Every CVE Search/ Get API key

CVE-2016-2181

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use...

7.5 HighFix available

CVE-2016-2181 is a high vulnerability (CVSS 7.5) in Openssl, published September 16, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.6%, the 97th percentile. Fixed in openssl 1.0.2h-r4.

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

22.6%Up 15.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Record
CVE-2016-2181
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Record
CVE-2016-2181
Updated
2026-11-02
EUVDEUVD-2016-3266 No score

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Record
EUVD-2016-3266
Updated
2026-11-03
GitHub AdvisoriesGHSA-mpfh-46p6-w5g3 7.5

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use...

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Record
GHSA-mpfh-46p6-w5g3
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALPINE-CVE-2016-2181 7.5

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Record
ALPINE-CVE-2016-2181
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2016-2181 7.5

CVE-2016-2181 does not affect BellSoft software

Record
BELL-CVE-2016-2181
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 17 moreShow less
OSV 7.5

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Record
CVE-2016-2181
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-2181 7.5

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Record
DEBIAN-CVE-2016-2181
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2016:1940 7.5

Red Hat Security Advisory: openssl security update

Record
RHSA-2016:1940
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-2181 7.5

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Record
UBUNTU-CVE-2016-2181
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2016-0338 No score

Updated openssl packages fix security vulnerabilities

Guido Vranken discovered that OpenSSL uses undefined pointer arithmetic (CVE-2016-2177).

Cesar Pereida, Billy Brumley and Yuval Yarom discovered a timing leak in the DSA code (CVE-2016-2178).

Quan Luo and the OCAP audit team discovered denial of service vulnerabilities in DTLS (CVE-2016-2179, CVE-2016-2181).

Shi Lei discovered an out-of-bounds memory read in TS_OBJ_print_bio() and an out-of-bounds write in BN_bn2dec() and MDC2_Update() (CVE-2016-2180, CVE-2016-2182, CVE-2016-6303).

DES-based cipher suites are demoted from the HIGH group to MEDIUM as a mitigation for the SWEET32 attack (CVE-2016-2183).

Shi Lei discovered that the use of SHA512 in TLS session tickets is susceptible to denial of service (CVE-2016-6302).

Shi Lei discovered that excessively large OCSP status request may result in denial of service via memory exhaustion (CVE-2016-6304).

Shi Lei discovered that missing message length validation when parsing certificates may potentially result in denial of service (CVE-2016-6306).

Record
MGASA-2016-0338
Updated
2026-11-02
OSVMGASA-2016-0408 No score

Updated virtualbox packages fixes security vulnerabilities

This update provides virtualbox 5.1.10 maintenance release and resolves at least the following security issues:

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c (CVE-2016-2177).

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack (CVE-2016-2178).

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c (CVE-2016-2179).

The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command (CVE-2016-2180).

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c (CVE-2016-2181).

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c (CVE-2016-2182).

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack (CVE-2016-2183).

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect confidentiality, integrity, and availability via vectors related to Core, a different vulnerability than CVE-2016-5538 (CVE-2016-5501).

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect confidentiality, integrity, and availability via vectors related to Core, a different vulnerability than CVE-2016-5501 (CVE-2016-5538).

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiality and integrity via vectors related to VRDE (CVE-2016-5605).

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect availability via vectors related to Core, a different vulnerability than CVE-2016-5613 (CVE-2016-5608).

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect confidentiality, integrity, and availability via vectors related to Core (CVE-2016-5610, CVE-2016-5611)

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to…

Record
MGASA-2016-0408
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-SU-2016:2387-1 No score

Security update for openssl

This update for openssl fixes the following issues:

OpenSSL Security Advisory [22 Sep 2016] (bsc#999665)

Severity: High

  • OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666)

Severity: Low

  • Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575)
  • Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)
  • DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)
  • OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419)
  • DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)
  • OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)
  • Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359)
  • Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)
  • OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)
  • Certificate message OOB reads (CVE-2016-6306) (bsc#999668)

More information can be found on: https://www.openssl.org/news/secadv/20160922.txt

Also following bugs were fixed:

  • update expired S/MIME certs (bsc#979475)
  • improve s390x performance (bsc#982745)
  • allow >= 64GB AESGCM transfers (bsc#988591)
  • fix crash in print_notice (bsc#998190)
  • resume reading from /dev/urandom when interrupted by a signal (bsc#995075)
Record
SUSE-SU-2016:2387-1
Updated
2026-11-02
OSVSUSE-SU-2016:2394-1 No score

Security update for openssl

This update for openssl fixes the following issues:

OpenSSL Security Advisory [22 Sep 2016] (bsc#999665)

Severity: High

  • OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666)

Severity: Low

  • Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575)
  • Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)
  • DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)
  • OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419)
  • DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)
  • OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)
  • Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359)
  • Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)
  • OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)
  • Certificate message OOB reads (CVE-2016-6306) (bsc#999668)

More information can be found on: https://www.openssl.org/news/secadv/20160922.txt

Also following bugs were fixed:

  • update expired S/MIME certs (bsc#979475)
  • improve s390x performance (bsc#982745)
  • allow >= 64GB AESGCM transfers (bsc#988591)
  • fix crash in print_notice (bsc#998190)
  • resume reading from /dev/urandom when interrupted by a signal (bsc#995075)
Record
SUSE-SU-2016:2394-1
Updated
2026-11-02
OSVSUSE-SU-2016:2458-1 No score

Security update for openssl

This update for openssl fixes the following issues:

OpenSSL Security Advisory [22 Sep 2016] (bsc#999665)

Severity: High

  • OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666)

Severity: Low

  • Pointer arithmetic undefined behavior (CVE-2016-2177) (bsc#982575)
  • Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)
  • DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)
  • DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)
  • OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)
  • Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359)
  • Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)
  • OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)
  • Certificate message OOB reads (CVE-2016-6306) (bsc#999668)

More information can be found on: https://www.openssl.org/news/secadv/20160922.txt

Bugs fixed:

  • Update expired S/MIME certs (bsc#979475)
  • Fix crash in print_notice (bsc#998190)
  • Resume reading from /dev/urandom when interrupted by a signal (bsc#995075)
Record
SUSE-SU-2016:2458-1
Updated
2026-11-02
OSVSUSE-SU-2016:2468-1 No score

Security update for compat-openssl098

This update for compat-openssl098 fixes the following issues:

OpenSSL Security Advisory [22 Sep 2016] (bsc#999665)

Severity: High

  • OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666)

Severity: Low

  • Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575)
  • Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)
  • DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)
  • DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)
  • OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)
  • Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359)
  • Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)
  • OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)
  • Certificate message OOB reads (CVE-2016-6306) (bsc#999668)

More information can be found on: https://www.openssl.org/news/secadv/20160922.txt

Bugs fixed:

  • update expired S/MIME certs (bsc#979475)
  • fix crash in print_notice (bsc#998190)
  • resume reading from /dev/urandom when interrupted by a signal (bsc#995075)
Record
SUSE-SU-2016:2468-1
Updated
2026-11-02
OSVSUSE-SU-2016:2469-1 No score

Security update for openssl1

This update for openssl1 fixes the following issues:

penSSL Security Advisory [22 Sep 2016] (bsc#999665)

Severity: High

  • OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666)

Severity: Low

  • Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575)
  • Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)
  • DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)
  • OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419)
  • DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)
  • OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)
  • Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359)
  • Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)
  • OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)
  • Certificate message OOB reads (CVE-2016-6306) (bsc#999668)

More information can be found on: https://www.openssl.org/news/secadv/20160922.txt

Also following bugs were fixed:

  • update expired S/MIME certs (bsc#979475)
  • improve s390x performance (bsc#982745)
  • fix crash in print_notice (bsc#998190)
  • resume reading from /dev/urandom when interrupted by a signal (bsc#995075)
Record
SUSE-SU-2016:2469-1
Updated
2026-11-02
OSVSUSE-SU-2017:2699-1 No score

Security update for SLES 12 Docker image

The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

util-linux:

  • CVE-2015-5218
  • CVE-2016-5011
  • CVE-2017-2616

cracklib:

  • CVE-2016-6318

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • openldap2
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • shadow
  • zypper
Record
SUSE-SU-2017:2699-1
Updated
2026-11-02
OSVSUSE-SU-2017:2700-1 No score

Security update for SLES 12-SP1 Docker image

The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

expat:

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306
  • CVE-2016-7056
  • CVE-2016-8610
  • CVE-2017-3731

cracklib:

  • CVE-2016-6318

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

util-linux:

  • CVE-2016-5011
  • CVE-2017-2616

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

update-alternatives:

  • CVE-2015-0860

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • lua51
  • lvm2
  • netcfg
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • sg3_utils
  • shadow
  • zypper
Record
SUSE-SU-2017:2700-1
Updated
2026-11-02
OSVUSN-3087-1 No score

openssl vulnerabilities

Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request extension. A remote attacker could possibly use this issue to cause memory consumption, resulting in a denial of service. (CVE-2016-6304)

Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointer arithmetic. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS in this update. (CVE-2016-2177)

César Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL did not properly use constant-time operations when performing DSA signing. A remote attacker could possibly use this issue to perform a cache-timing attack and recover private DSA keys. (CVE-2016-2178)

Quan Luo discovered that OpenSSL did not properly restrict the lifetime of queue entries in the DTLS implementation. A remote attacker could possibly use this issue to consume memory, resulting in a denial of service. (CVE-2016-2179)

Shi Lei discovered that OpenSSL incorrectly handled memory in the TS_OBJ_print_bio() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2180)

It was discovered that the OpenSSL incorrectly handled the DTLS anti-replay feature. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2181)

Shi Lei discovered that OpenSSL incorrectly validated division results. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2182)

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves DES from the HIGH cipher list to MEDIUM. (CVE-2016-2183)

Shi Lei discovered that OpenSSL incorrectly handled certain ticket lengths. A remote attacker could use this issue to cause a denial of service. (CVE-2016-6302)

Shi Lei discovered that OpenSSL incorrectly handled memory in the MDC2_Update() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6303)

Shi Lei discovered that OpenSSL incorrectly performed certain message length checks. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6306)

