RHSA-2015:2617: Moderate: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)and Transport Layer Security (TLS v1) protocols, as well as afull-strength, general purpose cryptography library.A NULL pointer derefernce flaw was found in the way OpenSSL verifiedsignatures using the RSA PSS algorithm. A remote attacked could possiblyuse this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL serverusing OpenSSL if it enabled client authentication. (CVE-2015-3194)A memory leak vulnerability was found in the way OpenSSL parsed PKCS#7 andCMS data. A remote attacker could use this flaw to cause an applicationthat parses PKCS#7 or CMS data from untrusted sources to use an excessiveamount of memory and possibly crash. (CVE-2015-3195)A race condition flaw, leading to a double free, was found in the wayOpenSSL handled pre-shared key (PSK) identify hints. A remote attackercould use this flaw to crash a multi-threaded SSL/TLS client usingOpenSSL. (CVE-2015-3196)All openssl users are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues. For the update to takeeffect, all services linked to the OpenSSL library must be restarted, orthe system rebooted.