CVE-2016-0799

Upstream information

CVE-2016-0799 at MITRE

Description

The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
	National Vulnerability Database	SUSE
Base Score	10	2.6
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C	AV:N/AC:H/Au:N/C:N/I:N/A:P
Access Vector	Network	Network
Access Complexity	Low	High
Authentication	None	None
Confidentiality Impact	Complete	None
Integrity Impact	Complete	None
Availability Impact	Complete	Partial

CVSS v3 Scores
	National Vulnerability Database
Base Score	9.8
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Access Vector	Network
Access Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3

SUSE Bugzilla entries: 968044 [RESOLVED / FIXED], 968374 [RESOLVED / FIXED], 969517 [RESOLVED / FIXED], 989345 [RESOLVED / FIXED], 990370 [RESOLVED / FIXED], 991722 [RESOLVED / FIXED]

SUSE Security Advisories:

SUSE-SU-2016:0617-1, published Tue, 1 Mar 2016 18:12:06 +0100 (CET)
SUSE-SU-2016:0620-1, published Tue, 1 Mar 2016 18:16:02 +0100 (CET)
SUSE-SU-2016:0621-1, published Tue, 1 Mar 2016 18:19:06 +0100 (CET)
SUSE-SU-2016:0624-1, published Tue, 1 Mar 2016 19:12:02 +0100 (CET)
SUSE-SU-2016:0631-1, published Wed, 2 Mar 2016 18:12:06 +0100 (CET)
SUSE-SU-2016:0641-1, published Thu, 3 Mar 2016 15:11:31 +0100 (CET)
SUSE-SU-2016:0678-1, published Mon, 7 Mar 2016 18:13:37 +0100 (CET)
SUSE-SU-2016:0748-1, published Mon, 14 Mar 2016 18:13:37 +0100 (CET)
SUSE-SU-2016:0778-1, published Tue, 15 Mar 2016 21:11:47 +0100 (CET)
SUSE-SU-2016:0786-1, published Wed, 16 Mar 2016 15:28:52 +0100 (CET)
SUSE-SU-2016:1057-1, published Fri, 15 Apr 2016 21:09:44 +0200 (CEST)
openSUSE-SU-2016:0627-1, published Wed, 2 Mar 2016 12:11:42 +0100 (CET)
openSUSE-SU-2016:0628-1, published Wed, 2 Mar 2016 14:11:45 +0100 (CET)
openSUSE-SU-2016:0637-1, published Wed, 2 Mar 2016 23:12:04 +0100 (CET)
openSUSE-SU-2016:0640-1, published Thu, 3 Mar 2016 14:11:44 +0100 (CET)
openSUSE-SU-2016:0720-1, published Fri, 11 Mar 2016 14:14:22 +0100 (CET)
openSUSE-SU-2016:1239-1, published Thu, 5 May 2016 13:09:43 +0200 (CEST)
openSUSE-SU-2016:1241-1, published Thu, 5 May 2016 13:12:11 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 11 SP4	`compat-openssl097g >= 0.9.7g-146.22.41.1` `compat-openssl097g-32bit >= 0.9.7g-146.22.41.1` `libopenssl0_9_8 >= 0.9.8j-0.89.1` `libopenssl0_9_8-32bit >= 0.9.8j-0.89.1` `openssl >= 0.9.8j-0.89.1`	Patchnames: sledsp4-compat-openssl097g-12436 sledsp4-openssl-12434
