SUSE-SU-2014:0759-2: critical: Security update for OpenSSL

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID:    SUSE-SU-2014:0759-2
Rating:             critical
References:         #880891 
Cross-References:   CVE-2014-0221 CVE-2014-0224 CVE-2014-3470
                   
Affected Products:
                    SUSE Linux Enterprise Server 10 SP4 LTSS
                    SUSE Linux Enterprise Server 10 SP3 LTSS
______________________________________________________________________________

   An update that fixes three vulnerabilities is now available.

Description:


   OpenSSL was updated to fix the following security vulnerabilities:

       * SSL/TLS MITM vulnerability. (CVE-2014-0224)
       * DTLS recursion flaw. (CVE-2014-0221)
       * Anonymous ECDH denial of service. (CVE-2014-3470)

   Further information can be found at
   http://www.openssl.org/news/secadv_20140605.txt
   <http://www.openssl.org/news/secadv_20140605.txt> .

   Security Issues references:

       * CVE-2014-0224
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224>
       * CVE-2014-0221
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221>
       * CVE-2014-3470
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470>



Package List:

   - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64):

      openssl-0.9.8a-18.82.4
      openssl-devel-0.9.8a-18.82.4
      openssl-doc-0.9.8a-18.82.4

   - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64):

      openssl-32bit-0.9.8a-18.82.4
      openssl-devel-32bit-0.9.8a-18.82.4

   - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64):

      openssl-0.9.8a-18.45.77.1
      openssl-devel-0.9.8a-18.45.77.1
      openssl-doc-0.9.8a-18.45.77.1

   - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64):

      openssl-32bit-0.9.8a-18.45.77.1
      openssl-devel-32bit-0.9.8a-18.45.77.1


References:

   http://support.novell.com/security/cve/CVE-2014-0221.html
   http://support.novell.com/security/cve/CVE-2014-0224.html
   http://support.novell.com/security/cve/CVE-2014-3470.html
   https://bugzilla.novell.com/880891
   http://download.suse.com/patch/finder/?keywords=06090ed98c412d84909da7f988402089
   http://download.suse.com/patch/finder/?keywords=ae77e66ba2a03bee961e56bc2d1daee6