2SGTqC+F/eldNFXuDuThz
DODYpyfg6LjkxeY+P4eG8BMM1grrf1K0/HAaDx3h+F/H/XrxP2gNQfXPxK9HSddL
eFWspWdRfJBydM4zrB8ndu/xmgfuCkgfrOgYU6z9eSLarmElM25Wic4+PiU0DXOq
tHoL3k6B8sEio19Jh2ggdrZJBDM+BzlDqXve3Z1t9lY9DVZbcNe1xWJ7SreBQfXl
n0r3LKLXxaFq014gb4/MV503XAn1P6Q87nL8wzkm9Z1qIHlJPt6Igrl+A5LcQ589
nW35xpeco8vFG0C6AmUk1cY14nZdZ/OjIEM4zGTd7oXRZRK6VFHJssTl0qJ/KLb1
rssl78ffhonLwFLLUzAGQlzYXYspz0ySwsrECcebOTzKzFUC9V0hcBuRMIwlAn5g
aqC0mYXivXqtV/cgdYL/
=3i9P
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-16:26.openssl Security Advisory
The FreeBSD Project
Topic: Multiple OpenSSL vulnerabilities
Category: contrib
Module: openssl
Announced: 2016-09-23; revised on 2016-09-26
Credits: OpenSSL Project
Affects: All supported versions of FreeBSD.
Corrected: 2016-09-22 14:57:48 UTC (stable/11, 11.0-STABLE)
2016-09-22 15:55:27 UTC (releng/11.0, 11.0-RELEASE)
2016-09-22 15:05:38 UTC (stable/10, 10.3-STABLE)
2016-09-26 08:21:29 UTC (releng/10.3, 10.3-RELEASE-p9)
2016-09-26 08:21:29 UTC (releng/10.2, 10.2-RELEASE-p22)
2016-09-26 08:21:29 UTC (releng/10.1, 10.1-RELEASE-p39)
2016-09-26 08:19:33 UTC (stable/9, 9.3-STABLE)
2016-09-26 08:21:29 UTC (releng/9.3, 9.3-RELEASE-p47)
CVE Name: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180,
CVE-2016-2181, CVE-2016-2182, CVE-2016-6302, CVE-2016-6303,
CVE-2016-6304, CVE-2016-6306
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
0. Revision history
v1.0 2016-09-23 Initial release.
v1.1 2016-09-26 Revised patch to address a regression in CVE-2016-2182 fix.
I. Background
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is
a collaborative effort to develop a robust, commercial-grade, full-featured
Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols as well as a full-strength
general purpose cryptography library.
II. Problem Description
A malicious client can send an excessively large OCSP Status Request extension.
If that client continually requests renegotiation, sending a large OCSP Status
Request extension each time, then there will be unbounded memory growth on the
server. [CVE-2016-6304]
An overflow can occur in MDC2_Update() either if called directly or through
the EVP_DigestUpdate() function using MDC2. If an attacker is able to supply
very large amounts of input data after a previous call to EVP_EncryptUpdate()
with a partial block then a length check can overflow resulting in a heap
corruption. [CVE-2016-6303]
If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a
DoS attack where a malformed ticket will result in an OOB read which will
ultimately crash. [CVE-2016-6302]
The function BN_bn2dec() does not check the return value of BN_div_word().
This can cause an OOB write if an application uses this function with an
overly large BIGNUM. This could be a problem if an overly large certificate
or CRL is printed out from an untrusted source. TLS is not affected because
record limits will reject an oversized certificate before it is parsed.
[CVE-2016-2182]
The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is
the total length the OID text representation would use and not the amount
of data written. This will result in OOB reads when large OIDs are presented.
[CVE-2016-2180]
Some calculations of limits in OpenSSL have used undefined pointer arithmetic.
This could cause problems with some malloc implementations. [CVE-2016-2177]
Operations in the DSA signing algorithm should run in constant time in order to
avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that
a non-constant time codepath is followed for certain operations. [CVE-2016-2178]
In a DTLS connection where handshake messages are delivered out-of-order those
messages that OpenSSL is not yet ready to process will be buffered for later
use. Under certain circumstances, a flaw in the logic means that those messages
do not get removed from the buffer even though the handshake has been completed.
