CVE-2015-5334
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an incorrect fix for CVE-2014-3508.
Un error por un paso en la función OBJ_obj2txt en LibreSSL versiones anteriores a 2.3.1, permite a atacantes remotos causar una denegación de servicio (bloqueo del programa) o posible ejecutar código arbitrario por medio de un certificado X.509 diseñado, que desencadena un desbordamiento de búfer en la región stack de la memoria. Nota: esta vulnerabilidad se presenta debido a una corrección incorrecta para CVE-2014-3508.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-07-01 CVE Reserved
- 2015-10-18 CVE Published
- 2023-03-26 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
http://lists.opensuse.org/opensuse-updates/2015-10/msg00050.html | Mailing List | |
http://www.securityfocus.com/archive/1/archive/1/536692/100/0/threaded | Broken Link |
URL | Date | SRC |
---|---|---|
http://packetstormsecurity.com/files/133998/Qualys-Security-Advisory-LibreSSL-Leak-Overflow.html | 2024-08-06 | |
http://seclists.org/fulldisclosure/2015/Oct/75 | 2024-08-06 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.1-relnotes.txt | 2020-01-30 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Openbsd Search vendor "Openbsd" | Libressl Search vendor "Openbsd" for product "Libressl" | < 2.3.1 Search vendor "Openbsd" for product "Libressl" and version " < 2.3.1" | - |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 13.2 Search vendor "Opensuse" for product "Opensuse" and version "13.2" | - |
Affected
|