CVE-2003-0545 Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 e...
CriticalCVSS 9.8
EPSS 87.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenSSL | = 0.9.6 | No fix listed |
| OpenSSL | = 0.9.7 | No fix listed |
| debian/openssl(Debian:12) | < 0.9.7c | 0.9.7c |
| debian/openssl(Debian:13) | < 0.9.7c | 0.9.7c |
| debian/openssl(Debian:14) | < 0.9.7c | 0.9.7c |
References
- 22249 broken-link third-party-advisory vendor-advisory
- www-1.ibm.com broken-link
- CA-2003-26 third-party-advisory us-government-resource
- DSA-394 broken-link vendor-advisory
- VU#935264 third-party-advisory us-government-resource
- RHSA-2003:292 broken-link patch vendor-advisory
- 8732 broken-link third-party-advisory vdb-entry
- www.uniras.gov.uk broken-link patch vendor-advisory
- ADV-2006-3900 broken-link vdb-entry
- oval:org.mitre.oval:def:2590 broken-link signature vdb-entry
- Debian Security Tracker CVE-2003-0545 vendor-advisory