An attacker could force up to approx. 15 messages to remain in the buffer when
they are no longer required. These messages will be cleared when the DTLS
connection is closed. The default maximum size for a message is 100k. Therefore
the attacker could force an additional 1500k to be consumed per connection.
[CVE-2016-2179]
A flaw in the DTLS replay attack protection mechanism means that records that
arrive for future epochs update the replay protection "window" before the MAC
for the record has been validated. This could be exploited by an attacker by
sending a record for the next epoch (which does not have to decrypt or have a
valid MAC), with a very large sequence number. This means that all subsequent
legitimate packets are dropped causing a denial of service for a specific
DTLS connection. [CVE-2016-2181]
In OpenSSL 1.0.2 and earlier some missing message length checks can result in
OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical
DoS risk but this has not been observed in practice on common platforms.
[CVE-2016-6306]
III. Impact
A remote attacker can cause OpenSSL server, regardless whether OCSP is supported,
to have unbounded memory growth, and eventually lead to a Denial of Service.
[CVE-2016-6304]
If an attacker is able to supply very large amounts of input data after a previous
call to EVP_EncryptUpdate() with a partial block then a length check can overflow
resulting in a heap corruption. [CVE-2016-6303]
An attacker who can send a malformed ticket to the server can cause an OOB read
which will ultimately lead to a crash, resulting in a Denial of Service.
[CVE-2016-6302]
A local attacker can cause an application that parses overly large certificate or
CRL to crash. TLS is not affected. [CVE-2016-2182]
A local attacker who can create a specially-crafted time stamp file and pass it
through the "ts" command of openssl(1) can cause it to crash. This functionality
is not used by the SSL/TLS implementation. [CVE-2016-2180]
Some OpenSSL code is questionable to integer overflow, which may lead to heap
corruption. [CVE-2016-2177]
An attacker may recover the private DSA key by conducting timing attack.
[CVE-2016-2178]
A remote attacker may cause a DTLS server to exhaust memory, resulting in a
Denial of Service. [CVE-2016-2179]
A remote attacker who can send DTLS records can cause the server to drop all
subsequent packets for a specific connection. [CVE-2016-2181]
A remote attacker can, in theory, cause OOB reads if the server enabled client
authentication. [CVE-2016-6306]
IV. Workaround
No workaround is available.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Restart all daemons that use the library, or reboot the system.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
Restart all daemons that use the library, or reboot the system.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 10.3]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.3.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.3.patch.asc
# gpg --verify openssl-10.3.patch.asc
[FreeBSD 10.1 and 10.2]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.2.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.2.patch.asc
# gpg --verify openssl-10.2.patch.asc
[FreeBSD 9.3]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-9.3.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-9.3.patch.asc
# gpg --verify openssl-9.3.patch.asc
For all releases, additionally, apply the openssl-fix.patch:
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-fix.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-fix.patch.asc
# gpg --verify openssl-fix.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all daemons that use the library, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r306335
releng/9.3/ r306336
stable/10/ r306196
releng/10.1/ r306336
releng/10.2/ r306336
releng/10.3/ r306336
stable/11/ r306195
releng/11.0/ r306198
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://www.openssl.org/news/secadv/20160922.txt>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2178>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2179>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2180>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2181>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2182>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6302>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6303>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6304>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6306>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.13 (FreeBSD)
iQIcBAEBCgAGBQJX6NvHAAoJEO1n7NZdz2rncwEP/3E3/QSGoSuhh7nqj3mzpSEl
YYVB2B6HrxOa99b6rDT8lnnbdkE+Z409C8PP/gM/86WsMJXRrYbB2Dvnpt2hdMI6
SK94iydp4/QEoahi3DqaiuvO0xfDonUVK/XM+HD2+OGnf5XhRJrXN72aYauK2TEw
3U58NWqdkHKyLMb9Xw6oOeoexOl7rbzvxB1M1Idsb5+mcs4/n9MHfLPPYDMZdGmc
XNuHzafINU4RD6ewZXmCjzZ2v4vlN6UJwoCdvm8NmG+2SGTqC+F/eldNFXuDuThz
DODYpyfg6LjkxeY+P4eG8BMM1grrf1K0/HAaDx3h+F/H/XrxP2gNQfXPxK9HSddL
eFWspWdRfJBydM4zrB8ndu/xmgfuCkgfrOgYU6z9eSLarmElM25Wic4+PiU0DXOq
tHoL3k6B8sEio19Jh2ggdrZJBDM+BzlDqXve3Z1t9lY9DVZbcNe1xWJ7SreBQfXl
n0r3LKLXxaFq014gb4/MV503XAn1P6Q87nL8wzkm9Z1qIHlJPt6Igrl+A5LcQ589
nW35xpeco8vFG0C6AmUk1cY14nZdZ/OjIEM4zGTd7oXRZRK6VFHJssTl0qJ/KLb1
rssl78ffhonLwFLLUzAGQlzYXYspz0ySwsrECcebOTzKzFUC9V0hcBuRMIwlAn5g
aqC0mYXivXqtV/cgdYL/
=3i9P
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Friday, September 23, 2016
[USN-3087-2] OpenSSL regression
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJX5U0mAAoJEGVp2FWnRL6TTpkQAIg0sQfCgAU9aKPygpKIZRC8
4Ffdr816X2rLtA93XmTY3jQim1H4Y16ui9wxts9zXZdiK1oPfiNWj6yTA+5hqsbB
kKiHlZkWWwlaoxUNvPFVYWUJVPjXVQxPffnN3NBfczYhtR5hxKfOQTE8irD0uWpq
PfhNzsbRE/waPSd0aIPZxsbfS+lHWaDTavSUhh8JgM5bGihWQ5pwsSOvZ1NQ749w
5ADZ5wg+Sc9T2AfhkO0TKJusDx5UXN0LDIEAVQRUybene1bwbABXxExPY4GMzW6g
dGQEB8KySujqTmgKRWrnaVJxgedYTMFmPZvFvtxYvX1/6+2OxAA2DLCzZ4tf/gxg
cj61duLK7bwVACP6XRfR739yg6YWABuUVd6/CRXs8+jotLEHiaMoLsVDczeU7BGc
kt0ZpyRnPoAOurQfGmZnTAhXKz4qs7P8UANX74lLp6soJZ9FikqlSDHIiUE9Ijvf
EJc7/3AJf1MK8Q3eDc+WybzTJ/5AyX1JFSHmVXIHiXwXI1ZqRLM9Eu+qXA6pgLyt
SOh9VOadtvVs7hywSIa044WbWrKpZkZ0AoRc01PFGppeFO4NAV2rW1v35wzIi6ul
RkzLnMZ/lZKcrvQ/cSIuObdHhz2h7wAKVAegteIVthaIM7z/3/ry3c7PsmFDSrLh
C6kZ5dbuoDbyxYHPwsy+
=isLw
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3087-2
September 23, 2016
openssl regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
USN-3087-1 introduced a regression in OpenSSL.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was
incomplete and caused a regression when parsing certificates. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request
extension. A remote attacker could possibly use this issue to cause memory
consumption, resulting in a denial of service. (CVE-2016-6304)
Guido Vranken discovered that OpenSSL used undefined behaviour when
performing pointer arithmetic. A remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. This
issue has only been addressed in Ubuntu 16.04 LTS in this update.
(CVE-2016-2177)
César Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL
did not properly use constant-time operations when performing DSA signing.
A remote attacker could possibly use this issue to perform a cache-timing
attack and recover private DSA keys. (CVE-2016-2178)
Quan Luo discovered that OpenSSL did not properly restrict the lifetime
of queue entries in the DTLS implementation. A remote attacker could
possibly use this issue to consume memory, resulting in a denial of
service. (CVE-2016-2179)
Shi Lei discovered that OpenSSL incorrectly handled memory in the
TS_OBJ_print_bio() function. A remote attacker could possibly use this
issue to cause a denial of service. (CVE-2016-2180)
It was discovered that the OpenSSL incorrectly handled the DTLS anti-replay
feature. A remote attacker could possibly use this issue to cause a denial
of service. (CVE-2016-2181)
Shi Lei discovered that OpenSSL incorrectly validated division results. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2016-2182)
Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES
ciphers were vulnerable to birthday attacks. A remote attacker could
possibly use this flaw to obtain clear text data from long encrypted
sessions. This update moves DES from the HIGH cipher list to MEDIUM.
