Just days after releasing Core Update 115 with our brand new Captive Portal, we are releasing the next update for IPFire which is necessary because some security vulneratbilities have been found in some packages that IPFire uses. Those are openssl and wget, but this update also brings some smaller bug fixes.
To help us to provide Core Updates regularly and swiftly in case of any security issues, we would like to ask you to support the project by sending us your donation!
openssl 1.0.2m
The OpenSSL project released version 1.0.2m and issued two security advisories in the last week. The two vulnerabilities that were discovered were of moderate and low security, but we have decided to ship you this update as soon as possible. Hence it is recommended to update as soon as possible, too.
The more severe vulnerability referenced as CVE-2017-3736 fixes a problem with modern Intel Broadwell and AMD Ryzen processors where OpenSSL uses some modern DMI1, DMI2 and ADX extensions and calculates the square root incorrectly. This could be exploited by an attacker who is able to put significant resources into recover a private key more easy alas this attack is still considered virtually unfeasible by the OpenSSL security team.
The less severe vulnerability was caused by overreading certificate data when a certificate has a malformed IPAddressFamily extension. This could lead lead to erroneous display of the certificate in text format. This vulnerability is tracked under CVE-2017-3735.
Misc.
wgetalso suffered from two security vulnerabilities that allowed an attacker to execute arbitrary code. They are referenced under CVE-2017-13089 and CVE-2017-13090.apachewas updated to version 2.4.29 which fixes a number of bugs.snorthas been updated to version 2.9.11.xzhas also been updated to version 5.2.3 which brings various improvements.
It is recommended to reboot the IPFire system after installing this Core Update.