Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apache | — | Apply OS X security update 2008-007 | Dec 16, 2011 | Jul 10, 2008 |
| Centos_linux | — | Upgrade httpdUpgrade httpd-develUpgrade mod_sslUpgrade httpd-manual | Dec 1, 2016 | Jul 10, 2008 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Jul 10, 2008 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Oct 30, 2017 | Jul 10, 2008 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Nov 18, 2010 | Jul 10, 2008 |
| Oracle_linux | — | Upgrade httpdUpgrade httpd-develUpgrade mod_sslUpgrade httpd-manual | Oct 16, 2024 | Jul 10, 2008 |
| Suse | — | Upgrade apache2-manualUpgrade apache2-eventUpgrade apache2-example-pagesUpgrade apache2-docUpgrade apache2-develUpgrade apache2Upgrade apache2-workerUpgrade apache2-preforkUpgrade apache2-utils | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade apache2.2-commonUpgrade apache2-mpm-workerUpgrade apache2-mpm-preforkUpgrade apache2-commonUpgrade apache2-mpm-perchildUpgrade apache2-mpm-event | Nov 8, 2024 | Jul 10, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub