<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for openssl</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2016:0641-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2016-03-03T11:02:43Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2016-03-03T11:02:43Z</InitialReleaseDate>
    <CurrentReleaseDate>2016-03-03T11:02:43Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for openssl</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">
This update for compat-openssl098 fixes various security issues and bugs: 

Security issues fixed:
- CVE-2016-0800 aka the 'DROWN' attack (bsc#968046):
  OpenSSL was vulnerable to a cross-protocol attack that could lead to
  decryption of TLS sessions by using a server supporting SSLv2 and
  EXPORT cipher suites as a Bleichenbacher RSA padding oracle.

  This update changes the openssl library to:

  * Disable SSLv2 protocol support by default.

    This can be overridden by setting the environment variable
    'OPENSSL_ALLOW_SSL2' or by using SSL_CTX_clear_options using the
    SSL_OP_NO_SSLv2 flag.

    Note that various services and clients had already disabled SSL
    protocol 2 by default previously.

  * Disable all weak EXPORT ciphers by default. These can be reenabled
    if required by old legacy software using the environment variable
    'OPENSSL_ALLOW_EXPORT'.

- CVE-2016-0797 (bnc#968048):
  The BN_hex2bn() and BN_dec2bn() functions had a bug that could result
  in an attempt to de-reference a NULL pointer leading to crashes.
  This could have security consequences if these functions were ever
  called by user applications with large untrusted hex/decimal data. Also,
  internal usage of these functions in OpenSSL uses data from config files
  or application command line arguments. If user developed applications
  generated config file data based on untrusted data, then this could
  have had security consequences as well.

- CVE-2016-0799 (bnc#968374)
  On many 64 bit systems, the internal fmtstr() and doapr_outch()
  functions could miscalculate the length of a string and attempt to
  access out-of-bounds memory locations. These problems could have
  enabled attacks where large amounts of untrusted data is passed to
  the BIO_*printf functions. If applications use these functions in
  this way then they could have been vulnerable. OpenSSL itself uses
  these functions when printing out human-readable dumps of ASN.1
  data. Therefore applications that print this data could have been
  vulnerable if the data is from untrusted sources. OpenSSL command line
  applications could also have been vulnerable when they print out ASN.1
  data, or if untrusted data is passed as command line arguments. Libssl
  is not considered directly vulnerable.

- CVE-2015-3197 (bsc#963415):
  The SSLv2 protocol did not block disabled ciphers.

Note that the March 1st 2016 release also references following CVEs
that were fixed by us with CVE-2015-0293 in 2015:

- CVE-2016-0703 (bsc#968051): This issue only affected versions of
  OpenSSL prior to March 19th 2015 at which time the code was refactored
  to address vulnerability CVE-2015-0293. It would have made the above
  'DROWN' attack much easier.
- CVE-2016-0704 (bsc#968053): 'Bleichenbacher oracle in SSLv2'
  This issue only affected versions of OpenSSL prior to March 19th
  2015 at which time the code was refactored to address vulnerability
  CVE-2015-0293. It would have made the above 'DROWN' attack much easier.

Also fixes the following bug:
- Avoid running OPENSSL_config twice. This avoids breaking
  engine loading and also fixes a memory leak in libssl. (bsc#952871)
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-DESKTOP-12-2016-367,SUSE-SLE-DESKTOP-12-SP1-2016-367,SUSE-SLE-Module-Legacy-12-2016-367,SUSE-SLE-SAP-12-SP1-2016-367</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20160641-1/</URL>
      <Description>Link for SUSE-SU-2016:0641-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2016-March/001911.html</URL>
      <Description>E-Mail link for SUSE-SU-2016:0641-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/952871</URL>
      <Description>SUSE Bug 952871</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/963415</URL>
      <Description>SUSE Bug 963415</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/968046</URL>
      <Description>SUSE Bug 968046</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/968048</URL>
      <Description>SUSE Bug 968048</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/968051</URL>
      <Description>SUSE Bug 968051</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/968053</URL>
      <Description>SUSE Bug 968053</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/968374</URL>
      <Description>SUSE Bug 968374</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2015-3197/</URL>
      <Description>SUSE CVE CVE-2015-3197 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-0702/</URL>
      <Description>SUSE CVE CVE-2016-0702 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-0703/</URL>
      <Description>SUSE CVE CVE-2016-0703 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-0704/</URL>
      <Description>SUSE CVE CVE-2016-0704 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-0797/</URL>
      <Description>SUSE CVE CVE-2016-0797 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-0799/</URL>
      <Description>SUSE CVE CVE-2016-0799 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-0800/</URL>
      <Description>SUSE CVE CVE-2016-0800 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Desktop 12">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Desktop 12">
        <FullProductName ProductID="SUSE Linux Enterprise Desktop 12" CPE="cpe:/o:suse:sled:12">SUSE Linux Enterprise Desktop 12</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Desktop 12 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Desktop 12 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Desktop 12 SP1" CPE="cpe:/o:suse:sled:12:sp1">SUSE Linux Enterprise Desktop 12 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Legacy 12">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Legacy 12">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Legacy 12" CPE="cpe:/o:suse:sle-module-legacy:12">SUSE Linux Enterprise Module for Legacy 12</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1" CPE="cpe:/o:suse:sles_sap:12:sp1">SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libopenssl0_9_8-0.9.8j-94.1">
      <FullProductName ProductID="libopenssl0_9_8-0.9.8j-94.1">libopenssl0_9_8-0.9.8j-94.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libopenssl0_9_8-32bit-0.9.8j-94.1">
      <FullProductName ProductID="libopenssl0_9_8-32bit-0.9.8j-94.1">libopenssl0_9_8-32bit-0.9.8j-94.1</FullProductName>
    </Branch>
    <Relationship ProductReference="libopenssl0_9_8-0.9.8j-94.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 12">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-94.1">libopenssl0_9_8-0.9.8j-94.1 as a component of SUSE Linux Enterprise Desktop 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="libopenssl0_9_8-32bit-0.9.8j-94.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 12">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-94.1">libopenssl0_9_8-32bit-0.9.8j-94.1 as a component of SUSE Linux Enterprise Desktop 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="libopenssl0_9_8-0.9.8j-94.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-94.1">libopenssl0_9_8-0.9.8j-94.1 as a component of SUSE Linux Enterprise Desktop 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="libopenssl0_9_8-32bit-0.9.8j-94.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-94.1">libopenssl0_9_8-32bit-0.9.8j-94.1 as a component of SUSE Linux Enterprise Desktop 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="libopenssl0_9_8-0.9.8j-94.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Legacy 12">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-94.1">libopenssl0_9_8-0.9.8j-94.1 as a component of SUSE Linux Enterprise Module for Legacy 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="libopenssl0_9_8-32bit-0.9.8j-94.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Legacy 12">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-94.1">libopenssl0_9_8-32bit-0.9.8j-94.1 as a component of SUSE Linux Enterprise Module for Legacy 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="libopenssl0_9_8-0.9.8j-94.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-94.1">libopenssl0_9_8-0.9.8j-94.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.</Note>
    </Notes>
    <CVE>CVE-2015-3197</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20160641-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-3197.html</URL>
        <Description>CVE-2015-3197</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/963410</URL>
        <Description>SUSE Bug 963410</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/963415</URL>
        <Description>SUSE Bug 963415</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968044</URL>
        <Description>SUSE Bug 968044</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968046</URL>
        <Description>SUSE Bug 968046</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.</Note>
    </Notes>
    <CVE>CVE-2016-0702</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>1.9</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20160641-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-0702.html</URL>
        <Description>CVE-2016-0702</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1007806</URL>
        <Description>SUSE Bug 1007806</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968044</URL>
        <Description>SUSE Bug 968044</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968050</URL>
        <Description>SUSE Bug 968050</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/971238</URL>
        <Description>SUSE Bug 971238</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/990370</URL>
        <Description>SUSE Bug 990370</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.</Note>
    </Notes>
    <CVE>CVE-2016-0703</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20160641-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-0703.html</URL>
        <Description>CVE-2016-0703</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968044</URL>
        <Description>SUSE Bug 968044</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968046</URL>
        <Description>SUSE Bug 968046</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968051</URL>
        <Description>SUSE Bug 968051</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/986238</URL>
        <Description>SUSE Bug 986238</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.</Note>
    </Notes>
    <CVE>CVE-2016-0704</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20160641-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-0704.html</URL>
        <Description>CVE-2016-0704</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968044</URL>
        <Description>SUSE Bug 968044</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968053</URL>
        <Description>SUSE Bug 968053</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/986238</URL>
        <Description>SUSE Bug 986238</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.</Note>
    </Notes>
    <CVE>CVE-2016-0797</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20160641-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-0797.html</URL>
        <Description>CVE-2016-0797</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968044</URL>
        <Description>SUSE Bug 968044</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968048</URL>
        <Description>SUSE Bug 968048</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/990370</URL>
        <Description>SUSE Bug 990370</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.</Note>
    </Notes>
    <CVE>CVE-2016-0799</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.6</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20160641-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-0799.html</URL>
        <Description>CVE-2016-0799</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968044</URL>
        <Description>SUSE Bug 968044</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968374</URL>
        <Description>SUSE Bug 968374</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/969517</URL>
        <Description>SUSE Bug 969517</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/989345</URL>
        <Description>SUSE Bug 989345</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/990370</URL>
        <Description>SUSE Bug 990370</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/991722</URL>
        <Description>SUSE Bug 991722</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="7">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.</Note>
    </Notes>
    <CVE>CVE-2016-0800</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-94.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-94.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20160641-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-0800.html</URL>
        <Description>CVE-2016-0800</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1106871</URL>
        <Description>SUSE Bug 1106871</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/961377</URL>
        <Description>SUSE Bug 961377</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968044</URL>
        <Description>SUSE Bug 968044</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968046</URL>
        <Description>SUSE Bug 968046</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/968888</URL>
        <Description>SUSE Bug 968888</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/969591</URL>
        <Description>SUSE Bug 969591</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/979060</URL>
        <Description>SUSE Bug 979060</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
