IBM Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2016-8610)

There is a vulnerability in OpenSSL used by AIX.

CVE(s): CVE-2016-8610

Affected product(s) and affected version(s):

 AIX 5.3, 6.1, 7.1, 7.2
VIOS 2.2.x
The following fileset levels are vulnerable:
key_fileset = osrcaix
Fileset Lower Level Upper Level KEY --------------------------------------------------
openssl.base 1.0.1.500 1.0.1.517 key_w_fs
openssl.base 20.11.101.500 20.13.101.500 key_w_fs
Note: 0.9.8 and 1.0.1 openSSL versions are out-of-support. Customers are advised
to upgrade to currently supported openSSL 1.0.2 version. OpenSSL 1.0.2 version
is available in AIX web download pack programs:
http://ift.tt/1I8VOAB
To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in the AIX user's guide.
Example: lslpp -L | grep -i openssl.base

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2k60u9f
X-Force Database: http://ift.tt/2hNr07D

from IBM Product Security Incident Response Team http://ift.tt/2k5TPfj