CVE - CVE-2011-3207

CVE-ID
CVE-2011-3207	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
APPLE:APPLE-SA-2013-06-04-1 URL:http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html CONFIRM:http://cvs.openssl.org/chngview?cn=21349 CONFIRM:http://openssl.org/news/secadv_20110906.txt CONFIRM:http://support.apple.com/kb/HT5784 CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=736087 FEDORA:FEDORA-2011-12233 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065744.html FEDORA:FEDORA-2011-12281 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065712.html FEDORA:FEDORA-2012-18035 URL:http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html HP:HPSBMU02752 URL:http://marc.info/?l=bugtraq&m=133226187115472&w=2 HP:SSRT100802 URL:http://marc.info/?l=bugtraq&m=133226187115472&w=2 MANDRIVA:MDVSA-2011:137 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2011:137~~ (Obsolete source) REDHAT:RHSA-2011:1409 URL:http://www.redhat.com/support/errata/RHSA-2011-1409.html SECTRACK:1026012 URL:http://www.securitytracker.com/id?1026012 SECUNIA:45956 URL:http://secunia.com/advisories/45956 SECUNIA:57353 URL:http://secunia.com/advisories/57353
Assigning CNA
Red Hat, Inc.
Date Record Created
20110819	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20110819)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)