CVE-2015-1790

Published: Jun 12, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.

Affected (45)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

45 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8zf
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.0n
Openssl Openssl	Version 1.0.0o
Openssl Openssl	Version 1.0.0p
Openssl Openssl	Version 1.0.0q
Openssl Openssl	Version 1.0.0r
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j
Openssl Openssl	Version 1.0.1k
Openssl Openssl	Version 1.0.1l
Openssl Openssl	Version 1.0.1m
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2a

References (106)

http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015

Source: secalert@redhat.com

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160436.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160647.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143654156615516&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143880121627664&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050155601375&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-1115.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-1197.html

Source: secalert@redhat.com

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl

Source: secalert@redhat.com

http://www.debian.org/security/2015/dsa-3287

Source: secalert@redhat.com

http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015

Source: secalert@redhat.com

http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/75157

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

http://www.securitytracker.com/id/1032564

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2639-1

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa98

Source: secalert@redhat.com

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://github.com/openssl/openssl/commit/59302b600e8d5b77ef144e447bb046fd7ab72686

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05353965

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10122

Source: secalert@redhat.com

https://openssl.org/news/secadv/20150611.txt

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201506-02

Source: secalert@redhat.com

https://support.apple.com/kb/HT205031

Source: secalert@redhat.com

https://www.arista.com/en/support/advisories-notices/security-advisories/1144-security-advisory-11

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20150611.txt

Source: secalert@redhat.com

Vendor Advisory

http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015