Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an incorrect fix for CVE-2014-3508.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Openssh | — | Upgrade macOS to the latest versionApply OS X security update 2016-002 | Mar 29, 2016 | Mar 29, 2016 |
| Freebsd | — | Upgrade libressl | Dec 10, 2025 | Oct 16, 2015 |
| Suse | — | Upgrade libssl37Upgrade libressl-develUpgrade libressl-debuginfoUpgrade libcrypto36-32bitUpgrade libssl37-debuginfoUpgrade libssl37-debuginfo-32bitUpgrade libcrypto36-debuginfoUpgrade libressl-debugsourceUpgrade libressl-devel-docUpgrade libtls9Upgrade libresslUpgrade libssl37-32bitUpgrade libcrypto36Upgrade libressl-devel-32bitUpgrade libcrypto36-debuginfo-32bitUpgrade libtls9-32bitUpgrade libtls9-debuginfoUpgrade libtls9-debuginfo-32bit | Dec 18, 2015 | Oct 27, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub