Vulnerabilities > Openssl > Openssl > 0.9.8
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2010-01-14 | CVE-2009-4355 | Resource Management Errors vulnerability in multiple products Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678. | 5.0 |
2009-03-27 | CVE-2009-0789 | Numeric Errors vulnerability in Openssl OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA public key. | 5.0 |
2009-03-27 | CVE-2009-0590 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length. | 5.0 |
2009-01-07 | CVE-2008-5077 | Improper Input Validation vulnerability in Openssl OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. | 5.8 |
2007-10-13 | CVE-2007-4995 | Numeric Errors vulnerability in Openssl Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors. | 9.3 |
2007-09-27 | CVE-2007-5135 | Numeric Errors vulnerability in Openssl Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. | 6.8 |
2007-08-08 | CVE-2007-3108 | Local Information Disclosure vulnerability in OpenSSL Montgomery Exponentiation Side-Channel The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys. | 1.2 |
2006-09-28 | CVE-2006-4343 | Null Pointer Dereference vulnerability in multiple products The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference. | 4.3 |
2006-09-28 | CVE-2006-3738 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Openssl Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers. | 10.0 |
2006-09-28 | CVE-2006-2940 | Resource Management Errors vulnerability in Openssl OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification. | 7.8 |