MGASA-2016-0338

Advisory lineage Upstream: 11 Downstream: 0
Published: 11 Oct 2016, 22:12
Last modified:16 Apr 2026, 06:25

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Oct 2016, 22:12
Published
Vulnerability first disclosed
16 Apr 2026, 06:25
Last Modified
Vulnerability information updated

Description

Updated openssl packages fix security vulnerabilities Guido Vranken discovered that OpenSSL uses undefined pointer arithmetic (CVE-2016-2177). Cesar Pereida, Billy Brumley and Yuval Yarom discovered a timing leak in the DSA code (CVE-2016-2178). Quan Luo and the OCAP audit team discovered denial of service vulnerabilities in DTLS (CVE-2016-2179, CVE-2016-2181). Shi Lei discovered an out-of-bounds memory read in TS_OBJ_print_bio() and an out-of-bounds write in BN_bn2dec() and MDC2_Update() (CVE-2016-2180, CVE-2016-2182, CVE-2016-6303). DES-based cipher suites are demoted from the HIGH group to MEDIUM as a mitigation for the SWEET32 attack (CVE-2016-2183). Shi Lei discovered that the use of SHA512 in TLS session tickets is susceptible to denial of service (CVE-2016-6302). Shi Lei discovered that excessively large OCSP status request may result in denial of service via memory exhaustion (CVE-2016-6304). Shi Lei discovered that missing message length validation when parsing certificates may potentially result in denial of service (CVE-2016-6306).

Affected Systems

  • mageia•openssl

    < 1.0.2j-1.mga5

References (4)