USN-522-1: openssl vulnerabilities
28 September 2007
openssl vulnerabilities
Releases
Packages
- openssl -
Details
It was discovered that OpenSSL did not correctly perform Montgomery
multiplications. Local attackers might be able to reconstruct RSA
private keys by examining another user's OpenSSL processes. (CVE-2007-3108)
Moritz Jodeit discovered that OpenSSL's SSL_get_shared_ciphers function
did not correctly check the size of the buffer it was writing to.
A remote attacker could exploit this to write one NULL byte past the end of
an application's cipher list buffer, possibly leading to arbitrary code
execution or a denial of service. (CVE-2007-5135)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 7.04
Ubuntu 6.10
Ubuntu 6.06
After a standard system upgrade you need to reboot your computer to
effect the necessary changes.