RHSA-2015:2616: Moderate: openssl security update
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)and Transport Layer Security (TLS v1) protocols, as well as afull-strength, general purpose cryptography library.A memory leak vulnerability was found in the way OpenSSL parsed PKCS#7 andCMS data. A remote attacker could use this flaw to cause an applicationthat parses PKCS#7 or CMS data from untrusted sources to use an excessiveamount of memory and possibly crash. (CVE-2015-3195)All openssl users are advised to upgrade to these updated packages, whichcontain a backported patch to correct this issue. For the update to takeeffect, all services linked to the OpenSSL library must be restarted, orthe system rebooted.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2015:2616?
The severity of RHSA-2015:2616 is classified as moderate.
How do I fix RHSA-2015:2616?
To fix RHSA-2015:2616, update OpenSSL to the version 0.9.8e-37.el5_11 or later.
What products are affected by RHSA-2015:2616?
The products affected by RHSA-2015:2616 include OpenSSL, OpenSSL-debug info, OpenSSL-devel, and OpenSSL-perl packages.
What type of issue is described in RHSA-2015:2616?
RHSA-2015:2616 describes a memory leak vulnerability in OpenSSL related to parsing PKCS#7 and CMS data.
When was the RHSA-2015:2616 vulnerability disclosed?
The RHSA-2015:2616 vulnerability was disclosed on December 3, 2015.