509608 – (CVE-2014-0198) dev-libs/openssl: s3_pkt.c do_ssl3_write() null pointer dereference DoS

Bug 509608 (CVE-2014-0198) - dev-libs/openssl: s3_pkt.c do_ssl3_write() null pointer dereference DoS

Summary: dev-libs/openssl: s3_pkt.c do_ssl3_write() null pointer dereference DoS

Status:	RESOLVED DUPLICATE of bug 512506

Alias:	CVE-2014-0198

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Security

URL:	https://bugzilla.redhat.com/show_bug....
Whiteboard:	A3 [ebuild]
Keywords:

Depends on:
Blocks:

Reported:	2014-05-05 08:27 UTC by Agostino Sarubbo
Modified:	2014-06-05 22:19 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Agostino Sarubbo gentoo-dev

2014-05-05 08:27:56 UTC

From ${URL} :

The OpenBSD Project reports:

An attacker can trigger generation of an SSL alert which could cause a null pointer dereference.

External references:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/005_openssl.patch.sig
https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 1 SpanKY gentoo-dev

2014-06-05 15:48:38 UTC

should be fixed with 1.0.1h

Comment 2 Kristian Fiskerstrand (RETIRED) gentoo-dev

2014-06-05 22:19:33 UTC

This issue is handled in an aggregate bug for multiple vulnerabilities released today.

*** This bug has been marked as a duplicate of bug 512506 ***