Record
USN-3087-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Alpine:v3.2
 before 1.0.2h-r4
1.0.2h-r4
openssl
Alpine:v3.3
 before 1.0.2h-r4
1.0.2h-r4
openssl
Alpine:v3.4
 before 1.0.2h-r4
1.0.2h-r4
openssl
Alpine:v3.5
 before 1.0.2h-r4
1.0.2h-r4
openssl
Alpine:v3.6
 before 1.0.2h-r4
1.0.2h-r4
openssl
Alpine:v3.7
 before 1.0.2h-r4
1.0.2h-r4
openssl
Alpine:v3.8
 before 1.0.2h-r4
1.0.2h-r4
openssl
Debian:12
 before 1.0.2i-1
1.0.2i-1
openssl
Debian:13
 before 1.0.2i-1
1.0.2i-1
openssl
Debian:14
 before 1.0.2i-1
1.0.2i-1
Show 74 moreShow less
Affected packages
PackageAffectedFixed
openssl
Debian:7
 before 1.0.1t-1+deb7u1, plus listed versions
1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u101.0.1e-2+deb7u111.0.1e-2+deb7u12
Show 39 moreShow less
1.0.1e-2+deb7u131.0.1e-2+deb7u141.0.1e-2+deb7u151.0.1e-2+deb7u161.0.1e-2+deb7u171.0.1e-2+deb7u181.0.1e-2+deb7u191.0.1e-2+deb7u21.0.1e-2+deb7u201.0.1e-2+deb7u211.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u91.0.1e-31.0.1e-41.0.1e-51.0.1e-61.0.1f-11.0.1g-11.0.1g-21.0.1g-2+alpha1.0.1g-31.0.1g-41.0.1h-11.0.1h-21.0.1h-31.0.1i-11.0.1i-21.0.1i-2+alpha1.0.1j-11.0.1j-1+alpha1.0.1k-11.0.1k-21.0.1k-31.0.1k-3+alpha
1.0.1t-1+deb7u1
openssl
Debian:8
 before 1.0.1t-1+deb8u4, plus listed versions
1.0.1k-31.0.1k-3+alpha1.0.1k-3+deb8u11.0.1k-3+deb8u21.0.1k-3+deb8u3
Show 5 moreShow less
1.0.1k-3+deb8u41.0.1k-3+deb8u51.0.1t-1+deb8u11.0.1t-1+deb8u21.0.1t-1+deb8u3
1.0.1t-1+deb8u4
openssl
Mageia:5
 before 1.0.2j-1.mga5
1.0.2j-1.mga5
kmod-vboxadditions
Mageia:5
 before 5.1.10-1.1.mga5
5.1.10-1.1.mga5
kmod-virtualbox
Mageia:5
 before 5.1.10-1.1.mga5
5.1.10-1.1.mga5
virtualbox
Mageia:5
 before 5.1.10-1.1.mga5
5.1.10-1.1.mga5
openssl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-devel
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-perl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-static
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-perl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-static
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-devel
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-perl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-static
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-perl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl-static
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
openssl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-debuginfo
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-libs
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-devel
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-perl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-static
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-libs
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-devel
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-perl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-static
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-devel
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-libs
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-perl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-static
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-devel
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-libs
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-perl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl-static
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
openssl
SUSE:Linux Enterprise Server for SAP Applications 12
 before 1.0.1i-27.21.1
1.0.1i-27.21.1
openssl
SUSE:Linux Enterprise Server 12-LTSS
 before 1.0.1i-27.21.1
1.0.1i-27.21.1
openssl
SUSE:Linux Enterprise Desktop 12 SP1
 before 1.0.1i-52.1
1.0.1i-52.1
openssl
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 1.0.1i-52.1
1.0.1i-52.1
openssl
SUSE:Linux Enterprise Server 12 SP1
 before 1.0.1i-52.1
1.0.1i-52.1
openssl
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 1.0.1i-52.1
1.0.1i-52.1
openssl
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:OpenStack Cloud 5
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:Manager 2.1
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:Manager Proxy 2.1
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:Linux Enterprise Server 11 SP2-LTSS
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:Linux Enterprise Server 11 SP3-LTSS
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:Linux Enterprise Server 11 SP3-TERADATA
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:Linux Enterprise Server 11 SP4
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
openssl
SUSE:Studio Onsite 1.3
 before 0.9.8j-0.102.2
0.9.8j-0.102.2
compat-openssl098
SUSE:Linux Enterprise Desktop 12 SP1
 before 0.9.8j-102.1
0.9.8j-102.1
compat-openssl098
SUSE:Linux Enterprise Module for Legacy 12
 before 0.9.8j-102.1
0.9.8j-102.1
compat-openssl098
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 0.9.8j-102.1
0.9.8j-102.1
openssl1
SUSE:Linux Enterprise Server 11-SECURITY
 before 1.0.1g-0.52.1
1.0.1g-0.52.1
openssl
Ubuntu:14.04:LTS
 before 1.0.1f-1ubuntu2.20, plus listed versions
1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4
Show 16 moreShow less
1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.81.0.1f-1ubuntu2.111.0.1f-1ubuntu2.121.0.1f-1ubuntu2.151.0.1f-1ubuntu2.161.0.1f-1ubuntu2.171.0.1f-1ubuntu2.181.0.1f-1ubuntu2.19
1.0.1f-1ubuntu2.20
openssl
Ubuntu:16.04:LTS
 before 1.0.2g-1ubuntu4.4, plus listed versions
1.0.2d-0ubuntu11.0.2d-0ubuntu21.0.2e-1ubuntu11.0.2f-2ubuntu11.0.2g-1ubuntu2
Show 4 moreShow less
1.0.2g-1ubuntu31.0.2g-1ubuntu41.0.2g-1ubuntu4.11.0.2g-1ubuntu4.2
1.0.2g-1ubuntu4.4
openssl-1_1
openSUSE:Tumbleweed
 before 1.1.1l-1.2
1.1.1l-1.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 729 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open