openssl vulnerabilities and exploits

(subscribe to this query)

The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and previous versions, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-...

Openssl Openssl Openssl Openssl 0.9.1c Openssl Openssl 0.9.2b Openssl Openssl 0.9.3 Openssl Openssl 0.9.3a Openssl Openssl 0.9.4 Openssl Openssl 0.9.5 Openssl Openssl 0.9.5a Openssl Openssl 0.9.6 Openssl Openssl 0.9.6a Openssl Openssl 0.9.6b Openssl Openssl 0.9.6c

The DTLS implementation in OpenSSL prior to 0.9.8s and 1.x prior to 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote malicious users to recover plaintext via a padding oracle attack.

Openssl Openssl Openssl Openssl 0.9.1c Openssl Openssl 0.9.2b Openssl Openssl 0.9.4 Openssl Openssl 0.9.5 Openssl Openssl 0.9.5a Openssl Openssl 0.9.6 Openssl Openssl 0.9.6a Openssl Openssl 0.9.6b Openssl Openssl 0.9.6c Openssl Openssl 0.9.6d Openssl Openssl 0.9.6e

The SSL 3.0 implementation in OpenSSL prior to 0.9.8s and 1.x prior to 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote malicious users to obtain sensitive information by decrypting the padding data sent by an SSL peer.

Openssl Openssl Openssl Openssl 0.9.1c Openssl Openssl 0.9.2b Openssl Openssl 0.9.4 Openssl Openssl 0.9.5 Openssl Openssl 0.9.5a Openssl Openssl 0.9.6 Openssl Openssl 0.9.6a Openssl Openssl 0.9.6b Openssl Openssl 0.9.6c Openssl Openssl 0.9.6d Openssl Openssl 0.9.6e

OpenSSL prior to 0.9.8s and 1.x prior to 1.0.0f, when RFC 3779 support is enabled, allows remote malicious users to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous...

Openssl Openssl Openssl Openssl 0.9.1c Openssl Openssl 0.9.2b Openssl Openssl 0.9.4 Openssl Openssl 0.9.5 Openssl Openssl 0.9.5a Openssl Openssl 0.9.6 Openssl Openssl 0.9.6a Openssl Openssl 0.9.6b Openssl Openssl 0.9.6c Openssl Openssl 0.9.6d Openssl Openssl 0.9.6e

The Server Gated Cryptography (SGC) implementation in OpenSSL prior to 0.9.8s and 1.x prior to 1.0.0f does not properly handle handshake restarts, which allows remote malicious users to cause a denial of service (CPU consumption) via unspecified vectors.

Openssl Openssl Openssl Openssl 0.9.1c Openssl Openssl 0.9.2b Openssl Openssl 0.9.4 Openssl Openssl 0.9.5 Openssl Openssl 0.9.5a Openssl Openssl 0.9.6 Openssl Openssl 0.9.6a Openssl Openssl 0.9.6b Openssl Openssl 0.9.6c Openssl Openssl 0.9.6d Openssl Openssl 0.9.6e

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that...

Openssl Openssl Openssl Openssl 1.0.2 Openssl Openssl 1.0.2a Openssl Openssl 1.0.2b Openssl Openssl 1.0.2c Openssl Openssl 1.0.2d Openssl Openssl 1.0.2e Openssl Openssl 1.0.2f Openssl Openssl 1.0.2g Openssl Openssl 1.0.2h Openssl Openssl 1.0.2i Openssl Openssl 1.0.2j

1 Github repository

The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL prior to 0.9.8o and 1.x prior to 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent malicious users to modify invalid memory locations or ...

Openssl Openssl Openssl Openssl 0.9.1c Openssl Openssl 0.9.2b Openssl Openssl 0.9.3 Openssl Openssl 0.9.3a Openssl Openssl 0.9.4 Openssl Openssl 0.9.5 Openssl Openssl 0.9.5a Openssl Openssl 0.9.6 Openssl Openssl 0.9.6a Openssl Openssl 0.9.6b Openssl Openssl 0.9.6c

The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and previous versions allows remote malicious users to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message.

Openssl Openssl Openssl Openssl 0.9.1c Openssl Openssl 0.9.2b Openssl Openssl 0.9.3 Openssl Openssl 0.9.3a Openssl Openssl 0.9.4 Openssl Openssl 0.9.5 Openssl Openssl 0.9.5a Openssl Openssl 0.9.6 Openssl Openssl 0.9.6a Openssl Openssl 0.9.6b Openssl Openssl 0.9.6c

The GOST ENGINE in OpenSSL prior to 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote malicious users to cause a denial of service (daemon crash) via crafted data from a TLS client.

Openssl Openssl Openssl Openssl 0.9.1c Openssl Openssl 0.9.2b Openssl Openssl 0.9.3 Openssl Openssl 0.9.3a Openssl Openssl 0.9.4 Openssl Openssl 0.9.5 Openssl Openssl 0.9.5a Openssl Openssl 0.9.6 Openssl Openssl 0.9.6a Openssl Openssl 0.9.6b Openssl Openssl 0.9.6c

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 prior to 0.9.8zb, 1.0.0 prior to 1.0.0n, and 1.0.1 prior to 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake mess...

Openssl Openssl 0.9.8 Openssl Openssl 0.9.8a Openssl Openssl 0.9.8b Openssl Openssl 0.9.8c Openssl Openssl 0.9.8d Openssl Openssl 0.9.8e Openssl Openssl 0.9.8f Openssl Openssl 0.9.8g Openssl Openssl 0.9.8h Openssl Openssl 0.9.8i Openssl Openssl 0.9.8j Openssl Openssl 0.9.8k

1 Github repository

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook