VYPR

OpenSSL

by OpenSSL Project

TLS/SSL and cryptography toolkit.

libraryLicense: Apache-2.0WebsiteDocsChangelog

Source repositories

CVEs (378)

  • CVE-2011-4577Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.09

    OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous System…

  • CVE-2011-4576Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.15

    The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

  • CVE-2011-4109Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.18

    Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

  • CVE-2011-4108Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.16

    The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

  • CVE-2011-0014Feb 19, 2011
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.10

    ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an…

  • CVE-2010-4252Dec 6, 2010
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.08

    OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of…

  • CVE-2010-4180Dec 6, 2010
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.10

    OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors…

  • CVE-2010-0742Jun 3, 2010
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.08

    The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct…

  • CVE-2010-0433Mar 5, 2010
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.08

    The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference…

  • CVE-2009-3245Mar 5, 2010
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.07

    OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

  • CVE-2009-4355Jan 14, 2010
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.09

    Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the…

  • CVE-2009-1387Jun 4, 2009
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.10

    The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."

  • CVE-2009-1378May 19, 2009
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.13

    Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers…

  • CVE-2009-1377May 19, 2009
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.11

    The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer…

  • CVE-2007-4995Oct 13, 2007
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.11

    Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2007-5135Sep 27, 2007
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.16

    Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a…

  • CVE-2007-2768May 21, 2007
    NetApp
    Hci Management Node
    risk 0.01cvss —epss 0.09

    OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to…

  • CVE-2006-4925Sep 29, 2006
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.15

    packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.

  • CVE-2006-2937Sep 28, 2006
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.11

    OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition.

  • CVE-2004-2760Dec 31, 2004
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.09

    sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess…

Page 12 of 19