Updated OpenSSL and Perl packages are available for Debian:

[DSA 3500-1] openssl security update
[DSA 3501-1] perl security update

[DSA 3500-1] openssl security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3500-1 security@debian.org
https://www.debian.org/security/ Alessandro Ghedini
March 01, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : openssl
CVE ID : CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798
CVE-2016-0799

Several vulnerabilities were discovered in OpenSSL, a Secure Socket Layer
toolkit.

CVE-2016-0702

Yuval Yarom from the University of Adelaide and NICTA, Daniel Genkin
from Technion and Tel Aviv University, and Nadia Heninger from the
University of Pennsylvania discovered a side-channel attack which
makes use of cache-bank conflicts on the Intel Sandy-Bridge
microarchitecture. This could allow local attackers to recover RSA
private keys.

CVE-2016-0705

Adam Langley from Google discovered a double free bug when parsing
malformed DSA private keys. This could allow remote attackers to
cause a denial of service or memory corruption in applications
parsing DSA private keys received from untrusted sources.

CVE-2016-0797

Guido Vranken discovered an integer overflow in the BN_hex2bn and
BN_dec2bn functions that can lead to a NULL pointer dereference and
heap corruption. This could allow remote attackers to cause a denial
of service or memory corruption in applications processing hex or
dec data received from untrusted sources.

CVE-2016-0798

Emilia Käsper of the OpenSSL development team discovered a memory
leak in the SRP database lookup code. To mitigate the memory leak,
the seed handling in SRP_VBASE_get_by_user is now disabled even if
the user has configured a seed. Applications are advised to migrate
to the SRP_VBASE_get1_by_user function.

CVE-2016-0799

Guido Vranken discovered an integer overflow in the BIO_*printf
functions that could lead to an OOB read when printing very long
strings. Additionally the internal doapr_outch function can attempt
to write to an arbitrary memory location in the event of a memory
allocation failure. These issues will only occur on platforms where
sizeof(size_t) > sizeof(int) like many 64 bit systems. This could
allow remote attackers to cause a denial of service or memory
corruption in applications that pass large amounts of untrusted data
to the BIO_*printf functions.

Additionally the EXPORT and LOW ciphers were disabled since thay could
be used as part of the DROWN (CVE-2016-0800) and SLOTH (CVE-2015-7575)
attacks, but note that the oldstable (wheezye) and stable (jessie)
distributions are not affected by those attacks since the SSLv2 protocol
has already been dropped in the openssl package version 1.0.0c-2.

For the oldstable distribution (wheezy), these problems have been fixed
in version 1.0.1e-2+deb7u20.

For the stable distribution (jessie), these problems have been fixed in
version 1.0.1k-3+deb8u4.

For the unstable distribution (sid), these problems will be fixed shortly.

We recommend that you upgrade your openssl packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[DSA 3501-1] perl security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3501-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
March 01, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : perl
CVE ID : CVE-2016-2381

Stephane Chazelas discovered a bug in the environment handling in Perl.
Perl provides a Perl-space hash variable, %ENV, in which environment
variables can be looked up. If a variable appears twice in envp, only
the last value would appear in %ENV, but getenv would return the first.
Perl's taint security mechanism would be applied to the value in %ENV,
but not to the other rest of the environment. This could result in an
ambiguous environment causing environment variables to be propagated to
subprocesses, despite the protections supposedly offered by taint
checking.

With this update Perl changes the behavior to match the following:

a) %ENV is populated with the first environment variable, as getenv
would return.
b) Duplicate environment entries are removed.

For the oldstable distribution (wheezy), this problem has been fixed
in version 5.14.2-21+deb7u3.

For the stable distribution (jessie), this problem has been fixed in
version 5.20.2-3+deb8u4.

For the unstable distribution (sid), this problem will be fixed in
version 5.22.1-8.

We recommend that you upgrade your perl packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/