CVE-2015-1789

Published: Jun 12, 2015Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Affected (46)

Products: Openssl: Openssl · Oracle: Sparc Opl Service Processor

Openssl

1 product

Openssl

Oracle

1 product

Sparc Opl Service Processor

Configuration A

45 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8zf
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.0n
Openssl Openssl	Version 1.0.0o
Openssl Openssl	Version 1.0.0p
Openssl Openssl	Version 1.0.0q
Openssl Openssl	Version 1.0.0r
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j
Openssl Openssl	Version 1.0.1k
Openssl Openssl	Version 1.0.1l
Openssl Openssl	Version 1.0.1m
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2a

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Sparc Opl Service Processor	Up to 1121

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (110)

http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015

Source: secalert@redhat.com

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160436.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160647.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143654156615516&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143880121627664&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050155601375&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-1115.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-1197.html

Source: secalert@redhat.com

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl

Source: secalert@redhat.com

http://www.debian.org/security/2015/dsa-3287

Source: secalert@redhat.com

http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015

Source: secalert@redhat.com

http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/75156

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

http://www.securitytracker.com/id/1032564

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2639-1

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa98

Source: secalert@redhat.com

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://github.com/openssl/openssl/commit/f48b83b4fb7d6689584cf25f61ca63a4891f5b11

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05353965

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10122

Source: secalert@redhat.com

https://openssl.org/news/secadv/20150611.txt

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201506-02

Source: secalert@redhat.com

https://support.apple.com/kb/HT205031

Source: secalert@redhat.com

https://support.citrix.com/article/CTX216642

Source: secalert@redhat.com

https://www.arista.com/en/support/advisories-notices/security-advisories/1144-security-advisory-11

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20150611.txt

Source: secalert@redhat.com

Vendor Advisory

http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015