Advisories ยป MGASA-2016-0408

Updated virtualbox packages fixes security vulnerabilities

Publication date: 05 Dec 2016
Modification date: 17 Feb 2022
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-2177 , CVE-2016-2178 , CVE-2016-2179 , CVE-2016-2180 , CVE-2016-2181 , CVE-2016-2182 , CVE-2016-2183 , CVE-2016-5501 , CVE-2016-5538 , CVE-2016-5605 , CVE-2016-5608 , CVE-2016-5610 , CVE-2016-5611 , CVE-2016-5613 , CVE-2016-6302 , CVE-2016-6303 , CVE-2016-6304 , CVE-2016-6305 , CVE-2016-6306 , CVE-2016-6307 , CVE-2016-6308 , CVE-2016-6309 , CVE-2016-7052

Description

This update provides virtualbox 5.1.10 maintenance release and resolves
at least the following security issues:

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer
boundary checks, which might allow remote attackers to cause a denial of
service (integer overflow and application crash) or possibly have
unspecified other impact by leveraging unexpected malloc behavior, related
to s3_srvr.c, ssl_sess.c, and t1_lib.c (CVE-2016-2177).

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through
1.0.2h does not properly ensure the use of constant-time operations, which
makes it easier for local users to discover a DSA private key via a timing
side-channel attack (CVE-2016-2178).

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict
the lifetime of queue entries associated with unused out-of-order messages,
which allows remote attackers to cause a denial of service (memory
consumption) by maintaining many crafted DTLS sessions simultaneously,
related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c
(CVE-2016-2179).

The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key
Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through
1.0.2h allows remote attackers to cause a denial of service (out-of-bounds
read and application crash) via a crafted time-stamp file that is mishandled
by the "openssl ts" command (CVE-2016-2180).

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0
mishandles early use of a new epoch number in conjunction with a large
sequence number, which allows remote attackers to cause a denial of service
(false-positive packet drops) via spoofed DTLS records, related to
rec_layer_d1.c and ssl3_record.c (CVE-2016-2181).

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0
mishandles early use of a new epoch number in conjunction with a large
sequence number, which allows remote attackers to cause a denial of service
(false-positive packet drops) via spoofed DTLS records, related to
rec_layer_d1.c and ssl3_record.c (CVE-2016-2182).

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols
and other protocols and products, have a birthday bound of approximately
four billion blocks, which makes it easier for remote attackers to obtain
cleartext data via a birthday attack against a long-duration encrypted
session, as demonstrated by an HTTPS session using Triple DES in CBC mode,
aka a "Sweet32" attack (CVE-2016-2183).

Unspecified vulnerability in the Oracle VM VirtualBox component before
5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users
to affect confidentiality, integrity, and availability via vectors related
to Core, a different vulnerability than CVE-2016-5538 (CVE-2016-5501).

Unspecified vulnerability in the Oracle VM VirtualBox component before
5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users
to affect confidentiality, integrity, and availability via vectors related
to Core, a different vulnerability than CVE-2016-5501 (CVE-2016-5538).

Unspecified vulnerability in the Oracle VM VirtualBox component before 
5.1.4 in Oracle Virtualization allows remote attackers to affect
confidentiality and integrity via vectors related to VRDE (CVE-2016-5605).

Unspecified vulnerability in the Oracle VM VirtualBox component before
5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users
to affect availability via vectors related to Core, a different
vulnerability than CVE-2016-5613 (CVE-2016-5608).

Unspecified vulnerability in the Oracle VM VirtualBox component before
5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users
to affect confidentiality, integrity, and availability via vectors related
to Core (CVE-2016-5610, CVE-2016-5611)

Unspecified vulnerability in the Oracle VM VirtualBox component before
5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users
to affect availability via vectors related to Core, a different
vulnerability than CVE-2016-5608 (CVE-2016-5613).

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0
does not consider the HMAC size during validation of the ticket length,
which allows remote attackers to cause a denial of service via a ticket
that is too short (CVE-2016-6302).

Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c
in OpenSSL before 1.1.0 allows remote attackers to cause a denial of
service (out-of-bounds write and application crash) or possibly have
unspecified other impact via unknown vectors (CVE-2016-6303).

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before
1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial
of service (memory consumption) via large OCSP Status Request extensions
(CVE-2016-6304).

The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0
before 1.1.0a allows remote attackers to cause a denial of service
(infinite loop) by triggering a zero-length record in an SSL_peek call
(CVE-2016-6305).

The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i
might allow remote attackers to cause a denial of service (out-of-bounds
read) via crafted certificate operations, related to s3_clnt.c and
s3_srvr.c (CVE-2016-6306).

The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates
memory before checking for an excessive length, which might allow remote
attackers to cause a denial of service (memory consumption) via crafted
TLS messages, related to statem/statem.c and statem/statem_lib.c
(CVE-2016-6307).

statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before
1.1.0a allocates memory before checking for an excessive length, which
might allow remote attackers to cause a denial of service (memory
consumption) via crafted DTLS messages (CVE-2016-6308).

statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement
after a realloc call, which allows remote attackers to cause a denial of
service (use-after-free) or possibly execute arbitrary code via a crafted
TLS session (CVE-2016-6309).

crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause
a denial of service (NULL pointer dereference and application crash) by
triggering a CRL operation (CVE-2016-7052).

For other fixes in this update, read the referenced changelog.

References

SRPMS

5/core