(CVE-2016-2183)
Shi Lei discovered that OpenSSL incorrectly handled certain ticket lengths.
A remote attacker could use this issue to cause a denial of service.
(CVE-2016-6302)
Shi Lei discovered that OpenSSL incorrectly handled memory in the
MDC2_Update() function. A remote attacker could possibly use this issue to
cause a denial of service. (CVE-2016-6303)
Shi Lei discovered that OpenSSL incorrectly performed certain message
length checks. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2016-6306)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
libssl1.0.0 1.0.2g-1ubuntu4.5
Ubuntu 14.04 LTS:
libssl1.0.0 1.0.1f-1ubuntu2.21
Ubuntu 12.04 LTS:
libssl1.0.0 1.0.1-4ubuntu5.38
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3087-2
http://www.ubuntu.com/usn/usn-3087-1
https://launchpad.net/bugs/1626883
Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.5
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.21
https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.38
Version: GnuPG v2
iQIcBAEBCgAGBQJX5U0mAAoJEGVp2FWnRL6TTpkQAIg0sQfCgAU9aKPygpKIZRC8
4Ffdr816X2rLtA93XmTY3jQim1H4Y16ui9wxts9zXZdiK1oPfiNWj6yTA+5hqsbB
kKiHlZkWWwlaoxUNvPFVYWUJVPjXVQxPffnN3NBfczYhtR5hxKfOQTE8irD0uWpq
PfhNzsbRE/waPSd0aIPZxsbfS+lHWaDTavSUhh8JgM5bGihWQ5pwsSOvZ1NQ749w
5ADZ5wg+Sc9T2AfhkO0TKJusDx5UXN0LDIEAVQRUybene1bwbABXxExPY4GMzW6g
dGQEB8KySujqTmgKRWrnaVJxgedYTMFmPZvFvtxYvX1/6+2OxAA2DLCzZ4tf/gxg
cj61duLK7bwVACP6XRfR739yg6YWABuUVd6/CRXs8+jotLEHiaMoLsVDczeU7BGc
kt0ZpyRnPoAOurQfGmZnTAhXKz4qs7P8UANX74lLp6soJZ9FikqlSDHIiUE9Ijvf
EJc7/3AJf1MK8Q3eDc+WybzTJ/5AyX1JFSHmVXIHiXwXI1ZqRLM9Eu+qXA6pgLyt
SOh9VOadtvVs7hywSIa044WbWrKpZkZ0AoRc01PFGppeFO4NAV2rW1v35wzIi6ul
RkzLnMZ/lZKcrvQ/cSIuObdHhz2h7wAKVAegteIVthaIM7z/3/ry3c7PsmFDSrLh
C6kZ5dbuoDbyxYHPwsy+
=isLw
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3087-2
September 23, 2016
openssl regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
USN-3087-1 introduced a regression in OpenSSL.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was
incomplete and caused a regression when parsing certificates. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request
extension. A remote attacker could possibly use this issue to cause memory
consumption, resulting in a denial of service. (CVE-2016-6304)
Guido Vranken discovered that OpenSSL used undefined behaviour when
performing pointer arithmetic. A remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. This
issue has only been addressed in Ubuntu 16.04 LTS in this update.
(CVE-2016-2177)
César Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL
did not properly use constant-time operations when performing DSA signing.
A remote attacker could possibly use this issue to perform a cache-timing
attack and recover private DSA keys. (CVE-2016-2178)
Quan Luo discovered that OpenSSL did not properly restrict the lifetime
of queue entries in the DTLS implementation. A remote attacker could
possibly use this issue to consume memory, resulting in a denial of
service. (CVE-2016-2179)
Shi Lei discovered that OpenSSL incorrectly handled memory in the
TS_OBJ_print_bio() function. A remote attacker could possibly use this
issue to cause a denial of service. (CVE-2016-2180)
It was discovered that the OpenSSL incorrectly handled the DTLS anti-replay
feature. A remote attacker could possibly use this issue to cause a denial
of service. (CVE-2016-2181)
Shi Lei discovered that OpenSSL incorrectly validated division results. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2016-2182)
Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES
ciphers were vulnerable to birthday attacks. A remote attacker could
possibly use this flaw to obtain clear text data from long encrypted
sessions. This update moves DES from the HIGH cipher list to MEDIUM.
