CVE-2009-4355
CVE-2009-4355
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
EPSS 9.2% · Fix available
- Published
- Updated
Affected products and versions
Original sources
- http://www.debian.org/security/2010/dsa-1970
- http://www.vupen.com/english/advisories/2010/0916
- http://cvs.openssl.org/chngview?cn=19167
- http://secunia.com/advisories/42724
- http://secunia.com/advisories/39461
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11260
- https://bugzilla.redhat.com/show_bug.cgi?id=546707
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049
- http://secunia.com/advisories/38761
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0004
- http://secunia.com/advisories/38181
- http://secunia.com/advisories/38200
- https://issues.rpath.com/browse/RPL-3157
- http://www.vupen.com/english/advisories/2010/0839
- http://cvs.openssl.org/chngview?cn=19069
- http://marc.info/?l=bugtraq&m=127128920008563&w=2
- http://cvs.openssl.org/chngview?cn=19068
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:022
- https://rhn.redhat.com/errata/RHSA-2010-0095.html
- http://www.ubuntu.com/usn/USN-884-1
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
- http://www.openwall.com/lists/oss-security/2010/01/13/3
- https://nvd.nist.gov/vuln/detail/CVE-2009-4355