CVE-2014-3566

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

This update adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV), which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails.

This can prevent a forceful downgrade of the communication to SSL 3.0. The SSL 3.0 protocol was found to be vulnerable to the padding oracle attack when using block cipher suites in cipher block chaining (CBC) mode. This issue is identified as CVE-2014-3566, and also known under the alias POODLE. This SSL 3.0 protocol flaw will not be addressed in a future update; it is recommended that users configure their applications to require at least TLS protocol version 1.0 for secure communication.

For additional information about this flaw, see the RedHat Knowledgebase article in the references.

A memory leak flaw was found in the way OpenSSL parsed the DTLS Secure Real-time Transport Protocol (SRTP) extension data. A remote attacker could send multiple specially crafted handshake messages to exhaust all available memory of an SSL/TLS or DTLS server (CVE-2014-3513).

A memory leak flaw was found in the way an OpenSSL handled failed session ticket integrity checks. A remote attacker could exhaust all available memory of an SSL/TLS or DTLS server by sending a large number of invalid session tickets to that server (CVE-2014-3567).

This new version enables SSL negotiation instead of hardcoding SSLv3.

These are all security issues fixed in the monit-5.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache2-mod_nss-1.0.14-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the claws-mail-3.14.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the fossil-1.35-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_7_0-openjdk-1.7.0.121-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the slrn-1.0.3-3.13 package on the GA media of openSUSE Tumbleweed.

This feature update for zxing-cpp and libreoffice fixes the following issues:

Update LibreOffice from version 7.1.3.2 to 7.2.3.2 (jsc#SLE-18213):

• Fix external URL connections issues when WebDav is built using libserf. (bsc#1187173, bsc#1186871)
• Fix an issue with PPTX where one column becomes two within one text frame. (bsc#1182969)
• Fix inteaction between multi-column shape text and automatic height. (bsc#1187982)
• Fix interaction of transparent cell fill and transparent shadow. (bsc#1189813)
• Fix lost bullet mode while typing and text is not visible.
• Use external poppler version 21.01.0 (jsc#SLE-18213)
• Use external CMIS version 0.5.2
• Update external boost to version 1.75.0
• Update external pdfium to version 4500
• Update external skia to version 'm90'
• Do not use qrcodegen-devel but move to zxing-cpp (jsc#SLE-18213)
• Keep upstream desktop file names (bsc#1183655)
• Display math icon (bsc#1180479)
• Source profile.d/alljava.sh from either /etc (if found) or /usr/etc.

Update libserf from version 1.3.7 to version 1.3.9 (jsc#SLE-18213):

• serf is now Apache Software Foundation project
• Reset state variables when resetting connection
• Fix some usages of the openssl BIO api
• Improve handling of bad data in the response state line
• Support more overrides via SCons arguments
• Adapt to OpenSSL 1.1.x api
• CVE-2014-3566: Fix the handling of very large gzip-encoded HTTP responses and disables SSLv2 and SSLv3. (bsc#901968)
  • CRC calculation error for gzipped http reponses > 4GB.
  • SSPI CredHandle not freed when APR pool is destroyed.
  • Disable SSLv2 and SSLv3 as both are broken

Provide zxing-cpp 1.2.0 as new LibreOffice dependency (jsc#SLE-18213):

• Do not build examples to avoid a cycle with QT5Multimedia
• Use cmake3-full package instead of cmake on SUSE Linux Enterprise 12
• Do not build examples on SUSE Linux Enterprise 12
• Only build blackbox tests on openSUSE Tumbleweed
• New BarcodeFormat
• New ZXingQtCamReader demo app based on QtMultimedia and QtQuick
• New QRCode reader, faster and better support for rotated symbols
• Add Structured Append support for DataMatrix, Aztec and MaxiCode
• Add DMRE support for DataMatrix
• Switch to the reimplemented 1D detectors, about 5x faster
• Faster and more capable isPure detection for all 2D codes
• 20% faster ReedSolomon error correction.
• ReedSolomon error detection code 2x speedup.
• PDF417 is faster and supports flipped symbols
• Reduced false positive rate for UPC/EAN barcodes and improved Add-On symbol handling
• Fix country-code metadata decoding for UPC/EAN codes.
• Proper ECI handling in all 2D barcodes
• Add baselibs.conf
• Many performance improvements for 1D readers
• More meta-data exported when reading specific format
• Improve DataMatrix encoder
• Add interface to simplify basic usage
• WASM API to support pixels array as input
• 'LuminanceSource' based API is now deprecated but still compiles.
• New BarcodeFormats flag type to specify the set of barcodes to look for.
• New simplified and consistent Python API
• Slightly improved QRCode detection for rotated symbols.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for crowbar-barclamp-nova_dashboard provides stability fixes from the upstream OpenStack project:

* Use a host specific memcache key for django_compressor (bnc#894070)
* Add Requires on crowbar-barclamp-openstack for the new
  crowbar-openstack cookbook.
* Use helpers from new crowbar-openstack cookbook
* Fix apache with HA not running until second chef-client run
* Configure horizon before configuring the vhost for horizon in apache
* Avoid races with HA on 'python manage.py syncdb'
* Add dependency on crowbar-barclamp-openstack as Requires(post) and
  Requires to make sure the package is installed before the %post
  scriplet is executed (bnc#900887).

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

This update provides fixes and enhancements for the Software Update Stack.

gnome-packagekit:

• Fix title of license agreement window. (bsc#927319)

libsolv:

• Rework splitprovides handling. (bnc#921332)
• Add product:regflavor attribute. (bnc#896224)
• Fix bug in reorder_dq_for_jobrules that could lead to crashes. (bnc#899907)
• Fix bug in dislike_old_versions that could lead to a segfault. (bnc#922352)
• Add manpages for the tools.

libzypp:

• Add configuration values for gpgcheck, repo_gpgcheck and pkg_gpgcheck to zypp.conf. (FATE#314603)
• Support $releasever_major/$releasever_minor repo variables. (FATE#318354)
• Support repo variable replacement in service url.
• Support repo variable replacement in gpg url.
• Add support for SHA224/384/512.
• Don't execute scripts in /tmp or /var/tmp, as they could be mounted noexec for security reasons. (bnc#915928)
• Let $ZYPP_REPO_RELEASEVER overwrite $releasever in .repo files. (bnc#911658)
• Parse and offer productRegisterFlavor attribute. (bnc#896224)
• Improve conflict message for locked packages. (bnc#828631)
• Fix broken de-escaping in str::splitEscaped. (bnc#909772)
• Filter PIDs running in a container. (bnc#909143)
• Suppress informal license (no need to accept) upon update. (bnc#908976)
• Adapt to gpg-2.1. (bnc#908135)
• Call rpm with '--noglob'. (bnc#892431)
• Fix URL path concatenation in MediaCurl. (bnc#901590)
• Move doxygen html doc to libzypp-devel-doc. (bnc#901691)
• Support parsing multiple baseurls from a repo file. (bnc#899510)
• Suppress MediaChangeReport while testing multiple baseurls. (bnc#899510)
• Fix handling local mirrorlist= files in .repo. (bnc#899510)
• Prevent POODLE by talking TLS only. (bnc#903405)
• Fix segmentation fault when dumping rpm header with epoch. (bnc#929483)
• Handle repository aliases containing ']' correctly. (bnc#929528)
• Avoid nested exception on user abort. (bnc#931601)
• Fix SSL client certificate authentication via URL option ssl_clientcert/ssl_clientkey. (bnc#932393)

libzypp-bindings:

• Enforce Python 2.7 libzypp-bindings is not yet ready for Python 3.
• Adapt to libzypp changes.

zypper:

• Implement and document GPG signature checking. (FATE#314603)
• Enhance 'Digest verification failed' message and dialog. (FATE#315008)
• Refresh plugin services on 'lr' 'ls -r' and 'ref'. (bnc#893294, FATE#318117) Repositories provided by a plugin service (SUSE Manager) must always be (auto-)refreshed to reflect server side changes immediately.
• Allow repo:package to reinstall from a different repo. (bnc#725867)
• Suppress MediaChangeReport while testing multiple baseurls. (bnc#899510)
• A date limit must ignore newer patch candidates. (bnc#919709)
• Notify about volatile changes to service repos. (bnc#916254)
• Change column header from 'Login' to 'User'. (bnc#915461)
• Fix wrong exit status using the --xmlout option. (bnc#914258)
• Add new color/pkglistHighlightAttribute to zypper.conf. (bnc#914284)
• New global option --releasever: Set the value of the $releasever variable in all .repo files. This can be used to switch to new distribution repositories when performing a distribution upgrade. (bnc#911658)
• Clarify legacy warning. (bnc#911335)
• Show new product:registerflavor attribute in 'zypper info'. (bnc#896224)
• Enhance message text when skipping repos due to an error. (bnc#909244)
• Fix additional spaces in zypper output and new colorization code. (bnc#908345)
• Properly reset auto-retry counter. (bnc#906549)
• Improve patch description in man page. (bnc#904737)
• Warn about repositories with 'gpgcheck=0'. (bnc#848054)
• Summary: quote names including spaces. (bnc#903675)
• Warn if legacy CLI options are used. (bnc#899781)
• Fix prompt returning undefined default value after wrong input. (bnc#925696)
• Fix typo in man page. (bnc#923800)
• Only use ANSI color codes on terminals. (bnc#925678)
• Fix table sorting with option --sort-by-priority. (bnc#832519)
• Clarify 'zypper lp --date' description. (bnc#929593)
• Warn user…

