CVE-2015-1789
Fixed in a distro release EPSS 76%
The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.
Products: openssl, oracle sparc-opl_service_processor
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openssl | 1.0.2b-1 |
| Debian 13 | openssl | 1.0.2b-1 |
| Debian 14 | openssl | 1.0.2b-1 |
| Debian 6.0 | openssl | 0.9.8o-4squeeze21 |
| Debian 7 | openssl | 1.0.1e-2+deb7u17 |
| Debian 8 | openssl | 1.0.1k-3+deb8u1 |
| Red Hat Enterprise Linux 5 | openssl | 0:0.9.8e-36.el5_11 |
| Red Hat Enterprise Linux 5 | openssl-debuginfo | 0:0.9.8e-36.el5_11 |
| Red Hat Enterprise Linux 5 | openssl-devel | 0:0.9.8e-36.el5_11 |
| Red Hat Enterprise Linux 5 | openssl-perl | 0:0.9.8e-36.el5_11 |
| Red Hat Enterprise Linux 6 | openssl | 0:1.0.1e-30.el6_6.11 |
| Red Hat Enterprise Linux 6 | openssl-debuginfo | 0:1.0.1e-30.el6_6.11 |
| Red Hat Enterprise Linux 6 | openssl-devel | 0:1.0.1e-30.el6_6.11 |
| Red Hat Enterprise Linux 6 | openssl-perl | 0:1.0.1e-30.el6_6.11 |
| Red Hat Enterprise Linux 6 | openssl-static | 0:1.0.1e-30.el6_6.11 |
| Red Hat Enterprise Linux 7 | openssl | 1:1.0.1e-42.ael7b_1.8 |
| Red Hat Enterprise Linux 7 | openssl | 1:1.0.1e-42.el7_1.8 |
| Red Hat Enterprise Linux 7 | openssl-debuginfo | 1:1.0.1e-42.ael7b_1.8 |
| Red Hat Enterprise Linux 7 | openssl-debuginfo | 1:1.0.1e-42.el7_1.8 |
| Red Hat Enterprise Linux 7 | openssl-devel | 1:1.0.1e-42.el7_1.8 |
| Red Hat Enterprise Linux 7 | openssl-devel | 1:1.0.1e-42.ael7b_1.8 |
| Red Hat Enterprise Linux 7 | openssl-libs | 1:1.0.1e-42.ael7b_1.8 |
| Red Hat Enterprise Linux 7 | openssl-libs | 1:1.0.1e-42.el7_1.8 |
| Red Hat Enterprise Linux 7 | openssl-perl | 1:1.0.1e-42.el7_1.8 |
| Red Hat Enterprise Linux 7 | openssl-perl | 1:1.0.1e-42.ael7b_1.8 |
| Red Hat Enterprise Linux 7 | openssl-static | 1:1.0.1e-42.el7_1.8 |
| Red Hat Enterprise Linux 7 | openssl-static | 1:1.0.1e-42.ael7b_1.8 |
| SUSE Linux Enterprise Desktop 11 SP3 | mysql | 5.5.46-0.14.1 |
| SUSE Linux Enterprise Desktop 11 SP4 | mysql | 5.5.46-0.14.1 |
| SUSE Linux Enterprise Desktop 12 | compat-openssl098 | 0.9.8j-78.1 |
| SUSE Linux Enterprise Desktop 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Desktop 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Desktop 12 | openssl | 1.0.1i-25.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Module for Legacy 12 | compat-openssl098 | 0.9.8j-78.1 |
| SUSE Linux Enterprise Server 11 SP3 | mysql | 5.5.46-0.14.1 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | mysql | 5.5.46-0.14.1 |
| SUSE Linux Enterprise Server 11 SP4 | mysql | 5.5.46-0.14.1 |
| SUSE Linux Enterprise Server 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Server 12 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Server 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Server 12 | openssl | 1.0.1i-25.1 |
| SUSE Linux Enterprise Server 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Server 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Server 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP3 | mysql | 5.5.46-0.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | mysql | 5.5.46-0.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openssl | 1.0.1i-25.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP3 | mysql | 5.5.46-0.14.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | mysql | 5.5.46-0.14.1 |
| SUSE Linux Enterprise Software Development Kit 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Software Development Kit 12 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Software Development Kit 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Software Development Kit 12 | openssl | 1.0.1i-25.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Workstation Extension 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Workstation Extension 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.15 |
| openSUSE Tumbleweed | libressl | 2.5.0-1.1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 |