SUSE Linux Enterprise Desktop 12 SP1	`libopenssl0_9_8 >= 0.9.8j-94.1` `libopenssl0_9_8-32bit >= 0.9.8j-94.1` `libopenssl1_0_0 >= 1.0.1i-44.1` `libopenssl1_0_0-32bit >= 1.0.1i-44.1` `openssl >= 1.0.1i-44.1`	Patchnames: SUSE-SLE-DESKTOP-12-SP1-2016-353 SUSE-SLE-DESKTOP-12-SP1-2016-367
SUSE Linux Enterprise Desktop 12 SP2	`libopenssl-devel >= 1.0.2j-55.1` `libopenssl0_9_8 >= 0.9.8j-102.1` `libopenssl0_9_8-32bit >= 0.9.8j-102.1` `libopenssl1_0_0 >= 1.0.2j-55.1` `libopenssl1_0_0-32bit >= 1.0.2j-55.1` `openssl >= 1.0.2j-55.1`
SUSE Linux Enterprise Desktop 12 SP3	`libopenssl-devel >= 1.0.2j-59.1` `libopenssl0_9_8 >= 0.9.8j-105.1` `libopenssl0_9_8-32bit >= 0.9.8j-105.1` `libopenssl1_0_0 >= 1.0.2j-59.1` `libopenssl1_0_0-32bit >= 1.0.2j-59.1` `openssl >= 1.0.2j-59.1`
SUSE Linux Enterprise Desktop 12 SP4	`libopenssl-1_0_0-devel >= 1.0.2p-2.11` `libopenssl0_9_8 >= 0.9.8j-106.6.1` `libopenssl0_9_8-32bit >= 0.9.8j-106.6.1` `libopenssl1_0_0 >= 1.0.2p-2.11` `libopenssl1_0_0-32bit >= 1.0.2p-2.11` `openssl-1_0_0 >= 1.0.2p-2.11`
SUSE Linux Enterprise Desktop 12	`libopenssl0_9_8 >= 0.9.8j-94.1` `libopenssl0_9_8-32bit >= 0.9.8j-94.1` `libopenssl1_0_0 >= 1.0.1i-27.13.1` `libopenssl1_0_0-32bit >= 1.0.1i-27.13.1` `openssl >= 1.0.1i-27.13.1`	Patchnames: SUSE-SLE-DESKTOP-12-2016-352 SUSE-SLE-DESKTOP-12-2016-367
SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP5	`libopenssl-1_0_0-devel >= 1.0.2p-3.11.1` `libopenssl1_0_0 >= 1.0.2p-3.11.1` `libopenssl1_0_0-32bit >= 1.0.2p-3.11.1` `libopenssl1_0_0-hmac >= 1.0.2p-3.11.1` `libopenssl1_0_0-hmac-32bit >= 1.0.2p-3.11.1` `openssl-1_0_0 >= 1.0.2p-3.11.1` `openssl-1_0_0-doc >= 1.0.2p-3.11.1`
SUSE Linux Enterprise Module for Containers 12	`sles11sp4-docker-image >= 1.1.1-20160304104143` `sles12-docker-image >= 1.1.1-20160307082632` `sles12sp1-docker-image >= 1.0.4-20160308171022`	Patchnames: SUSE-SLE-Module-Containers-12-2016-440 SUSE-SLE-Module-Containers-12-2016-457 SUSE-SLE-Module-Containers-12-2016-459
SUSE Linux Enterprise Module for Legacy 12	`libopenssl0_9_8 >= 0.9.8j-94.1` `libopenssl0_9_8-32bit >= 0.9.8j-94.1`	Patchnames: SUSE-SLE-Module-Legacy-12-2016-367
SUSE Linux Enterprise Server 11 SP2-LTSS	`libopenssl-devel >= 0.9.8j-0.89.1` `libopenssl0_9_8 >= 0.9.8j-0.89.1` `libopenssl0_9_8-32bit >= 0.9.8j-0.89.1` `libopenssl0_9_8-hmac >= 0.9.8j-0.89.1` `libopenssl0_9_8-hmac-32bit >= 0.9.8j-0.89.1` `openssl >= 0.9.8j-0.89.1` `openssl-doc >= 0.9.8j-0.89.1`	Patchnames: slessp2-openssl-12434
SUSE Linux Enterprise Server 11 SP3-LTSS	`libopenssl0_9_8 >= 0.9.8j-0.89.1` `libopenssl0_9_8-32bit >= 0.9.8j-0.89.1` `libopenssl0_9_8-hmac >= 0.9.8j-0.89.1` `libopenssl0_9_8-hmac-32bit >= 0.9.8j-0.89.1` `openssl >= 0.9.8j-0.89.1` `openssl-doc >= 0.9.8j-0.89.1`	Patchnames: slessp3-openssl-12434