(CVE-2016-2183)
Shi Lei discovered that OpenSSL incorrectly handled certain ticket lengths.
A remote attacker could use this issue to cause a denial of service.
(CVE-2016-6302)
Shi Lei discovered that OpenSSL incorrectly handled memory in the
MDC2_Update() function. A remote attacker could possibly use this issue to
cause a denial of service. (CVE-2016-6303)
Shi Lei discovered that OpenSSL incorrectly performed certain message
length checks. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2016-6306)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
libssl1.0.0 1.0.2g-1ubuntu4.5
Ubuntu 14.04 LTS:
libssl1.0.0 1.0.1f-1ubuntu2.21
Ubuntu 12.04 LTS:
libssl1.0.0 1.0.1-4ubuntu5.38
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3087-2
http://www.ubuntu.com/usn/usn-3087-1
https://launchpad.net/bugs/1626883
Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.5
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.21
https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.38
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-16:26.openssl
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-16:26.openssl Security Advisory
The FreeBSD Project
Topic: Multiple OpenSSL vulnerabilities
Category: contrib
Module: openssl
Announced: 2016-09-23
Credits: OpenSSL Project
Affects: All supported versions of FreeBSD.
Corrected: 2016-09-22 14:57:48 UTC (stable/11, 11.0-STABLE)
2016-09-22 15:55:27 UTC (releng/11.0, 11.0-RELEASE)
2016-09-22 15:05:38 UTC (stable/10, 10.3-STABLE)
2016-09-23 07:48:34 UTC (releng/10.3, 10.3-RELEASE-p8)
2016-09-23 07:48:34 UTC (releng/10.2, 10.2-RELEASE-p21)
2016-09-23 07:48:34 UTC (releng/10.1, 10.1-RELEASE-p38)
2016-09-23 07:44:10 UTC (stable/9, 9.3-STABLE)
2016-09-23 07:48:34 UTC (releng/9.3, 9.3-RELEASE-p46)
CVE Name: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180,
CVE-2016-2181, CVE-2016-2182, CVE-2016-6302, CVE-2016-6303,
CVE-2016-6304, CVE-2016-6306
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is
a collaborative effort to develop a robust, commercial-grade, full-featured
Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols as well as a full-strength
general purpose cryptography library.
II. Problem Description
A malicious client can send an excessively large OCSP Status Request extension.
If that client continually requests renegotiation, sending a large OCSP Status
Request extension each time, then there will be unbounded memory growth on the
server. [CVE-2016-6304]
An overflow can occur in MDC2_Update() either if called directly or through
the EVP_DigestUpdate() function using MDC2. If an attacker is able to supply
very large amounts of input data after a previous call to EVP_EncryptUpdate()
with a partial block then a length check can overflow resulting in a heap
corruption. [CVE-2016-6303]
If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a
DoS attack where a malformed ticket will result in an OOB read which will
ultimately crash. [CVE-2016-6302]
The function BN_bn2dec() does not check the return value of BN_div_word().
This can cause an OOB write if an application uses this function with an
overly large BIGNUM. This could be a problem if an overly large certificate
or CRL is printed out from an untrusted source. TLS is not affected because
record limits will reject an oversized certificate before it is parsed.
[CVE-2016-2182]
The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is
the total length the OID text representation would use and not the amount
of data written. This will result in OOB reads when large OIDs are presented.
[CVE-2016-2180]
Some calculations of limits in OpenSSL have used undefined pointer arithmetic.
This could cause problems with some malloc implementations. [CVE-2016-2177]
Operations in the DSA signing algorithm should run in constant time in order to
avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that
a non-constant time codepath is followed for certain operations. [CVE-2016-2178]
In a DTLS connection where handshake messages are delivered out-of-order those
messages that OpenSSL is not yet ready to process will be buffered for later
use. Under certain circumstances, a flaw in the logic means that those messages
do not get removed from the buffer even though the handshake has been completed.
An attacker could force up to approx. 15 messages to remain in the buffer when
they are no longer required. These messages will be cleared when the DTLS
connection is closed. The default maximum size for a message is 100k. Therefore
the attacker could force an additional 1500k to be consumed per connection.
[CVE-2016-2179]
A flaw in the DTLS replay attack protection mechanism means that records that
arrive for future epochs update the replay protection "window" before the MAC
for the record has been validated. This could be exploited by an attacker by
sending a record for the next epoch (which does not have to decrypt or have a
valid MAC), with a very large sequence number. This means that all subsequent
legitimate packets are dropped causing a denial of service for a specific
DTLS connection. [CVE-2016-2181]
In OpenSSL 1.0.2 and earlier some missing message length checks can result in
OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical
DoS risk but this has not been observed in practice on common platforms.
[CVE-2016-6306]
III. Impact
A remote attacker can cause OpenSSL server, regardless whether OCSP is supported,
to have unbounded memory growth, and eventually lead to a Denial of Service.
[CVE-2016-6304]
If an attacker is able to supply very large amounts of input data after a previous
call to EVP_EncryptUpdate() with a partial block then a length check can overflow
resulting in a heap corruption. [CVE-2016-6303]
An attacker who can send a malformed ticket to the server can cause an OOB read
which will ultimately lead to a crash, resulting in a Denial of Service.
[CVE-2016-6302]
A local attacker can cause an application that parses overly large certificate or
CRL to crash. TLS is not affected. [CVE-2016-2182]
A local attacker who can create a specially-crafted time stamp file and pass it
through the "ts" command of openssl(1) can cause it to crash. This functionality
is not used by the SSL/TLS implementation. [CVE-2016-2180]
Some OpenSSL code is questionable to integer overflow, which may lead to heap
corruption. [CVE-2016-2177]
An attacker may recover the private DSA key by conducting timing attack.
[CVE-2016-2178]
A remote attacker may cause a DTLS server to exhaust memory, resulting in a
Denial of Service. [CVE-2016-2179]
A remote attacker who can send DTLS records can cause the server to drop all
subsequent packets for a specific connection. [CVE-2016-2181]
A remote attacker can, in theory, cause OOB reads if the server enabled client
authentication. [CVE-2016-6306]
IV. Workaround
No workaround is available.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Restart all daemons that use the library, or reboot the system.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
Restart all daemons that use the library, or reboot the system.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 10.3]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.3.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.3.patch.asc
# gpg --verify openssl-10.3.patch.asc
[FreeBSD 10.1 and 10.2]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.2.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.2.patch.as
# gpg --verify openssl-10.2.patch.asc
[FreeBSD 9.3]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-9.3.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-9.3.patch.as
# gpg --verify openssl-9.3.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all daemons that use the library, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r306229
releng/9.3/ r206230
stable/10/ r306196
releng/10.1/ r206230
releng/10.2/ r206230
releng/10.3/ r206230
stable/11/ r306195
releng/11.0/ r306198
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://www.openssl.org/news/secadv/20160922.txt>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2178>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2179>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2180>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2181>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2182>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6302>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6303>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6304>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6306>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.13 (FreeBSD)
iQIcBAEBCgAGBQJX5N+CAAoJEO1n7NZdz2rnRZEP/2/fe1c3tLZZAPguwphI7NFK
DoGODy5Uj/pMdMv2ZvSJaNFKX5bo4ph2mCtA3rxFhFX4PEDaRoZc4BIlN470qdDe
soBV0mJEHC8r0z8cw6WYbh4wbd2yYy2x95LFi3g/04udctGQyxWmEzkzjzT8SqxU
EMoZYZuYQTvr8paQGiUizLu61AFDM2sZhU8yW4euxxiIREbFTO8rC7DMAk3mKfNk
Og1NN6uVK7+AgxZRJtfrKPftdwGPfKPQKgR731goAghQihThNNDvQ8OdDwj8Mlh1
KI8u+GaVKUTfgS2Ra9a291nEqV0EHZkY3zSpp4LeCY93gpFQeEhS5M/32oFheP4+
qNQZdvDzKVBKT1NTzgDbMN++56/h0FDa9NkIQbZI9TwkOTbLeGNMWtC46Ngza3tz
avlSxxckCwelvmZcjntU3MakdWQhIgMRFvOzVDgfL+erUi3kot0+kgiXq+cn0UEa
ZHOCJWIzAh/PJGPNOJl71Ji3qb6iUJx31HmVLxyoofbfKmNsg72/ROqUgBLCYO3s
kW77yMNYEBAzdxeep8oNwMat9bZbxnhvAbr2v934SIndLQ5FtDJ/OdiCq3oXMbyE
uLFTjqGaTur7z26bibT72l4OEy7Qkt5G1EqefxTGHpY0UQhjQQVFWjwbFYq9RT40
60v4DC15ArshCN6tuyWt
=8wR6
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-16:26.openssl Security Advisory
The FreeBSD Project
Topic: Multiple OpenSSL vulnerabilities
Category: contrib
Module: openssl
Announced: 2016-09-23
Credits: OpenSSL Project
Affects: All supported versions of FreeBSD.
Corrected: 2016-09-22 14:57:48 UTC (stable/11, 11.0-STABLE)
2016-09-22 15:55:27 UTC (releng/11.0, 11.0-RELEASE)
2016-09-22 15:05:38 UTC (stable/10, 10.3-STABLE)
2016-09-23 07:48:34 UTC (releng/10.3, 10.3-RELEASE-p8)
2016-09-23 07:48:34 UTC (releng/10.2, 10.2-RELEASE-p21)
2016-09-23 07:48:34 UTC (releng/10.1, 10.1-RELEASE-p38)
2016-09-23 07:44:10 UTC (stable/9, 9.3-STABLE)
2016-09-23 07:48:34 UTC (releng/9.3, 9.3-RELEASE-p46)
CVE Name: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180,
CVE-2016-2181, CVE-2016-2182, CVE-2016-6302, CVE-2016-6303,
CVE-2016-6304, CVE-2016-6306
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is
a collaborative effort to develop a robust, commercial-grade, full-featured
Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols as well as a full-strength
general purpose cryptography library.
II. Problem Description
A malicious client can send an excessively large OCSP Status Request extension.
If that client continually requests renegotiation, sending a large OCSP Status
Request extension each time, then there will be unbounded memory growth on the
server. [CVE-2016-6304]
An overflow can occur in MDC2_Update() either if called directly or through
the EVP_DigestUpdate() function using MDC2. If an attacker is able to supply
very large amounts of input data after a previous call to EVP_EncryptUpdate()
with a partial block then a length check can overflow resulting in a heap
corruption. [CVE-2016-6303]
If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a
DoS attack where a malformed ticket will result in an OOB read which will
ultimately crash. [CVE-2016-6302]
The function BN_bn2dec() does not check the return value of BN_div_word().
This can cause an OOB write if an application uses this function with an
overly large BIGNUM. This could be a problem if an overly large certificate
or CRL is printed out from an untrusted source. TLS is not affected because
record limits will reject an oversized certificate before it is parsed.
[CVE-2016-2182]
The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is
the total length the OID text representation would use and not the amount
of data written. This will result in OOB reads when large OIDs are presented.
[CVE-2016-2180]
Some calculations of limits in OpenSSL have used undefined pointer arithmetic.
This could cause problems with some malloc implementations. [CVE-2016-2177]
Operations in the DSA signing algorithm should run in constant time in order to
avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that
a non-constant time codepath is followed for certain operations. [CVE-2016-2178]
In a DTLS connection where handshake messages are delivered out-of-order those
messages that OpenSSL is not yet ready to process will be buffered for later
use. Under certain circumstances, a flaw in the logic means that those messages
do not get removed from the buffer even though the handshake has been completed.
An attacker could force up to approx. 15 messages to remain in the buffer when
they are no longer required. These messages will be cleared when the DTLS
connection is closed. The default maximum size for a message is 100k. Therefore
the attacker could force an additional 1500k to be consumed per connection.
[CVE-2016-2179]
A flaw in the DTLS replay attack protection mechanism means that records that
arrive for future epochs update the replay protection "window" before the MAC
for the record has been validated. This could be exploited by an attacker by
sending a record for the next epoch (which does not have to decrypt or have a
valid MAC), with a very large sequence number. This means that all subsequent
legitimate packets are dropped causing a denial of service for a specific
DTLS connection. [CVE-2016-2181]
In OpenSSL 1.0.2 and earlier some missing message length checks can result in
OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical
DoS risk but this has not been observed in practice on common platforms.
[CVE-2016-6306]
III. Impact
A remote attacker can cause OpenSSL server, regardless whether OCSP is supported,
to have unbounded memory growth, and eventually lead to a Denial of Service.
[CVE-2016-6304]
If an attacker is able to supply very large amounts of input data after a previous
call to EVP_EncryptUpdate() with a partial block then a length check can overflow
resulting in a heap corruption. [CVE-2016-6303]
An attacker who can send a malformed ticket to the server can cause an OOB read
which will ultimately lead to a crash, resulting in a Denial of Service.
[CVE-2016-6302]
A local attacker can cause an application that parses overly large certificate or
CRL to crash. TLS is not affected. [CVE-2016-2182]
A local attacker who can create a specially-crafted time stamp file and pass it
through the "ts" command of openssl(1) can cause it to crash. This functionality
is not used by the SSL/TLS implementation. [CVE-2016-2180]
Some OpenSSL code is questionable to integer overflow, which may lead to heap
corruption. [CVE-2016-2177]
An attacker may recover the private DSA key by conducting timing attack.
[CVE-2016-2178]
A remote attacker may cause a DTLS server to exhaust memory, resulting in a
Denial of Service. [CVE-2016-2179]
A remote attacker who can send DTLS records can cause the server to drop all
subsequent packets for a specific connection. [CVE-2016-2181]
A remote attacker can, in theory, cause OOB reads if the server enabled client
authentication. [CVE-2016-6306]
IV. Workaround
No workaround is available.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Restart all daemons that use the library, or reboot the system.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
Restart all daemons that use the library, or reboot the system.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 10.3]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.3.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.3.patch.asc
# gpg --verify openssl-10.3.patch.asc
[FreeBSD 10.1 and 10.2]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.2.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-10.2.patch.as
# gpg --verify openssl-10.2.patch.asc
[FreeBSD 9.3]
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-9.3.patch
# fetch https://security.FreeBSD.org/patches/SA-16:26/openssl-9.3.patch.as
# gpg --verify openssl-9.3.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all daemons that use the library, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r306229
releng/9.3/ r206230
stable/10/ r306196
releng/10.1/ r206230
releng/10.2/ r206230
releng/10.3/ r206230
stable/11/ r306195
releng/11.0/ r306198
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://www.openssl.org/news/secadv/20160922.txt>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2178>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2179>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2180>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2181>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2182>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6302>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6303>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6304>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6306>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.13 (FreeBSD)
iQIcBAEBCgAGBQJX5N+CAAoJEO1n7NZdz2rnRZEP/2/fe1c3tLZZAPguwphI7NFK
DoGODy5Uj/pMdMv2ZvSJaNFKX5bo4ph2mCtA3rxFhFX4PEDaRoZc4BIlN470qdDe
soBV0mJEHC8r0z8cw6WYbh4wbd2yYy2x95LFi3g/04udctGQyxWmEzkzjzT8SqxU
EMoZYZuYQTvr8paQGiUizLu61AFDM2sZhU8yW4euxxiIREbFTO8rC7DMAk3mKfNk
Og1NN6uVK7+AgxZRJtfrKPftdwGPfKPQKgR731goAghQihThNNDvQ8OdDwj8Mlh1
KI8u+GaVKUTfgS2Ra9a291nEqV0EHZkY3zSpp4LeCY93gpFQeEhS5M/32oFheP4+
qNQZdvDzKVBKT1NTzgDbMN++56/h0FDa9NkIQbZI9TwkOTbLeGNMWtC46Ngza3tz
avlSxxckCwelvmZcjntU3MakdWQhIgMRFvOzVDgfL+erUi3kot0+kgiXq+cn0UEa
ZHOCJWIzAh/PJGPNOJl71Ji3qb6iUJx31HmVLxyoofbfKmNsg72/ROqUgBLCYO3s
kW77yMNYEBAzdxeep8oNwMat9bZbxnhvAbr2v934SIndLQ5FtDJ/OdiCq3oXMbyE
uLFTjqGaTur7z26bibT72l4OEy7Qkt5G1EqefxTGHpY0UQhjQQVFWjwbFYq9RT40
60v4DC15ArshCN6tuyWt
=8wR6
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Subscribe to:
Posts (Atom)