[ MDVSA-2010:022 ] openssl

[dude67]

_______________________________________________________________________

Package : openssl
Date : January 21, 2010
Affected: 2008.0, 2009.0, 2009.1, 2010.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Some vulnerabilities were discovered and corrected in openssl:

Memory leak in the zlib_stateful_finish function in
crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta
through Beta 4 allows remote attackers to cause a denial of service
(memory consumption) via vectors that trigger incorrect calls to the
CRYPTO_free_all_ex_data function, as demonstrated by use of SSLv3
and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678
(CVE-2009-4355).

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.

The updated packages have been patched to correct thies issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-4355
_______________________________________________________________________