The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libcrypto1.0.0-udeb" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libcrypto1.0.0-udeb-dbgsym" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libssl-dev" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libssl-dev-dbgsym" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libssl-doc" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libssl1.0.0" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libssl1.0.0-dbg" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libssl1.0.0-dbgsym" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libssl1.0.0-udeb" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "libssl1.0.0-udeb-dbgsym" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "openssl" }, { "binary_version": "1.0.1f-1ubuntu2.16", "binary_name": "openssl-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libcrypto1.0.0-udeb" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libcrypto1.0.0-udeb-dbgsym" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libssl-dev" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libssl-dev-dbgsym" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libssl-doc" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libssl1.0.0" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libssl1.0.0-dbg" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libssl1.0.0-dbgsym" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libssl1.0.0-udeb" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "libssl1.0.0-udeb-dbgsym" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "openssl" }, { "binary_version": "1.0.2e-1ubuntu1", "binary_name": "openssl-dbgsym" } ] }