Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote attackers to cause a denial of service (crash) via a malformed Client Hello packet. NOTE: some of these details are obtained from third party information.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade openssl | Jul 30, 2024 | May 29, 2008 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Oct 30, 2017 | May 29, 2008 |
| Oracle_linux | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-staticUpgrade openssl-devel | May 13, 2016 | May 29, 2008 |
| Suse | — | Upgrade libopenssl1_0_0-32bitUpgrade openssl-docUpgrade libopenssl1-develUpgrade libopenssl0_9_8Upgrade opensslUpgrade libopenssl1_0_0Upgrade libopenssl0_9_8-x86Upgrade openssl1Upgrade openssl1-docUpgrade libopenssl0_9_8-hmacUpgrade libopenssl0_9_8-32bitUpgrade libopenssl0_9_8-hmac-32bitUpgrade libopenssl-fips-providerUpgrade libopenssl-devel | Aug 9, 2024 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libssl0.9.8 | Nov 8, 2024 | May 29, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub