CVE-2015-0287

Published: Mar 19, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.

Affected (33)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

33 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8ze
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.0n
Openssl Openssl	Version 1.0.0o
Openssl Openssl	Version 1.0.0p
Openssl Openssl	Version 1.0.0q
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j
Openssl Openssl	Version 1.0.1k
Openssl Openssl	Version 1.0.1l
Openssl Openssl	Version 1.0.2

Related CWEs

CWE-17

References (98)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156823.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157177.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00022.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2015-03/msg00062.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142841429220765&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143213830203296&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143748090628601&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050155601375&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050297101809&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0715.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0716.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0752.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0800.html

Source: secalert@redhat.com

http://support.apple.com/kb/HT204942

Source: secalert@redhat.com

http://www.debian.org/security/2015/dsa-3197

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:062

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:063

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/73227

Source: secalert@redhat.com

http://www.securitytracker.com/id/1031929

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2537-1

Source: secalert@redhat.com

https://access.redhat.com/articles/1384453

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa92

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1202380

Source: secalert@redhat.com

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=b717b083073b6cacc0a5e2397b661678aff7ae7f

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10110

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201503-11

Source: secalert@redhat.com

https://support.apple.com/HT205212

Source: secalert@redhat.com

https://support.apple.com/HT205267

Source: secalert@redhat.com

https://support.citrix.com/article/CTX216642

Source: secalert@redhat.com

https://www.freebsd.org/security/advisories/FreeBSD-SA-15%3A06.openssl.asc

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20150319.txt

Source: secalert@redhat.com

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680