CVE-2012-1165: Null Pointer Dereference
Published Mar 15, 2012
·Updated
The mimeparamcmp function in crypto/asn1/asnmime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250.
Affected Software
86 affected components
OpenSSL OpenSSL<=0.9.8t
OpenSSL OpenSSL=0.9.1c
OpenSSL OpenSSL=0.9.2b
OpenSSL OpenSSL=0.9.3
OpenSSL OpenSSL=0.9.3a
OpenSSL OpenSSL=0.9.4
OpenSSL OpenSSL=0.9.5
OpenSSL OpenSSL=0.9.5-beta1
OpenSSL OpenSSL=0.9.5-beta2
OpenSSL OpenSSL=0.9.5a
OpenSSL OpenSSL=0.9.5a-beta1
OpenSSL OpenSSL=0.9.5a-beta2
OpenSSL OpenSSL=0.9.6
OpenSSL OpenSSL=0.9.6-beta1
OpenSSL OpenSSL=0.9.6-beta2
OpenSSL OpenSSL=0.9.6-beta3
OpenSSL OpenSSL=0.9.6a
OpenSSL OpenSSL=0.9.6a-beta1
OpenSSL OpenSSL=0.9.6a-beta2
OpenSSL OpenSSL=0.9.6a-beta3
OpenSSL OpenSSL=0.9.6b
OpenSSL OpenSSL=0.9.6c
OpenSSL OpenSSL=0.9.6d
OpenSSL OpenSSL=0.9.6e
OpenSSL OpenSSL=0.9.6f
OpenSSL OpenSSL=0.9.6g
OpenSSL OpenSSL=0.9.6h
OpenSSL OpenSSL=0.9.6i
OpenSSL OpenSSL=0.9.6j
OpenSSL OpenSSL=0.9.6k
OpenSSL OpenSSL=0.9.6l
OpenSSL OpenSSL=0.9.6m
OpenSSL OpenSSL=0.9.7
OpenSSL OpenSSL=0.9.7-beta1
OpenSSL OpenSSL=0.9.7-beta2
OpenSSL OpenSSL=0.9.7-beta3
OpenSSL OpenSSL=0.9.7-beta4
OpenSSL OpenSSL=0.9.7-beta5
OpenSSL OpenSSL=0.9.7-beta6
OpenSSL OpenSSL=0.9.7a
OpenSSL OpenSSL=0.9.7b
OpenSSL OpenSSL=0.9.7c
OpenSSL OpenSSL=0.9.7d
OpenSSL OpenSSL=0.9.7e
OpenSSL OpenSSL=0.9.7f
OpenSSL OpenSSL=0.9.7g
OpenSSL OpenSSL=0.9.7h
OpenSSL OpenSSL=0.9.7i
OpenSSL OpenSSL=0.9.7j
OpenSSL OpenSSL=0.9.7k
OpenSSL OpenSSL=0.9.7l
OpenSSL OpenSSL=0.9.7m
OpenSSL OpenSSL=0.9.8
OpenSSL OpenSSL=0.9.8a
OpenSSL OpenSSL=0.9.8b
OpenSSL OpenSSL=0.9.8c
OpenSSL OpenSSL=0.9.8d
OpenSSL OpenSSL=0.9.8e
OpenSSL OpenSSL=0.9.8f
OpenSSL OpenSSL=0.9.8g
OpenSSL OpenSSL=0.9.8h
OpenSSL OpenSSL=0.9.8i
OpenSSL OpenSSL=0.9.8j
OpenSSL OpenSSL=0.9.8k
OpenSSL OpenSSL=0.9.8l
OpenSSL OpenSSL=0.9.8m
OpenSSL OpenSSL=0.9.8m-beta1
OpenSSL OpenSSL=0.9.8n
OpenSSL OpenSSL=0.9.8o
OpenSSL OpenSSL=0.9.8p
OpenSSL OpenSSL=0.9.8q
OpenSSL OpenSSL=0.9.8r
OpenSSL OpenSSL=0.9.8s
OpenSSL OpenSSL=1.0.0
OpenSSL OpenSSL=1.0.0-beta1
OpenSSL OpenSSL=1.0.0-beta2
OpenSSL OpenSSL=1.0.0-beta3
OpenSSL OpenSSL=1.0.0-beta4
OpenSSL OpenSSL=1.0.0-beta5
OpenSSL OpenSSL=1.0.0a
OpenSSL OpenSSL=1.0.0b
OpenSSL OpenSSL=1.0.0c
OpenSSL OpenSSL=1.0.0d
OpenSSL OpenSSL=1.0.0e
OpenSSL OpenSSL=1.0.0f
OpenSSL OpenSSL=1.0.0g
Event History
Mar 15, 2012
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-1165?
CVE-2012-1165 is classified as a denial of service vulnerability impacting OpenSSL.
2
How do I fix CVE-2012-1165?
To fix CVE-2012-1165, upgrade to OpenSSL version 0.9.8u or 1.0.0h or later.
3
What versions of OpenSSL are affected by CVE-2012-1165?
CVE-2012-1165 affects OpenSSL versions before 0.9.8u and 1.x before 1.0.0h.
4
What type of attack does CVE-2012-1165 enable?
CVE-2012-1165 enables remote attackers to cause a denial of service through a crafted S/MIME message.
5
Is CVE-2012-1165 a buffer overflow vulnerability?
No, CVE-2012-1165 is not a buffer overflow vulnerability; it involves a NULL pointer dereference.