CVE-2007-5135
CVE-2007-5135
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a fix for CVE-2006-3738. As of 20071012, it is unknown whether code execution is possible.
EPSS 16.1% · Fix available
- Published
- Updated
Affected products and versions
Original sources
- https://bugs.gentoo.org/show_bug.cgi?id=194039
- http://www.securityfocus.com/archive/1/484353/100/0/threaded
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5337
- http://www.securityfocus.com/archive/1/481217/100/0/threaded
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0241
- http://secunia.com/advisories/27205
- http://secunia.com/advisories/27097
- http://www.vupen.com/english/advisories/2008/2362
- http://www.securitytracker.com/id?1018755
- http://secunia.com/advisories/31489
- http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
- https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00218.html
- http://www.redhat.com/support/errata/RHSA-2007-1003.html
- http://secunia.com/advisories/29242
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:193
- https://issues.rpath.com/browse/RPL-1770
- http://secunia.com/advisories/27186
- http://secunia.com/advisories/27851
- http://www.vupen.com/english/advisories/2008/2268
- http://secunia.com/advisories/30124
- http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
- http://secunia.com/advisories/27394
- http://www.openbsd.org/errata41.html
- https://nvd.nist.gov/vuln/detail/CVE-2007-5135