CVE-2009-4355
Fixed in a distro release EPSS 9%
Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
Products: openssl, redhat openssl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openssl | 0.9.8k-8 |
| Debian 13 | openssl | 0.9.8k-8 |
| Debian 14 | openssl | 0.9.8k-8 |
| Debian 5.0 | openssl | 0.9.8g-15+lenny6 |
| Red Hat Enterprise Linux 5 | openssl | 0:0.9.8e-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | openssl-debuginfo | 0:0.9.8e-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | openssl-devel | 0:0.9.8e-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | openssl-perl | 0:0.9.8e-12.el5_4.1 |