{"affected":[{"ecosystem_specific":{"binaries":[{"openssh-openssl1":"6.6p1-15.1","openssh-openssl1-helpers":"6.6p1-15.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","name":"openssh-openssl1","purl":"purl:rpm/suse/openssh-openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011-SECURITY"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.6p1-15.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"\nThis update for openssh-openssl1 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-6210: Prevent user enumeration through the timing of password\n  processing (bsc#989363)\n- CVE-2016-6515: limit accepted password length (prevents possible DoS)\n  (bsc#992533)\n- CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)\n- CVE-2016-1908: prevent X11 SECURITY circumvention when forwarding X11\n  connections (bsc#962313)\n- CVE-2015-8325: ignore PAM environment when using login (bsc#975865)\n- Disable DH parameters under 2048 bits by default and allow\n  lowering the limit back to the RFC 4419 specified minimum\n  through an option (bsc#932483, bsc#948902)\n- Allow lowering the DH groups parameter limit in server as well\n  as when GSSAPI key exchange is used (bsc#948902)\n\nBugs fixed:\n- avoid complaining about unset DISPLAY variable (bsc#981654)\n- Correctly parse GSSAPI KEX algorithms (bsc#961368)\n- more verbose FIPS mode/CC related documentation in README.FIPS\n  (bsc#965576, bsc#960414)\n- fix PRNG re-seeding (bsc#960414, bsc#729190)\n- Allow empty Match blocks (bsc#961494)\n","id":"SUSE-SU-2016:2555-1","modified":"2016-10-17T14:52:50Z","published":"2016-10-17T14:52:50Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162555-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/729190"},{"type":"REPORT","url":"https://bugzilla.suse.com/932483"},{"type":"REPORT","url":"https://bugzilla.suse.com/948902"},{"type":"REPORT","url":"https://bugzilla.suse.com/960414"},{"type":"REPORT","url":"https://bugzilla.suse.com/961368"},{"type":"REPORT","url":"https://bugzilla.suse.com/961494"},{"type":"REPORT","url":"https://bugzilla.suse.com/962313"},{"type":"REPORT","url":"https://bugzilla.suse.com/965576"},{"type":"REPORT","url":"https://bugzilla.suse.com/970632"},{"type":"REPORT","url":"https://bugzilla.suse.com/975865"},{"type":"REPORT","url":"https://bugzilla.suse.com/981654"},{"type":"REPORT","url":"https://bugzilla.suse.com/989363"},{"type":"REPORT","url":"https://bugzilla.suse.com/992533"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-8325"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-1908"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-3115"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-6210"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-6515"}],"related":["CVE-2015-8325","CVE-2016-1908","CVE-2016-3115","CVE-2016-6210","CVE-2016-6515"],"summary":"Security update for openssh-openssl1"}