CVE - CVE-2015-1790

CVE-ID
CVE-2015-1790	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/openssl/openssl/commit/59302b600e8d5b77ef144e447bb046fd7ab72686 CONFIRM:https://www.openssl.org/news/secadv_20150611.txt CONFIRM:https://support.apple.com/kb/HT205031 CONFIRM:http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM:http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044 CONFIRM:http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351 CONFIRM:http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html CONFIRM:http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM:http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015 CONFIRM:http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733 CONFIRM:https://openssl.org/news/secadv/20150611.txt CONFIRM:http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015 CONFIRM:http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015 CONFIRM:https://bto.bluecoat.com/security-advisory/sa98 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05353965 CONFIRM:https://kc.mcafee.com/corporate/index?page=content&id=SB10122 CONFIRM:http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html CONFIRM:http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html APPLE:APPLE-SA-2015-08-13-2 URL:http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html CISCO:20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products URL:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl DEBIAN:DSA-3287 URL:http://www.debian.org/security/2015/dsa-3287 FEDORA:FEDORA-2015-10047 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160436.html FEDORA:FEDORA-2015-10108 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160647.html GENTOO:GLSA-201506-02 URL:https://security.gentoo.org/glsa/201506-02 HP:HPSBUX03388 URL:http://marc.info/?l=bugtraq&m=143880121627664&w=2 HP:SSRT102180 URL:http://marc.info/?l=bugtraq&m=143880121627664&w=2 HP:HPSBGN03371 URL:http://marc.info/?l=bugtraq&m=143654156615516&w=2 HP:HPSBMU03409 URL:http://marc.info/?l=bugtraq&m=144050155601375&w=2 NETBSD:NetBSD-SA2015-008 URL:http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc REDHAT:RHSA-2015:1115 URL:http://rhn.redhat.com/errata/RHSA-2015-1115.html REDHAT:RHSA-2015:1197 URL:http://rhn.redhat.com/errata/RHSA-2015-1197.html SUSE:openSUSE-SU-2016:0640 URL:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html SUSE:openSUSE-SU-2015:1277 URL:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html SUSE:SUSE-SU-2015:1143 URL:http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html SUSE:SUSE-SU-2015:1150 URL:http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html SUSE:SUSE-SU-2015:1181 URL:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html SUSE:SUSE-SU-2015:1182 URL:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html SUSE:SUSE-SU-2015:1183 URL:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html SUSE:SUSE-SU-2015:1184 URL:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html SUSE:openSUSE-SU-2015:1139 URL:http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html SUSE:SUSE-SU-2015:1185 URL:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html UBUNTU:USN-2639-1 URL:http://www.ubuntu.com/usn/USN-2639-1 BID:91787 URL:http://www.securityfocus.com/bid/91787 BID:75157 URL:http://www.securityfocus.com/bid/75157 SECTRACK:1032564 URL:http://www.securitytracker.com/id/1032564
Assigning CNA
N/A
Date Entry Created
20150217	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20150217)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org