CVSS: 5.0EPSS: 94%CPEs: 33EXPL: 0CVE-2015-0286 – openssl: invalid pointer use in ASN1_TYPE_cmp()
https://notcve.org/view.php?id=CVE-2015-0286
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature. La función ASN1_TYPE_cmp en crypto/asn1/a_type.c en OpenSSL anterior a 0.9.8zf, 1.0.0 anterior a 1.0.0r, 1.0.1 anterior a 1.0.1m, y 1.0.2 anterior a 1.0.2a no realiza correctamente las comparaciones tipo boolean, lo que permite a atacantes remotos causar una denegación de servicio (operación de lectura inválida y caída de aplicación) a través de un certificado X.509 manipulado en un endpoint que utiliza la característica de verificación de certificados. An invalid pointer use flaw was found in OpenSSL's ASN1_TYPE_cmp() function. A remote attacker could crash a TLS/SSL client or server using OpenSSL via a specially crafted X.509 certificate when the attacker-supplied certificate was verified by the application. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html http://lists.fedoraproject.org/pipermail/package-announce/2015-Ma • CWE-17: DEPRECATED: Code CWE-125: Out-of-bounds Read •
CVSS: 5.0EPSS: 1%CPEs: 33EXPL: 0CVE-2015-0287 – openssl: ASN.1 structure reuse memory corruption
https://notcve.org/view.php?id=CVE-2015-0287
The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse. La función ASN1_item_ex_d2i en crypto/asn1/tasn_dec.c en OpenSSL anterior a 0.9.8zf, 1.0.0 anterior a 1.0.0r, 1.0.1 anterior a 1.0.1m, y 1.0.2 anterior a 1.0.2a no reinicializa estructuras de datos CHOICE y ADB, lo que podría permitir a atacantes causar una denegación de servicio (operación de escritura inválida y corrupción de memoria) mediante el aprovechamiento de una aplicación que depende del reuso de estructuras ASN.1. An out-of-bounds write flaw was found in the way OpenSSL reused certain ASN.1 structures. A remote attacker could possibly use a specially crafted ASN.1 structure that, when parsed by an application, would cause that application to crash. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html http://lists.fedoraproject.org/pipermail/package-announce/2015-Ma • CWE-17: DEPRECATED: Code CWE-787: Out-of-bounds Write •
CVSS: 5.0EPSS: 1%CPEs: 33EXPL: 0CVE-2015-0288 – openssl: X509_to_X509_REQ NULL pointer dereference
https://notcve.org/view.php?id=CVE-2015-0288
The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key. La función X509_to_X509_REQ en crypto/x509/x509_req.c en OpenSSL anterior a 0.9.8zf, 1.0.0 anterior a 1.0.0r, 1.0.1 anterior a 1.0.1m, y 1.0.2 anterior a 1.0.2a podría permitir a atacantes causar una denegación de servicio (referencia a puntero nulo y caída de aplicación) a través de una clave de certificado inválida. A NULL pointer dereference flaw was found in OpenSSL's X.509 certificate handling implementation. A specially crafted X.509 certificate could cause an application using OpenSSL to crash if the application attempted to convert the certificate to a certificate request. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156823.html http://lists.fedoraproject.org/pipermail/package-announce/ • CWE-476: NULL Pointer Dereference •
CVSS: 5.0EPSS: 1%CPEs: 33EXPL: 0CVE-2015-0289 – openssl: PKCS7 NULL pointer dereference
https://notcve.org/view.php?id=CVE-2015-0289
The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c. La implementación PKCS#7 en OpenSSL anterior a 0.9.8zf, 1.0.0 anterior a 1.0.0r, 1.0.1 anterior a 1.0.1m, y 1.0.2 anterior a 1.0.2a no maneja correctamente la falta de ContentInfo exterior, lo que permite a atacantes causar una denegación de servicio (referencia a puntero nulo y caída de aplicación) mediante el aprovechamiento de una aplicación que procesa datos PKCS#7 arbitrarios y la provisión de datos malformados con una codificación ASN.1, relacionado con crypto/pkcs7/pk7_doit.c y crypto/pkcs7/pk7_lib.c. A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS#7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected by this flaw. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156823.html http://lists.fedoraproject.org/pipermail/package-announce/ • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 18%CPEs: 22EXPL: 1CVE-2015-0292 – openssl: integer underflow leading to buffer overflow in base64 decoding
https://notcve.org/view.php?id=CVE-2015-0292
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow. Subdesbordamiento de enteros en la función EVP_DecodeUpdate en crypto/evp/encode.c en la implementación base64-decoding en OpenSSL anterior a 0.9.8za, 1.0.0 anterior a 1.0.0m, y 1.0.1 anterior a 1.0.1h permite a atacantes remotos causar una denegación de servicio (corrupción de memoria) o posiblemente tener otro impacto no especificado a través de datos base64 manipulados que provocan un desbordamiento de buffer. An integer underflow flaw, leading to a buffer overflow, was found in the way OpenSSL decoded malformed Base64-encoded inputs. An attacker able to make an application using OpenSSL decode a specially crafted Base64-encoded input (such as a PEM file) could use this flaw to cause the application to crash. Note: this flaw is not exploitable via the TLS/SSL protocol because the data being transferred is not Base64-encoded. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html http://marc.info/?l=bugtraq&m=143213830203296&w=2 http://marc.info/?l=bugtraq&m=143748090628601&w=2 http://marc.inf • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •