[ MDVSA-2012:060 ] openssl

[security@xxxxxxxxxxxx]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2012:060
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : openssl
 Date    : April 19, 2012
 Affected: 2010.1, 2011., Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A potentially exploitable vulnerability has been discovered in
 the OpenSSL function asn1_d2i_read_bio that affects S/MIME or CMS
 applications using the built in MIME parser SMIME_read_PKCS7 or
 SMIME_read_CMS (CVE-2012-2110).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110
 http://www.openssl.org/news/secadv_20120419.txt
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2010.1:
 dd02ccb47f1f0186ea2666bf4e4ea654  
2010.1/i586/libopenssl0.9.8-0.9.8v-0.1mdv2010.2.i586.rpm
 940f8619817517593c39d32393a72a9b  
2010.1/i586/libopenssl1.0.0-1.0.0a-1.12mdv2010.2.i586.rpm
 7171b24070750b1c5d35a48fbe130c6f  
2010.1/i586/libopenssl1.0.0-devel-1.0.0a-1.12mdv2010.2.i586.rpm
 f86dae4d6a6c4f9cc655ac6f2d05c54b  
2010.1/i586/libopenssl1.0.0-static-devel-1.0.0a-1.12mdv2010.2.i586.rpm
 ec1a0346e0c59450ae7e61ae4fadfda3  
2010.1/i586/libopenssl-engines1.0.0-1.0.0a-1.12mdv2010.2.i586.rpm
 b21a278ec7e4bc417fa687232f3eee54  
2010.1/i586/openssl-1.0.0a-1.12mdv2010.2.i586.rpm 
 618ce5827a69c42704c138605b35f304  
2010.1/SRPMS/openssl0.9.8-0.9.8v-0.1mdv2010.2.src.rpm
 50465c31c0741ce8ad33bbf9b939c1b1  
2010.1/SRPMS/openssl-1.0.0a-1.12mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 991ff30ceb5425c7067f2630210fc36b  
2010.1/x86_64/lib64openssl0.9.8-0.9.8v-0.1mdv2010.2.x86_64.rpm
 48334a9b4c9ba24b179fe61a3bcc9da6  
2010.1/x86_64/lib64openssl1.0.0-1.0.0a-1.12mdv2010.2.x86_64.rpm
 0608076c3867169789918249361c9d2c  
2010.1/x86_64/lib64openssl1.0.0-devel-1.0.0a-1.12mdv2010.2.x86_64.rpm
 4ab52b125e9f1ab109666e3f3b7bbb32  
2010.1/x86_64/lib64openssl1.0.0-static-devel-1.0.0a-1.12mdv2010.2.x86_64.rpm
 bcc1ac795db80d77b5b62fdc3a7dacb8  
2010.1/x86_64/lib64openssl-engines1.0.0-1.0.0a-1.12mdv2010.2.x86_64.rpm
 6ec558667fd46a6f861c86edc373c6bf  
2010.1/x86_64/openssl-1.0.0a-1.12mdv2010.2.x86_64.rpm 
 618ce5827a69c42704c138605b35f304  
2010.1/SRPMS/openssl0.9.8-0.9.8v-0.1mdv2010.2.src.rpm
 50465c31c0741ce8ad33bbf9b939c1b1  
2010.1/SRPMS/openssl-1.0.0a-1.12mdv2010.2.src.rpm

 Mandriva Linux 2011:
 5c4d2ebd62ca4902c33af45f142ac4dc  
2011/i586/libopenssl1.0.0-1.0.0d-2.5-mdv2011.0.i586.rpm
 74097913bf7d112bb302088111e7c47b  
2011/i586/libopenssl-devel-1.0.0d-2.5-mdv2011.0.i586.rpm
 60710d4654f43babebdda414b64b7c7d  
2011/i586/libopenssl-engines1.0.0-1.0.0d-2.5-mdv2011.0.i586.rpm
 602fa24f9bd89b71a15a6d437e5c3762  
2011/i586/libopenssl-static-devel-1.0.0d-2.5-mdv2011.0.i586.rpm
 75a5f322268efc20031cde19d3ce4804  
2011/i586/openssl-1.0.0d-2.5-mdv2011.0.i586.rpm 
 04e221404fd3441d5ab719d5b169c19f  2011/SRPMS/openssl-1.0.0d-2.5.src.rpm

 Mandriva Linux 2011/X86_64:
 b9779bda3c7c7174aa4ee7242c29eddb  
2011/x86_64/lib64openssl1.0.0-1.0.0d-2.5-mdv2011.0.x86_64.rpm
 f2791c8922745026f6dfeb6e835ce7c0  
2011/x86_64/lib64openssl-devel-1.0.0d-2.5-mdv2011.0.x86_64.rpm
 3c6c071feb4c4ca40d7e8d00bd408b0a  
2011/x86_64/lib64openssl-engines1.0.0-1.0.0d-2.5-mdv2011.0.x86_64.rpm
 906899fe11101597cd8dc57432c6e170  
2011/x86_64/lib64openssl-static-devel-1.0.0d-2.5-mdv2011.0.x86_64.rpm
 f7fa3a9643589b5c19e597333d2f82ab  
2011/x86_64/openssl-1.0.0d-2.5-mdv2011.0.x86_64.rpm 
 04e221404fd3441d5ab719d5b169c19f  2011/SRPMS/openssl-1.0.0d-2.5.src.rpm

 Mandriva Enterprise Server 5:
 02bd37190274c5146ccc957104749720  
mes5/i586/libopenssl0.9.8-0.9.8h-3.15mdvmes5.2.i586.rpm
 bc32691d48e647fb522cbd81acb24b20  
mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.15mdvmes5.2.i586.rpm
 af5ef21840a2131584c89aec4fd9380d  
mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.15mdvmes5.2.i586.rpm
 29483c4c2d15d04fbcc8a0dc549c3ec4  
mes5/i586/openssl-0.9.8h-3.15mdvmes5.2.i586.rpm 
 a4f69e6f2f298491331a63518680e95d  
mes5/SRPMS/openssl-0.9.8h-3.15mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 e071c6df557f30b89a50e1c75d3548ed  
mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.15mdvmes5.2.x86_64.rpm
 b2844aa38800d9235144ebd806990882  
mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.15mdvmes5.2.x86_64.rpm
 d47106ae69b84af2ea0e907c5df1d7c0  
mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.15mdvmes5.2.x86_64.rpm
 8f908ac5cabbc0bbde9773dd44f00bbf  
mes5/x86_64/openssl-0.9.8h-3.15mdvmes5.2.x86_64.rpm 
 a4f69e6f2f298491331a63518680e95d  
mes5/SRPMS/openssl-0.9.8h-3.15mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFPkCNimqjQ0CJFipgRAr50AJ9wbb2iVuOj/rxwTegLnt07UDFNmQCeKKm2
vm6/Cf6U06zk+5zICLcTIVA=
=EqO1
-----END PGP SIGNATURE-----