FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

OpenSSL -- Local Information Disclosure

Affected packages
1.0.1	<=	openssl	<	1.0.1_10
1.0.1	<=	mingw32-openssl	<	1.0.1g
8.3	<=	FreeBSD	<	8.3_15
8.4	<=	FreeBSD	<	8.4_8
9.1	<=	FreeBSD	<	9.1_11
9.2	<=	FreeBSD	<	9.2_4
10.0	<=	FreeBSD	<	10.0_1

Details

VuXML ID	7ccd4def-c1be-11e3-9d09-000c2980a9f3
Discovery	2014-04-07
Entry	2014-04-11

OpenSSL reports:

A flaw in the implementation of Montgomery Ladder Approach would create a side-channel that leaks sensitive timing information.

A local attacker might be able to snoop a signing process and might recover the signing key from it.

[source]

References

CVE Name	CVE-2014-0076
FreeBSD Advisory	SA-14:06.openssl
URL	https://www.openssl.org/news/vulnerabilities.html#2014-0076