CVE-2015-0292: Buffer Overflow
First published: Mon Mar 16 2015(Updated: )
A vulnerability existed in previous versions of OpenSSL related to the processing of base64-encoded data. Any code path that reads base64 data from an untrusted source could be affected (such as the PEM processing routines). Maliciously crafted base 64 data could trigger a segmenation fault or memory corruption. This was addressed in previous versions of OpenSSL but has not been included in any security advisory until now. This issue affects OpenSSL versions 1.0.1, 1.0.0, and 0.9.8. This issue is fixed in versions: 1.0.1h, 1.0.0m, and 0.9.8za. Acknowledgements: Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Robert Dugal and David Ramos as the original reporters.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openssl | <1.0.1 | 1.0.1 |
| redhat/openssl | <0.9.8 | 0.9.8 |
| OpenSSL OpenSSL | <=0.9.8z | |
| OpenSSL OpenSSL | =1.0.0 | |
| OpenSSL OpenSSL | =1.0.0a | |
| OpenSSL OpenSSL | =1.0.0b | |
| OpenSSL OpenSSL | =1.0.0c | |
| OpenSSL OpenSSL | =1.0.0d | |
| OpenSSL OpenSSL | =1.0.0e | |
| OpenSSL OpenSSL | =1.0.0f | |
| OpenSSL OpenSSL | =1.0.0g | |
| OpenSSL OpenSSL | =1.0.0h | |
| OpenSSL OpenSSL | =1.0.0i | |
| OpenSSL OpenSSL | =1.0.0j | |
| OpenSSL OpenSSL | =1.0.0k | |
| OpenSSL OpenSSL | =1.0.0l | |
| OpenSSL OpenSSL | =1.0.1 | |
| OpenSSL OpenSSL | =1.0.1a | |
| OpenSSL OpenSSL | =1.0.1b | |
| OpenSSL OpenSSL | =1.0.1c | |
| OpenSSL OpenSSL | =1.0.1d | |
| OpenSSL OpenSSL | =1.0.1e | |
| OpenSSL OpenSSL | =1.0.1f | |
| OpenSSL OpenSSL | =1.0.1g |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://rt.openssl.org/Ticket/Display.html?id=2608&user=guest&pass=guest
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d0666f2
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=84fe686
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9febee0
- https://openssl.org/news/secadv_20150319.txt
- https://access.redhat.com/articles/1384453
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1196738
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1203855
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1203856
- https://rhn.redhat.com/errata/RHSA-2015-0715.html
- https://rhn.redhat.com/errata/RHSA-2015-0716.html
- https://rhn.redhat.com/errata/RHSA-2015-0752.html
- https://rhn.redhat.com/errata/RHSA-2015-0800.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1202395
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
- http://marc.info/?l=bugtraq&m=143213830203296&w=2
- http://marc.info/?l=bugtraq&m=143748090628601&w=2
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://marc.info/?l=bugtraq&m=144050297101809&w=2
- http://rhn.redhat.com/errata/RHSA-2015-0715.html
- http://rhn.redhat.com/errata/RHSA-2015-0716.html
- http://rhn.redhat.com/errata/RHSA-2015-0752.html
- http://rhn.redhat.com/errata/RHSA-2015-0800.html
- http://www.debian.org/security/2015/dsa-3197
- http://www.fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- http://www.securityfocus.com/bid/73228
- http://www.securitytracker.com/id/1031929
- http://www.ubuntu.com/usn/USN-2537-1
- https://bto.bluecoat.com/security-advisory/sa92
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=d0666f289ac013094bbbf547bfbcd616199b7d2d
- https://kc.mcafee.com/corporate/index?page=content&id=SB10110
- https://security.gentoo.org/glsa/201503-11
- https://support.citrix.com/article/CTX216642
- https://www.openssl.org/news/secadv_20150319.txt
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=d0666f289ac013094bbbf547bfbcd616199b7d2d
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/references
- agent/description
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-0292
- agent/software-canonical-lookup
- vendor/openssl
- canonical/openssl openssl
- version/openssl openssl/0.9.8z
- version/openssl openssl/1.0.0
- version/openssl openssl/1.0.0a
- version/openssl openssl/1.0.0b
- version/openssl openssl/1.0.0c
- version/openssl openssl/1.0.0d
- version/openssl openssl/1.0.0e
- version/openssl openssl/1.0.0f
- version/openssl openssl/1.0.0g
- version/openssl openssl/1.0.0h
- version/openssl openssl/1.0.0i
- version/openssl openssl/1.0.0j
- version/openssl openssl/1.0.0k
- version/openssl openssl/1.0.0l
- version/openssl openssl/1.0.1
- version/openssl openssl/1.0.1a
- version/openssl openssl/1.0.1b
- version/openssl openssl/1.0.1c
- version/openssl openssl/1.0.1d
- version/openssl openssl/1.0.1e
- version/openssl openssl/1.0.1f
- version/openssl openssl/1.0.1g
- package-manager/redhat