CVE-2012-2333

Published: May 14, 2012Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation.

Affected (99)

Products: Openssl: Openssl · Redhat: Openssl

1 product

1 product

Configuration A

79 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8w
Openssl Openssl	Version 0.9.1c
Openssl Openssl	Version 0.9.2b
Openssl Openssl	Version 0.9.3
Openssl Openssl	Version 0.9.3a
Openssl Openssl	Version 0.9.4
Openssl Openssl	Version 0.9.5
Openssl Openssl	Version 0.9.5 beta1
Openssl Openssl	Version 0.9.5 beta2
Openssl Openssl	Version 0.9.5a
Openssl Openssl	Version 0.9.5a beta1
Openssl Openssl	Version 0.9.5a beta2
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6 beta1
Openssl Openssl	Version 0.9.6 beta2
Openssl Openssl	Version 0.9.6 beta3
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6a beta1
Openssl Openssl	Version 0.9.6a beta2
Openssl Openssl	Version 0.9.6a beta3
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6f
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.6j
Openssl Openssl	Version 0.9.6k
Openssl Openssl	Version 0.9.6l
Openssl Openssl	Version 0.9.6m
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7 beta1
Openssl Openssl	Version 0.9.7 beta2
Openssl Openssl	Version 0.9.7 beta3
Openssl Openssl	Version 0.9.7 beta4
Openssl Openssl	Version 0.9.7 beta5
Openssl Openssl	Version 0.9.7 beta6
Openssl Openssl	Version 0.9.7a
Openssl Openssl	Version 0.9.7b
Openssl Openssl	Version 0.9.7c
Openssl Openssl	Version 0.9.7d
Openssl Openssl	Version 0.9.7e
Openssl Openssl	Version 0.9.7f
Openssl Openssl	Version 0.9.7g
Openssl Openssl	Version 0.9.7h
Openssl Openssl	Version 0.9.7i
Openssl Openssl	Version 0.9.7j
Openssl Openssl	Version 0.9.7k
Openssl Openssl	Version 0.9.7l
Openssl Openssl	Version 0.9.7m
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m
Openssl Openssl	Version 0.9.8m beta1
Openssl Openssl	Version 0.9.8n
Openssl Openssl	Version 0.9.8o
Openssl Openssl	Version 0.9.8p
Openssl Openssl	Version 0.9.8q
Openssl Openssl	Version 0.9.8r
Openssl Openssl	Version 0.9.8s
Openssl Openssl	Version 0.9.8t
Openssl Openssl	Version 0.9.8u
Openssl Openssl	Version 0.9.8v
Redhat Openssl	Version 0.9.6-15
Redhat Openssl	Version 0.9.6b-3
Redhat Openssl	Version 0.9.7a-2

Configuration B

14 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b

Related CWEs

CWE-189

References (56)

http://cvs.openssl.org/chngview?cn=22538

Source: secalert@redhat.com

http://cvs.openssl.org/chngview?cn=22547

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081460.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00019.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00020.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=134919053717161&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=136432043316835&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0699.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1306.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1307.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1308.html

Source: secalert@redhat.com

http://secunia.com/advisories/49116

Source: secalert@redhat.com

http://secunia.com/advisories/49208

Source: secalert@redhat.com

http://secunia.com/advisories/49324

Source: secalert@redhat.com

http://secunia.com/advisories/50768

Source: secalert@redhat.com

http://secunia.com/advisories/51312

Source: secalert@redhat.com

http://support.apple.com/kb/HT5784

Source: secalert@redhat.com

http://www.cert.fi/en/reports/2012/vulnerability641549.html

Source: secalert@redhat.com

http://www.debian.org/security/2012/dsa-2475

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/737740

Source: secalert@redhat.com

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2012:073

Source: secalert@redhat.com

http://www.openssl.org/news/secadv_20120510.txt

Source: secalert@redhat.com

http://www.securityfocus.com/bid/53476

Source: secalert@redhat.com

http://www.securitytracker.com/id?1027057

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=820686

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/75525

Source: secalert@redhat.com

http://cvs.openssl.org/chngview?cn=22538