CVE-2015-0292: Buffer Overflow
A vulnerability existed in previous versions of OpenSSL related to the processing of base64-encoded data. Any code path that reads base64 data from an untrusted source could be affected (such as the PEM processing routines). Maliciously crafted base 64 data could trigger a segmenation fault or memory corruption. This was addressed in previous versions of OpenSSL but has not been included in any security advisory until now.
This issue affects OpenSSL versions 1.0.1, 1.0.0, and 0.9.8. This issue is fixed in versions: 1.0.1h, 1.0.0m, and 0.9.8za.
Acknowledgements:
Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Robert Dugal and David Ramos as the original reporters.
Other sources
Integer underflow in the EVPDecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0292?
CVE-2015-0292 has been classified as a high severity vulnerability due to its potential to trigger segmentation faults from crafted base64 data.
How do I fix CVE-2015-0292?
To fix CVE-2015-0292, update OpenSSL to version 1.0.1 or later, or apply the relevant patches from your distribution.
Which versions of OpenSSL are affected by CVE-2015-0292?
CVE-2015-0292 affects OpenSSL versions 0.9.8 through 1.0.1, including all iterations of these versions.
What type of attacks does CVE-2015-0292 enable?
CVE-2015-0292 can enable denial of service attacks through segmentation faults when processing maliciously crafted base64 data.
Is CVE-2015-0292 being actively exploited?
As of the last reports, there have been instances of CVE-2015-0292 being exploited in the wild, highlighting the need for prompt remediation.