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

Oracle Critical Patch Update Advisory - October 2014

Description:

A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities.

Find more information here: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

java-1_7_0-ibm has been updated to version 1.7.0_sr7.2 to fix 21 security issues.

These security issues have been fixed:

* Unspecified vulnerability (CVE-2014-3065).
* The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
  products, uses nondeterministic CBC padding, which makes it easier
  for man-in-the-middle attackers to obtain cleartext data via a
  padding-oracle attack, aka the 'POODLE' issue (CVE-2014-3566).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and
  Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to
  AWT (CVE-2014-6513).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors (CVE-2014-6456).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532
  (CVE-2014-6503).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503
  (CVE-2014-6532).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-4288).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-6493).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Firefox, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6492).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows local users to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment
  (CVE-2014-6458).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Internet Explorer, allows local users to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6466).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Libraries (CVE-2014-6506).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect integrity via unknown vectors related to
  Deployment, a different vulnerability than CVE-2014-6527
  (CVE-2014-6476).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect integrity via unknown vectors
  related to Deployment (CVE-2014-6515).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20 allows remote attackers to affect confidentiality via unknown
  vectors related to 2D (CVE-2014-6511).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality via unknown vectors related to Libraries
  (CVE-2014-6531).
* Unspecified…

java-1_6_0-ibm has been updated to version 1.6.0_sr16.2 to fix 18 security issues.

These security issues have been fixed:

* Unspecified vulnerability in Oracle Java SE 6u81 (CVE-2014-3065).
* The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
  products, uses nondeterministic CBC padding, which makes it easier
  for man-in-the-middle attackers to obtain cleartext data via a
  padding-oracle attack, aka the 'POODLE' issue (CVE-2014-3566).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and
  Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to
  AWT (CVE-2014-6513).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532
  (CVE-2014-6503).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503
  (CVE-2014-6532).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-4288).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-6493).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Firefox, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6492).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows local users to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment
  (CVE-2014-6458).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Internet Explorer, allows local users to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6466).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Libraries (CVE-2014-6506).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect integrity via unknown vectors
  related to Deployment (CVE-2014-6515).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20 allows remote attackers to affect confidentiality via unknown
  vectors related to 2D (CVE-2014-6511).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality via unknown vectors related to Libraries
  (CVE-2014-6531).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows
  remote attackers to affect integrity via unknown vectors related to
  Libraries (CVE-2014-6512).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows
  remote…

This update fixes 13 security issues.

These security issues were fixed:

• CVE-2015-0395: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot (bnc#914041).
• CVE-2015-0400: Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality via unknown vectors related to Libraries (bnc#914041).
• CVE-2015-0383: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allowed local users to affect integrity and availability via unknown vectors related to Hotspot (bnc#914041).
• CVE-2015-0412: Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS (bnc#914041).
• CVE-2015-0407: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality via unknown vectors related to Swing (bnc#914041).
• CVE-2015-0408: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI (bnc#914041).
• CVE-2014-6585: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality via unknown vectors reelated to 2D, a different vulnerability than CVE-2014-6591 (bnc#914041).
• CVE-2014-6587: Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#914041).
• CVE-2014-6591: Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585 (bnc#914041).
• CVE-2014-6593: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allowed remote attackers to affect confidentiality and integrity via vectors related to JSSE (bnc#914041).
• CVE-2014-6601: Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot (bnc#914041).
• CVE-2015-0410: Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allowed remote attackers to affect availability via unknown vectors related to Security (bnc#914041).
• CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, used nondeterministic CBC padding, which made it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the 'POODLE' issue (bnc#901223).

These non-security issues were fixed:

• Update protocol support (S8046656).
• Fewer escapes from escape analysis (S8047130).
• Better GC validation (S8049253).
• TLAB stability (S8055479).

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>