SUSE Linux Enterprise Server 11 SP4	`libopenssl0_9_8 >= 0.9.8j-0.89.1` `libopenssl0_9_8-32bit >= 0.9.8j-0.89.1` `libopenssl0_9_8-hmac >= 0.9.8j-0.89.1` `libopenssl0_9_8-hmac-32bit >= 0.9.8j-0.89.1` `libopenssl0_9_8-x86 >= 0.9.8j-0.89.1` `openssl >= 0.9.8j-0.89.1` `openssl-doc >= 0.9.8j-0.89.1`	Patchnames: slessp4-openssl-12434
SUSE Linux Enterprise Server 11-SECURITY	`libopenssl1-devel >= 1.0.1g-0.40.1` `libopenssl1_0_0 >= 1.0.1g-0.40.1` `libopenssl1_0_0-32bit >= 1.0.1g-0.40.1` `libopenssl1_0_0-x86 >= 1.0.1g-0.40.1` `openssl1 >= 1.0.1g-0.40.1` `openssl1-doc >= 1.0.1g-0.40.1`	Patchnames: secsp3-openssl1-12429
SUSE Linux Enterprise Server 12 SP1	`libopenssl1_0_0 >= 1.0.1i-44.1` `libopenssl1_0_0-32bit >= 1.0.1i-44.1` `libopenssl1_0_0-hmac >= 1.0.1i-44.1` `libopenssl1_0_0-hmac-32bit >= 1.0.1i-44.1` `openssl >= 1.0.1i-44.1` `openssl-doc >= 1.0.1i-44.1`	Patchnames: SUSE-SLE-SERVER-12-SP1-2016-353
SUSE Linux Enterprise Server 12 SP2	`libopenssl-devel >= 1.0.2j-55.1` `libopenssl1_0_0 >= 1.0.2j-55.1` `libopenssl1_0_0-32bit >= 1.0.2j-55.1` `libopenssl1_0_0-hmac >= 1.0.2j-55.1` `libopenssl1_0_0-hmac-32bit >= 1.0.2j-55.1` `openssl >= 1.0.2j-55.1` `openssl-doc >= 1.0.2j-55.1`
SUSE Linux Enterprise Server 12 SP3	`libopenssl-devel >= 1.0.2j-59.1` `libopenssl1_0_0 >= 1.0.2j-59.1` `libopenssl1_0_0-32bit >= 1.0.2j-59.1` `libopenssl1_0_0-hmac >= 1.0.2j-59.1` `libopenssl1_0_0-hmac-32bit >= 1.0.2j-59.1` `openssl >= 1.0.2j-59.1` `openssl-doc >= 1.0.2j-59.1`
SUSE Linux Enterprise Server 12 SP4	`libopenssl-1_0_0-devel >= 1.0.2p-2.11` `libopenssl1_0_0 >= 1.0.2p-2.11` `libopenssl1_0_0-32bit >= 1.0.2p-2.11` `libopenssl1_0_0-hmac >= 1.0.2p-2.11` `libopenssl1_0_0-hmac-32bit >= 1.0.2p-2.11` `openssl-1_0_0 >= 1.0.2p-2.11` `openssl-1_0_0-doc >= 1.0.2p-2.11`
SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12	`libopenssl1_0_0 >= 1.0.1i-27.13.1` `libopenssl1_0_0-32bit >= 1.0.1i-27.13.1` `libopenssl1_0_0-hmac >= 1.0.1i-27.13.1` `libopenssl1_0_0-hmac-32bit >= 1.0.1i-27.13.1` `openssl >= 1.0.1i-27.13.1` `openssl-doc >= 1.0.1i-27.13.1`	Patchnames: SUSE-SLE-SERVER-12-2016-352
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2	`libopenssl-devel >= 1.0.2j-55.1` `libopenssl1_0_0 >= 1.0.2j-55.1` `libopenssl1_0_0-hmac >= 1.0.2j-55.1` `openssl >= 1.0.2j-55.1` `openssl-doc >= 1.0.2j-55.1`
