Bug 567564 (CVE-2015-3194)

Summary:

<dev-libs/libressl-2.2.4-r1: NULL Pointer dereference in client certification validation (CVE-2015-3194)

Product:

Gentoo Security

Reporter:

Aric Belsito <lluixhi>

Component:

Vulnerabilities

Assignee:

Gentoo Security <security>

Status:

RESOLVED FIXED

Severity:

normal

CC:

blueness, hasufell

Priority:

Normal

Version:

unspecified

Hardware:

All

OS:

Linux

URL:

Whiteboard:

~3 [noglsa]

---

Attachments:

Description	Flags
Patch for use in tree.	none

Description Aric Belsito 2015-12-05 03:08:11 UTC

Security vulnerability.

This patch should be applied to both libressl-2.2.4 and libressl-2.3.1, the current in-tree versions.

Reproducible: Always

Comment 1 Aric Belsito 2015-12-05 03:08:47 UTC

Created attachment 418584 [details, diff]
Patch for use in tree.

Comment 2 Anthony Basile gentoo-dev

2015-12-05 12:45:06 UTC

The fix is in the tree and the vulnerable versions removed.