SUSE Linux Enterprise Server for SAP Applications 11 SP4	`compat-openssl097g >= 0.9.7g-146.22.41.1` `compat-openssl097g-32bit >= 0.9.7g-146.22.41.1` `libopenssl0_9_8 >= 0.9.8j-0.89.1` `libopenssl0_9_8-32bit >= 0.9.8j-0.89.1` `libopenssl0_9_8-hmac >= 0.9.8j-0.89.1` `libopenssl0_9_8-hmac-32bit >= 0.9.8j-0.89.1` `libopenssl0_9_8-x86 >= 0.9.8j-0.89.1` `openssl >= 0.9.8j-0.89.1` `openssl-doc >= 0.9.8j-0.89.1`	Patchnames: slesappsp4-compat-openssl097g-12436 slessp4-openssl-12434
SUSE Linux Enterprise Server for SAP Applications 12 SP1	`libopenssl0_9_8 >= 0.9.8j-94.1` `libopenssl1_0_0 >= 1.0.1i-44.1` `libopenssl1_0_0-32bit >= 1.0.1i-44.1` `libopenssl1_0_0-hmac >= 1.0.1i-44.1` `libopenssl1_0_0-hmac-32bit >= 1.0.1i-44.1` `openssl >= 1.0.1i-44.1` `openssl-doc >= 1.0.1i-44.1`	Patchnames: SUSE-SLE-SAP-12-SP1-2016-367 SUSE-SLE-SERVER-12-SP1-2016-353
SUSE Linux Enterprise Software Development Kit 11 SP4	`libopenssl-devel >= 0.9.8j-0.89.1`	Patchnames: sdksp4-openssl-12434
SUSE Linux Enterprise Software Development Kit 12 SP1	`libopenssl-devel >= 1.0.1i-44.1`	Patchnames: SUSE-SLE-SDK-12-SP1-2016-353
SUSE Linux Enterprise Software Development Kit 12 SP2	`libopenssl-devel >= 1.0.2j-55.1`
SUSE Linux Enterprise Software Development Kit 12 SP3	`libopenssl-devel >= 1.0.2j-59.1`
SUSE Linux Enterprise Software Development Kit 12 SP4	`libopenssl-1_0_0-devel >= 1.0.2p-2.11`
SUSE Linux Enterprise Software Development Kit 12 SP5	`libopenssl-1_0_0-devel >= 1.0.2p-3.11.1`
SUSE Linux Enterprise Software Development Kit 12	`libopenssl-devel >= 1.0.1i-27.13.1`	Patchnames: SUSE-SLE-SDK-12-2016-352
SUSE Manager 2.1	`libopenssl-devel >= 0.9.8j-0.91.1` `libopenssl0_9_8 >= 0.9.8j-0.91.1` `libopenssl0_9_8-32bit >= 0.9.8j-0.91.1` `libopenssl0_9_8-hmac >= 0.9.8j-0.91.1` `libopenssl0_9_8-hmac-32bit >= 0.9.8j-0.91.1` `openssl >= 0.9.8j-0.91.1` `openssl-doc >= 0.9.8j-0.91.1`	Patchnames: sleman21-openssl-12511
SUSE Manager Proxy 2.1	`libopenssl-devel >= 0.9.8j-0.91.1` `libopenssl0_9_8 >= 0.9.8j-0.91.1` `libopenssl0_9_8-32bit >= 0.9.8j-0.91.1` `libopenssl0_9_8-hmac >= 0.9.8j-0.91.1` `libopenssl0_9_8-hmac-32bit >= 0.9.8j-0.91.1` `openssl >= 0.9.8j-0.91.1` `openssl-doc >= 0.9.8j-0.91.1`	Patchnames: slemap21-openssl-12511
SUSE OpenStack Cloud 5	`libopenssl-devel >= 0.9.8j-0.91.1` `libopenssl0_9_8 >= 0.9.8j-0.91.1` `libopenssl0_9_8-32bit >= 0.9.8j-0.91.1` `libopenssl0_9_8-hmac >= 0.9.8j-0.91.1` `libopenssl0_9_8-hmac-32bit >= 0.9.8j-0.91.1` `openssl >= 0.9.8j-0.91.1` `openssl-doc >= 0.9.8j-0.91.1`	Patchnames: sleclo50sp3-openssl-12511
SUSE Studio Onsite 1.3	`libopenssl-devel >= 0.9.8j-0.89.1`	Patchnames: slestso13-openssl-12434

Status of this issue by product and package

Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification.

Product(s)	Source package	State
SLED-10-SP3	compat-openssl097g	Released
SLED-10-SP3	openssl	Released
SLED-10-SP4	compat-openssl097g	Released
SLED-10-SP4	openssl	Released
SLES for SAP Applications	compat-openssl097g	Released
SLES for SAP Applications	openssl	Released
SLES-10-SP3	compat-openssl097g	Released
SLES-10-SP3	openssl	Released
SLES-10-SP4	compat-openssl097g	Released
SLES-10-SP4	openssl	Released
SLES_LTSS-10-SP4	compat-openssl097g	Released
SLES_LTSS-10-SP4	openssl	Released
SUSE Linux Enterprise Desktop 11 SP1	compat-openssl097g	Released
SUSE Linux Enterprise Desktop 11 SP1	openssl	Released
SUSE Linux Enterprise Desktop 11 SP2	compat-openssl097g	Released
SUSE Linux Enterprise Desktop 11 SP2	openssl	Released
SUSE Linux Enterprise Desktop 11 SP3	compat-openssl097g	Released
SUSE Linux Enterprise Desktop 11 SP3	openssl	Released
SUSE Linux Enterprise Desktop 11 SP4	compat-openssl097g	Released
SUSE Linux Enterprise Desktop 11 SP4	openssl	Released
SUSE Linux Enterprise Desktop 12	compat-openssl098	Released
SUSE Linux Enterprise Desktop 12	openssl	Released
SUSE Linux Enterprise Desktop 12 SP1	compat-openssl098	Released
SUSE Linux Enterprise Desktop 12 SP1	openssl	Released
SUSE Linux Enterprise Enterprise Server 11 SP1 for SAP Enterprise Search	compat-openssl097g	Released
SUSE Linux Enterprise High Performance Computing 12 SP5	openssl	Already fixed
SUSE Linux Enterprise High Performance Computing 12 SP5	openssl-1_0_0	Already fixed
SUSE Linux Enterprise High Performance Computing 12 SP5	openssl-1_1	Already fixed
SUSE Linux Enterprise Module for Containers 12	sles12-docker-image	Released
SUSE Linux Enterprise Module for Containers 12	sles12sp1-docker-image	Released
SUSE Linux Enterprise Module for Legacy 12	compat-openssl098	Released
SUSE Linux Enterprise Point of Service 11 SP3	openssl	In progress
SUSE Linux Enterprise Server 11 SP1 LTSS	openssl	Released
SUSE Linux Enterprise Server 11 SP2	openssl	Released
SUSE Linux Enterprise Server 11 SP2 LTSS	openssl	Released
SUSE Linux Enterprise Server 11 SP2 for VMware	openssl	Released
SUSE Linux Enterprise Server 11 SP3	openssl	Released
SUSE Linux Enterprise Server 11 SP3 LTSS	openssl	Released
SUSE Linux Enterprise Server 11 SP3 for VMware	openssl	Released
SUSE Linux Enterprise Server 11 SP4	openssl	Released
SUSE Linux Enterprise Server 11 SP4 LTSS	openssl	In progress
SUSE Linux Enterprise Server 12	openssl	Released
SUSE Linux Enterprise Server 12 LTSS	openssl	Ignore
SUSE Linux Enterprise Server 12 SP1	openssl	Released
SUSE Linux Enterprise Server 12 SP4 ESPOS	openssl	Already fixed
SUSE Linux Enterprise Server 12 SP4 ESPOS	openssl-1_0_0	Already fixed
SUSE Linux Enterprise Server 12 SP4 ESPOS	openssl-1_1	Already fixed
SUSE Linux Enterprise Server 12 SP4 LTSS	openssl	Already fixed
SUSE Linux Enterprise Server 12 SP4 LTSS	openssl-1_0_0	Already fixed
SUSE Linux Enterprise Server 12 SP4 LTSS	openssl-1_1	Already fixed
SUSE Linux Enterprise Server 12 SP5	openssl	Already fixed
SUSE Linux Enterprise Server 12 SP5	openssl-1_0_0	Already fixed
SUSE Linux Enterprise Server 12 SP5	openssl-1_1	Already fixed
SUSE Linux Enterprise Server for SAP All-in-One 11 SP4	compat-openssl097g	Released
SUSE Linux Enterprise Server for SAP Applications 12 SP1	compat-openssl098	Released
SUSE Linux Enterprise Server for SAP Applications 12 SP2	compat-openssl098	Released
SUSE Linux Enterprise Server for SAP Applications 12 SP3	compat-openssl098	Released
SUSE Linux Enterprise Server for SAP Applications 12 SP4	compat-openssl098	Released
SUSE Linux Enterprise Server for SAP Applications 12 SP4	openssl	Already fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP4	openssl-1_0_0	Already fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP4	openssl-1_1	Already fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP5	compat-openssl098	Released
SUSE Linux Enterprise Server for SAP Applications 12 SP5	openssl	Already fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP5	openssl-1_0_0	Already fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP5	openssl-1_1	Already fixed
SUSE Linux Enterprise Server for SAP Business All-in-One 11 SP1	compat-openssl097g	Released
SUSE Linux Enterprise Software Development Kit 11 SP2	openssl	Released
SUSE Linux Enterprise Software Development Kit 11 SP3	openssl	Released
SUSE Linux Enterprise Software Development Kit 11 SP4	openssl	Released
SUSE Linux Enterprise Software Development Kit 12	openssl	Released
SUSE Linux Enterprise Software Development Kit 12 SP1	openssl	Released
SUSE Linux Enterprise Software Development Kit 12 SP5	openssl-1_1	Already fixed
SUSE OpenStack Cloud 9	openssl	Already fixed
SUSE OpenStack Cloud 9	openssl-1_0_0	Already fixed
SUSE OpenStack Cloud 9	openssl-1_1	Already fixed
SUSE OpenStack Cloud Crowbar 9	openssl	Already fixed
SUSE OpenStack Cloud Crowbar 9	openssl-1_0_0	Already fixed
SUSE OpenStack Cloud Crowbar 9	openssl-1_1	Already fixed
SUSE Studio Onsite 1.3	openssl	Released
Security Module for SUSE Linux Enterprise 11	openssl1	Released

CVE-2016-0799

Common Vulnerabilities and Exposures

Upstream information

Description

SUSE information

List of released packages

Status of this issue by product and package

SUSE Linux Enterprise

SUSE Rancher

Solutions

Industries

Support

Services

Resources

Partners

Communities

About